Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hijack this log, I could use some help please


  • This topic is locked This topic is locked
8 replies to this topic

#1 buyerat

buyerat

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:25 AM

Posted 22 July 2009 - 08:49 PM

I was told I should inform you that I tried to follow the instructions in the prep guide but was unable to get DDS to run. Garmanma was able very helpful and got me to download and run RSIT which allowed me to run hijackthis (which I was also unable to get to run before).





Logfile of random's system information tool 1.06 (written by random/random)
Run by at 2009-07-22 20:29:51
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 9 GB (3%) free of 286 GB
Total RAM: 2047 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:30:23 PM, on 7/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys\WMP300N\WLService.exe
C:\Program Files\Linksys\WMP300N\WMP300N.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Desktop\RSIT.exe
C:\WINDOWS\system32\winmine.exe
C:\Program Files\trend micro\
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [nozodumeza] Rundll32.exe "C:\WINDOWS\system32\suhowumu.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [nozodumeza] Rundll32.exe "C:\WINDOWS\system32\suhowumu.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-746137067-1123561945-839522115-1006\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} (Enlite 2.x Simulation Engine Installer) - http://myitlab.pearsoned.com/Pegasus/Modul...ces/ax/stub.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Google Update Service (gupdate1c9f3058e2885fa) (gupdate1c9f3058e2885fa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Primavera Background Agent (PrmBackAgent) - Unknown owner - C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: WMP300NSvc - GEMTEKS - C:\Program Files\Linksys\WMP300N\WLService.exe

--
End of file - 9562 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BA52B914-B692-46c4-B683-905236F6F655} - McAfee VirusScan - c:\progra~1\mcafee.com\vso\mcvsshl.dll [2005-07-01 114688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-04-28 7573504]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"VSOCheckTask"=C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe [2005-07-08 151552]
"VirusScan Online"=C:\Program Files\McAfee.com\VSO\mcvsshld.exe [2005-08-10 163840]
"OASClnt"=C:\Program Files\McAfee.com\VSO\oasclnt.exe [2005-08-11 53248]
"MCAgentExe"=c:\PROGRA~1\mcafee.com\agent\mcagent.exe [2005-09-22 303104]
"MCUpdateExe"=C:\PROGRA~1\mcafee.com\agent\McUpdate.exe [2006-01-11 212992]
"MPFExe"=C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe [2005-11-11 1005096]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-10-05 866584]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-13 169984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Aim6"= []
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-23 203928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe [2007-03-15 454784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2006-04-28 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2009-03-15 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-12-08 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-06-13 185784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE [2007-05-11 738968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
C:\PROGRA~1\Google\GOOGLE~2\GOOGLE~1.EXE -systray -startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^^Start Menu^Programs^Startup^Nikon Monitor.lnk]
C:\PROGRA~1\COMMON~1\Nikon\Monitor\NKMONI~1.EXE [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WUSB54GCSVC"=2
"WMPNetworkSvc"=3
"WinDefend"=2
"Viewpoint Manager Service"=2
"usnjsvc"=3
"iPod Service"=3
"Apple Mobile Device"=2
"sdCoreService"=2
"sdAuxService"=2
"McTskshd.exe"=2
"mcupdmgr.exe"=3
"Bonjour Service"=2

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

C:\Documents and Settings\Start Menu\Programs\Startup
Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-13 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-10-05 83224]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoSetActiveDesktop"=
"NoActiveDesktopChanges"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe"="C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe:*:Enabled:LaunchPad"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\QuickTime\QuickTimePlayer.exe"="C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"
"C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui"
"C:\WINDOWS\system32\scrnsave.scr"="C:\WINDOWS\system32\scrnsave.scr:*:Enabled:scrnsave"
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\McAfee.com\VSO\oasclnt.exe"="C:\Program Files\McAfee.com\VSO\oasclnt.exe:*:Enabled:oasclnt"
"C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe"="C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe:*:Enabled:MpfService"
"C:\WINDOWS\RTHDCPL.exe"="C:\WINDOWS\RTHDCPL.exe:*:Enabled:RTHDCPL"
"C:\WINDOWS\system32\lsass.exe"="C:\WINDOWS\system32\lsass.exe:*:Enabled:lsass"
"C:\Documents and Settings\Application Data\Microsoft\Installer\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\_5C99E29DDF4411B426A6B2.exe"="C:\Documents and Settings\Application Data\Microsoft\Installer\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\_5C99E29DDF4411B426A6B2.exe:*:Enabled:_5C99E29DDF4411B426A6B2"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b957ff11-8081-11db-befc-806d6172696f}]
shell\AutoRun\command - D:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fae88f8a-d761-11db-bf29-00138fb29186}]
shell\AutoRun\command - setup.exe


======File associations======

.scr - open - "C:\WINDOWS\system32\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-07-22 20:29:51 ----D---- C:\rsit
2009-07-22 20:29:51 ----D---- C:\Program Files\trend micro
2009-07-22 15:02:48 ----D---- C:\Program Files\SUPERAntiSpyware
2009-07-22 15:02:48 ----D---- C:\Documents and Settings\Application Data\SUPERAntiSpyware.com
2009-07-22 15:02:38 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-07-15 11:02:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-15 11:02:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-15 11:01:10 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-02 13:14:23 ----D---- C:\Program Files\AutoCAD 2008
2009-07-02 13:14:23 ----D---- C:\Documents and Settings\Application Data\Autodesk
2009-07-02 13:14:23 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2009-07-02 13:12:45 ----D---- C:\Program Files\Common Files\Autodesk Shared
2009-07-02 13:12:45 ----D---- C:\Program Files\Autodesk
2009-07-02 12:48:49 ----D---- C:\Program Files\Alcohol Soft
2009-07-02 12:43:25 ----D---- C:\Program Files\PowerISO
2009-06-29 16:33:14 ----D---- C:\Program Files\Primavera
2009-06-29 16:33:14 ----D---- C:\Program Files\Common Files\Primavera Common
2009-06-29 16:33:14 ----D---- C:\Program Files\Common Files\Borland Shared
2009-06-29 16:29:08 ----D---- C:\Program Files\MSSQL
2009-06-29 16:27:52 ----D---- C:\Program Files\MSXML 6.0
2009-06-29 16:26:11 ----D---- C:\Program Files\Microsoft SQL Server
2009-06-29 16:12:26 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-06-29 15:57:58 ----D---- C:\WINDOWS\system32\XPSViewer
2009-06-29 15:57:48 ----D---- C:\Program Files\Reference Assemblies
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-06-29 15:57:12 ----D---- C:\9d5a35ddca906c17504171ef46c7
2009-06-29 15:51:27 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-06-29 15:51:20 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-29 15:51:16 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-29 15:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-29 15:51:06 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-29 15:50:34 ----D---- C:\WINDOWS\ie8updates
2009-06-29 15:50:16 ----D---- C:\WINDOWS\WBEM
2009-06-29 15:48:26 ----HDC---- C:\WINDOWS\ie8
2009-06-29 15:47:11 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-29 15:45:42 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-06-29 15:45:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-06-29 15:45:30 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-06-29 15:45:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-06-29 15:45:06 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-06-29 15:45:01 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-06-29 15:44:50 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-06-29 15:44:40 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-06-29 15:44:36 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-29 15:44:31 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-06-29 15:44:26 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-06-29 15:44:21 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-06-29 15:44:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-06-29 15:34:23 ----D---- C:\WINDOWS\Prefetch
2009-06-29 15:32:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-06-29 15:32:02 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2009-06-29 15:31:54 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-06-29 15:31:50 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2009-06-29 15:31:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-06-29 15:31:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-06-29 15:31:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-06-29 15:31:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2009-06-29 15:31:18 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-06-29 15:31:12 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-29 15:31:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2009-06-29 15:30:58 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
2009-06-29 15:30:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-06-29 15:30:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-06-29 15:30:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-06-29 15:30:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-06-29 15:30:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-29 15:30:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2009-06-29 15:30:23 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-06-29 15:30:18 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-06-29 15:30:13 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-06-29 15:30:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
2009-06-29 15:30:03 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-06-29 15:29:59 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2009-06-29 15:28:24 ----A---- C:\WINDOWS\setuplog.txt
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\scripting
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\en-us
2009-06-29 15:27:34 ----D---- C:\WINDOWS\system32\en
2009-06-29 15:27:34 ----D---- C:\WINDOWS\l2schemas
2009-06-29 15:27:33 ----D---- C:\WINDOWS\system32\bits
2009-06-29 15:25:34 ----D---- C:\WINDOWS\ServicePackFiles
2009-06-29 15:22:38 ----D---- C:\WINDOWS\network diagnostic
2009-06-29 15:17:56 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-06-29 15:17:55 ----D---- C:\WINDOWS\EHome
2009-06-29 15:10:10 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-06-29 14:38:23 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$

======List of files/folders modified in the last 1 months======

2009-07-22 20:29:51 ----D---- C:\Program Files
2009-07-22 20:28:57 ----D---- C:\Program Files\Mozilla Firefox
2009-07-22 15:28:13 ----D---- C:\WINDOWS\system32
2009-07-22 15:28:13 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-22 15:25:49 ----D---- C:\WINDOWS\Temp
2009-07-22 15:24:37 ----HD---- C:\WINDOWS
2009-07-22 15:24:22 ----SH---- C:\boot.ini
2009-07-22 15:04:12 ----SHD---- C:\WINDOWS\Installer
2009-07-22 15:04:12 ----SHD---- C:\Config.Msi
2009-07-22 15:02:38 ----D---- C:\Program Files\Common Files
2009-07-22 08:43:14 ----AH---- C:\WINDOWS\NeroDigital.ini
2009-07-22 08:27:00 ----D---- C:\WINDOWS\system32\drivers
2009-07-21 13:56:00 ----AH---- C:\WINDOWS\SchedLgU.Txt
2009-07-16 16:44:17 ----D---- C:\Documents and Settings\All Users\Application Data\myitlab
2009-07-15 11:02:40 ----HD---- C:\WINDOWS\inf
2009-07-15 11:02:37 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-15 11:02:36 ----A---- C:\WINDOWS\imsins.BAK
2009-07-15 11:02:35 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-13 13:28:06 ----D---- C:\Program Files\New Folder
2009-07-09 17:44:48 ----D---- C:\WINDOWS\Help
2009-07-02 13:48:27 ----D---- C:\New Folder (2)
2009-07-02 13:19:56 ----RSD---- C:\WINDOWS\assembly
2009-07-02 13:19:56 ----D---- C:\WINDOWS\Microsoft.NET
2009-07-02 13:19:07 ----RSD---- C:\WINDOWS\Fonts
2009-07-02 13:18:54 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-07-02 13:18:11 ----D---- C:\WINDOWS\WinSxS
2009-07-02 13:14:05 ----HD---- C:\Program Files\Uninstall Information
2009-07-02 13:12:32 ----D---- C:\WINDOWS\system32\DirectX
2009-07-02 13:12:15 ----D---- C:\Program Files\Common Files\DESIGNER
2009-07-02 13:12:14 ----D---- C:\Program Files\Microsoft Office
2009-07-02 13:12:14 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-07-02 12:46:59 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-30 10:51:32 ----SD---- C:\WINDOWS\Tasks
2009-06-29 16:32:33 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-06-29 16:32:14 ----SD---- C:\Documents and Settings\Application Data\Microsoft
2009-06-29 16:26:36 ----D---- C:\WINDOWS\Registration
2009-06-29 16:13:40 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-29 16:04:21 ----D---- C:\Program Files\Internet Explorer
2009-06-29 16:04:20 ----D---- C:\WINDOWS\system32\wbem
2009-06-29 16:04:20 ----D---- C:\WINDOWS\AppPatch
2009-06-29 15:57:54 ----D---- C:\Program Files\MSBuild
2009-06-29 15:57:24 ----D---- C:\WINDOWS\system32\spool
2009-06-29 15:56:42 ----D---- C:\WINDOWS\SxsCaPendDel
2009-06-29 15:50:18 ----D---- C:\WINDOWS\system32\config
2009-06-29 15:50:05 ----D---- C:\WINDOWS\Media
2009-06-29 15:35:44 ----AH---- C:\WINDOWS\OEWABLog.txt
2009-06-29 15:33:53 ----D---- C:\WINDOWS\system32\Setup
2009-06-29 15:30:05 ----D---- C:\Program Files\Messenger
2009-06-29 15:29:47 ----D---- C:\WINDOWS\security
2009-06-29 15:27:49 ----D---- C:\WINDOWS\ime
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\usmt
2009-06-29 15:27:33 ----D---- C:\WINDOWS\PeerNet
2009-06-29 15:27:33 ----D---- C:\Program Files\Movie Maker
2009-06-29 15:25:27 ----D---- C:\WINDOWS\system32\Restore
2009-06-29 15:25:27 ----D---- C:\WINDOWS\system32\npp
2009-06-29 15:25:26 ----D---- C:\WINDOWS\msagent
2009-06-29 15:25:24 ----D---- C:\WINDOWS\srchasst
2009-06-29 15:25:23 ----D---- C:\Program Files\NetMeeting
2009-06-29 15:25:21 ----D---- C:\WINDOWS\system32\Com
2009-06-29 15:25:18 ----D---- C:\Program Files\Windows Media Player
2009-06-29 15:25:17 ----D---- C:\Program Files\Windows NT
2009-06-29 15:25:17 ----D---- C:\Program Files\Outlook Express
2009-06-29 15:25:12 ----D---- C:\Program Files\Common Files\System
2009-06-29 15:24:48 ----D---- C:\WINDOWS\system32\oobe
2009-06-29 15:24:46 ----D---- C:\WINDOWS\system

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 MPFIREWL;MPFIREWL; C:\WINDOWS\System32\Drivers\MpFirewall.sys [2005-11-11 80640]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-08-03 20747]
R2 elagopro;GoProto Protocol Driver for LELA; C:\WINDOWS\system32\DRIVERS\elagopro.sys [2007-03-22 28672]
R2 elaunidr;UniDriver for LELA; C:\WINDOWS\system32\DRIVERS\elaunidr.sys [2007-03-22 5376]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\Linksys\WMP300N\GTNDIS5.SYS []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-04-28 3663040]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver; C:\WINDOWS\system32\DRIVERS\WMP300Nv1.sys [2007-10-18 822400]
S1 seneka;seneka; C:\WINDOWS\system32\drivers\senekaewppoeek.sys []
S3 anuufr1w;anuufr1w; C:\WINDOWS\system32\drivers\anuufr1w.sys []
S3 AR5211;Gigabyte Super Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-11-04 487552]
S3 BCM42RLY;BCM42RLY; \??\C:\WINDOWS\System32\BCM42RLY.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 NaiAvFilter1;NaiAvFilter1; C:\WINDOWS\system32\drivers\naiavf5x.sys [2005-08-10 114464]
S3 RT73;Linksys Home Wireless-G USB Adapter Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2005-11-24 245248]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2008-09-23 303104]
R2 McDetect.exe;McAfee WSC Integration; c:\program files\mcafee.com\agent\mcdetect.exe [2005-10-13 126976]
R2 msftesql$PRIMAVERA;SQL Server FullText Search (PRIMAVERA); C:\Program Files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe [2006-08-28 92952]
R2 MSSQL$PRIMAVERA;SQL Server (PRIMAVERA); C:\Program Files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-04-28 143426]
R2 pgsql-8.3;PostgreSQL Database Server 8.3; C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe [2008-09-19 65536]
R2 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2007-07-23 24064]
R3 MpfService;McAfee Personal Firewall Service; C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe [2005-11-11 548864]
S2 gupdate1c9f3058e2885fa;Google Update Service (gupdate1c9f3058e2885fa); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
S2 PrmBackAgent;Primavera Background Agent; C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe [2007-03-30 673280]
S2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
S2 WMP300NSvc;WMP300NSvc; C:\Program Files\Linksys\WMP300N\WLService.exe [2005-07-04 53307]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-07-02 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 HP Port Resolver;HP Port Resolver; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE [2005-05-20 81920]
S3 HP Status Server;HP Status Server; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE [2004-10-16 73728]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 McShield;McAfee.com McShield; c:\PROGRA~1\mcafee.com\vso\mcshield.exe [2005-08-10 221184]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
S4 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
S4 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S4 McTskshd.exe;McAfee Task Scheduler; c:\PROGRA~1\mcafee.com\agent\mctskshd.exe [2005-08-24 122368]
S4 mcupdmgr.exe;McAfee SecurityCenter Update Manager; C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe [2005-07-01 245760]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S4 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-10-05 13592]
S4 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 WUSB54GCSVC;WUSB54GCSVC; C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe [2005-07-04 53307]

-----------------EOF-----------------

Edited by buyerat, 22 July 2009 - 10:30 PM.


BC AdBot (Login to Remove)

 


#2 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:25 AM

Posted 22 July 2009 - 11:01 PM

Hello buyerat,

Posted Image

No problem, as I actually prefer a HijackThis log. :thumbup2:

I need for you to go offline completely and disable ALL your protective programs after you download ComboFix, but before you run it. Sometimes those programs interfere with it, and we don't want that! :)

If McAfee still gives you problems then you may have to temporarily uninstall it.

This tool is not a toy. If used the wrong way you could trash your computer. Please use only under direction of a Helper. If you decide to do so anyway, please do not blame me or ComboFix.

1. Download this file - combofix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply please, along with a new HijackThis log.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall.

If ComboFix will not run the first time, then rename ComboFix.exe to buyerat.exe and try it again. :)

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#3 buyerat

buyerat
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:25 AM

Posted 23 July 2009 - 04:23 PM

ComboFix 09-07-23.01 - 07/23/2009 15:54.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1641 [GMT -5:00]
Running from: c:\documents and settings\Desktop\buyerat.exe.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Start Menu\Programs\AVI Codec Pack +
c:\documents and settings\Start Menu\Programs\AVI Codec Pack +\Check For Updates.lnk
c:\documents and settings\Start Menu\Programs\AVI Codec Pack +\Uninstall.lnk
c:\program files\AVI Codec Pack
c:\program files\AVI Codec Pack\AC3\ac3filter.ax
c:\program files\AVI Codec Pack\AC3\dialog_patch.exe
c:\program files\AVI Codec Pack\LAYER-3\L3CODECP.ACM
c:\program files\AVI Codec Pack\LAYER-3\RaMp3Cfg.exe
c:\program files\AVI Codec Pack\uninstall.exe
c:\windows\run.log
c:\windows\system32\aginikoy.ini
c:\windows\system32\ahojawoy.ini
c:\windows\system32\ajanugih.ini
c:\windows\system32\ajuvalav.ini
c:\windows\system32\akuhikap.ini
c:\windows\system32\alogidaj.ini
c:\windows\system32\amerihoy.ini
c:\windows\system32\amigejed.ini
c:\windows\system32\anijidip.ini
c:\windows\system32\apudinub.ini
c:\windows\system32\asotibij.ini
c:\windows\system32\atudoteg.ini
c:\windows\system32\avuvotuf.ini
c:\windows\system32\awetobeg.ini
c:\windows\system32\ayehuvab.ini
c:\windows\system32\ayufusel.ini
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekaewppoeek.sys
c:\windows\system32\drivers\UACwyjosynhjd.sys
c:\windows\system32\drivers\vsfoceephmoake.sys
c:\windows\system32\edozafaj.ini
c:\windows\system32\edujawem.ini
c:\windows\system32\eherubor.ini
c:\windows\system32\ejiwaved.ini
c:\windows\system32\ekumobaw.ini
c:\windows\system32\enafoves.ini
c:\windows\system32\eralasut.ini
c:\windows\system32\erugasog.ini
c:\windows\system32\erumiyit.ini
c:\windows\system32\esavoduz.ini
c:\windows\system32\ewizipog.ini
c:\windows\system32\idowuhav.ini
c:\windows\system32\ifiyiteb.ini
c:\windows\system32\ihevemoz.ini
c:\windows\system32\imizikal.ini
c:\windows\system32\irudirak.ini
c:\windows\system32\ivefopan.ini
c:\windows\system32\iyanomok.ini
c:\windows\system32\iyawawar.ini
c:\windows\system32\izuleman.ini
c:\windows\system32\obizabiv.ini
c:\windows\system32\ofiloled.ini
c:\windows\system32\ogijitab.ini
c:\windows\system32\okuturib.ini
c:\windows\system32\oloruyew.ini
c:\windows\system32\opimohem.ini
c:\windows\system32\opuzitij.ini
c:\windows\system32\osubisak.ini
c:\windows\system32\senekacxykcldk.dll
c:\windows\system32\senekagfbcylkf.dat
c:\windows\system32\senekakncpgxlf.dat
c:\windows\system32\senekaswplorxq.dll
c:\windows\system32\UAChjnbxqlcii.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACjuhtvycyrn.db
c:\windows\system32\UACmqilkdieoc.dll
c:\windows\system32\UACplyinmrdcn.dll
c:\windows\system32\UACtapxqfslmx.dat
c:\windows\system32\UACuiyrshpndt.dll
c:\windows\system32\UACyxecrjwili.dll
c:\windows\system32\ubomadaz.ini
c:\windows\system32\ubujezok.ini
c:\windows\system32\uduforuh.ini
c:\windows\system32\ugolosiv.ini
c:\windows\system32\ujokakey.ini
c:\windows\system32\ujupodil.ini
c:\windows\system32\ukepewim.ini
c:\windows\system32\ukugijuz.ini
c:\windows\system32\ulilihep.ini
c:\windows\system32\uniq.tll
c:\windows\system32\upesewal.ini
c:\windows\system32\utedereh.ini
c:\windows\system32\uteforab.ini
c:\windows\system32\utuvumud.ini
c:\windows\system32\uzovuziz.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SENEKA
-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-06-23 to 2009-07-23 )))))))))))))))))))))))))))))))
.

2009-07-23 19:13 . 2009-07-23 19:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX
2009-07-23 18:42 . 2009-07-23 18:42 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-07-23 18:34 . 2009-07-23 18:34 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-07-23 18:32 . 2009-07-23 18:32 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-07-23 01:29 . 2009-07-23 01:30 -------- d-----w- C:\rsit
2009-07-23 01:29 . 2009-07-23 01:30 -------- d-----w- c:\program files\trend micro
2009-07-22 20:02 . 2009-07-22 20:02 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-22 20:02 . 2009-07-22 20:02 -------- d-----w- c:\documents and settings\Application Data\SUPERAntiSpyware.com
2009-07-22 20:02 . 2009-07-22 20:02 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-17 07:56 . 2009-07-17 07:56 -------- d-----w- c:\documents and settings\Local Settings\Application Data\Temp
2009-07-02 18:14 . 2009-07-02 18:26 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Autodesk
2009-07-02 18:14 . 2009-07-02 18:19 -------- d-----w- c:\program files\AutoCAD 2008
2009-07-02 18:14 . 2009-07-02 18:14 -------- d-----w- c:\documents and settings\Application Data\Autodesk
2009-07-02 18:12 . 2009-07-02 18:19 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-07-02 18:12 . 2009-07-02 18:14 -------- d-----w- c:\documents and settings\Local Settings\Application Data\Autodesk
2009-07-02 18:12 . 2009-07-02 18:12 -------- d-----w- c:\program files\Autodesk
2009-07-02 17:48 . 2009-07-02 17:48 -------- d-----w- c:\program files\Alcohol Soft
2009-07-02 17:47 . 2009-07-02 17:47 -------- d-----w- c:\documents and settings\NetworkService\Application Data\McAfee.com Personal Firewall
2009-07-02 17:45 . 2009-07-02 17:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-07-02 17:44 . 2009-07-02 17:44 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-02 17:43 . 2009-07-02 17:43 -------- d-----w- c:\program files\PowerISO
2009-06-30 04:22 . 2009-06-30 04:22 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-29 21:33 . 2009-06-29 21:33 -------- d-----w- c:\program files\Common Files\Primavera Common
2009-06-29 21:33 . 2009-06-29 21:33 -------- d-----w- c:\program files\Primavera
2009-06-29 21:33 . 2009-06-29 21:33 -------- d-----w- c:\program files\Common Files\Borland Shared
2009-06-29 21:29 . 2009-06-29 21:29 -------- d-----w- c:\program files\MSSQL
2009-06-29 21:27 . 2009-06-29 21:27 -------- d-----w- c:\program files\MSXML 6.0
2009-06-29 21:26 . 2009-06-29 21:32 -------- d-----w- c:\program files\Microsoft SQL Server
2009-06-29 21:08 . 2009-06-29 21:08 -------- d-sh--w- c:\documents and settings\PrivacIE
2009-06-29 21:06 . 2009-06-29 21:06 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-29 21:05 . 2009-06-29 21:05 -------- d-sh--w- c:\documents and settings\IETldCache
2009-06-29 20:57 . 2009-06-29 20:57 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-29 20:57 . 2009-06-29 20:57 -------- d-----w- c:\program files\Reference Assemblies
2009-06-29 20:57 . 2009-06-29 20:57 -------- d-----w- C:\9d5a35ddca906c17504171ef46c7
2009-06-29 20:57 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-29 20:57 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-29 20:57 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-06-29 20:57 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-06-29 20:57 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-06-29 20:57 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-06-29 20:57 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-29 20:50 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-29 20:50 . 2009-06-29 20:50 -------- d-----w- c:\windows\ie8updates
2009-06-29 20:50 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-29 20:50 . 2009-04-30 21:22 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-29 20:50 . 2009-04-30 21:22 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-29 20:50 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-29 20:48 . 2009-06-29 20:49 -------- dc-h--w- c:\windows\ie8
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\system32\scripting
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\system32\en
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\l2schemas
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\system32\bits
2009-06-29 20:25 . 2009-06-29 20:25 -------- d-----w- c:\windows\ServicePackFiles
2009-06-29 20:17 . 2009-06-29 20:17 -------- d-----w- c:\windows\EHome
2009-06-29 20:11 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-06-29 20:11 . 2009-02-09 12:10 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-06-29 20:11 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-06-29 20:11 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-06-29 20:11 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-06-29 20:11 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-06-29 20:11 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-06-29 20:11 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-06-29 20:11 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-06-29 20:10 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-06-29 20:10 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 20:13 . 2007-03-21 04:36 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\McAfee.com
2009-07-16 21:44 . 2009-06-16 20:47 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\myitlab
2009-07-13 18:28 . 2007-04-09 17:16 -------- d-----w- c:\program files\New Folder
2009-07-02 18:26 . 2006-11-30 22:53 106264 ----a-w- c:\documents and settings\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 21:32 . 2009-06-09 21:56 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Microsoft Help
2009-06-29 20:57 . 2009-06-09 22:00 -------- d-----w- c:\program files\MSBuild
2009-06-29 20:29 . 2006-11-30 21:25 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-22 06:50 . 2007-03-21 04:39 -------- d-----w- c:\program files\Google
2009-06-22 06:50 . 2006-12-28 06:59 -------- d-----w- c:\program files\DivX
2009-06-22 06:49 . 2009-06-22 06:48 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-22 01:51 . 2007-01-07 06:04 -------- d-----w- c:\program files\PokerStars
2009-06-20 18:43 . 2009-06-20 18:43 -------- d-----w- c:\program files\QuickTime
2009-06-20 18:41 . 2007-06-07 08:29 -------- d-----w- c:\program files\Apple Software Update
2009-06-19 00:37 . 2009-06-19 00:37 -------- d-----w- c:\program files\GanttProject
2009-06-18 09:23 . 2006-12-05 06:54 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-06-18 09:23 . 2007-12-10 21:38 -------- d-----w- c:\program files\AIM6
2009-06-18 09:20 . 2006-12-05 06:52 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-09 22:00 . 2009-06-09 22:00 -------- d-----w- c:\program files\Microsoft Works
2009-06-09 21:59 . 2009-06-09 21:59 -------- d-----w- c:\program files\Microsoft.NET
2009-06-09 21:57 . 2009-06-09 21:57 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 21:40 . 2009-05-07 21:26 117092 ----a-w- c:\windows\hpoins11.dat
2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll
2009-04-29 04:46 . 2009-04-29 04:46 81920 ------w- c:\windows\system32\ieencode.dll
2009-06-12 16:50 . 2008-12-07 22:31 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-01-26 21:21 . 2009-01-26 21:21 3748 --sh--w- c:\windows\system32\balineko.exe
2009-01-27 09:22 . 2009-01-27 09:22 17562 --sh--w- c:\windows\system32\bidineli.exe
2009-01-23 06:38 . 2009-01-23 06:38 23467 --sh--w- c:\windows\system32\dedayizo.exe
2009-01-26 21:22 . 2009-01-26 21:22 23688 --sh--w- c:\windows\system32\duhotumi.exe
2009-01-29 10:23 . 2009-01-29 10:23 29965 --sh--w- c:\windows\system32\dujoyuma.exe
2009-01-14 11:32 . 2009-01-14 11:32 17472 --sh--w- c:\windows\system32\duvazuge.exe
2009-01-13 02:44 . 2009-01-13 02:44 1995 --sh--w- c:\windows\system32\fironage.exe
2009-01-22 05:38 . 2009-01-22 05:38 17477 --sh--w- c:\windows\system32\ginejoyi.exe
2009-01-29 22:23 . 2009-01-29 22:23 17556 --sh--w- c:\windows\system32\hitakire.exe
2009-01-28 22:23 . 2009-01-28 22:23 3748 --sh--w- c:\windows\system32\hogonina.exe
2009-01-29 10:23 . 2009-01-29 10:23 17550 --sh--w- c:\windows\system32\hoguwagi.exe
2009-01-14 11:32 . 2009-01-14 11:32 23452 --sh--w- c:\windows\system32\hunigira.exe
2009-01-25 21:20 . 2009-01-25 21:20 3748 --sh--w- c:\windows\system32\husekafi.exe
2009-01-31 14:25 . 2009-01-31 14:25 17499 --sh--w- c:\windows\system32\husowipe.exe
2009-01-22 06:38 . 2009-01-22 06:38 2098 --sh--w- c:\windows\system32\janapeko.exe
2009-01-31 02:24 . 2009-01-31 02:24 30253 --sh--w- c:\windows\system32\javezome.exe
2009-01-28 09:22 . 2009-01-28 09:22 17546 --sh--w- c:\windows\system32\jewipaje.exe
2009-01-18 17:35 . 2009-01-18 17:35 23485 --sh--w- c:\windows\system32\jipuyahe.exe
2009-01-15 00:33 . 2009-01-15 00:33 23493 --sh--w- c:\windows\system32\kawowuzu.exe
2009-01-31 02:24 . 2009-01-31 02:24 3748 --sh--w- c:\windows\system32\kerumobu.exe
2009-01-19 05:36 . 2009-01-19 05:36 23491 --sh--w- c:\windows\system32\kiwifage.exe
2009-01-20 17:37 . 2009-01-20 17:37 23442 --sh--w- c:\windows\system32\kumudoze.exe
2009-01-15 12:33 . 2009-01-15 12:33 23490 --sh--w- c:\windows\system32\kuzeduhu.exe
2009-01-16 12:34 . 2009-01-16 12:34 23486 --sh--w- c:\windows\system32\leyiwuni.exe
2009-01-24 18:39 . 2009-01-24 18:39 3748 --sh--w- c:\windows\system32\lipabiva.exe
2009-01-22 18:38 . 2009-01-22 18:38 2098 --sh--w- c:\windows\system32\lujegofe.exe
2009-01-25 21:21 . 2009-01-25 21:21 23647 --sh--w- c:\windows\system32\lutawudi.exe
2009-01-20 17:37 . 2009-01-20 17:37 3748 --sh--w- c:\windows\system32\mahefeba.exe
2009-01-15 12:33 . 2009-01-15 12:33 17493 --sh--w- c:\windows\system32\mimegepa.exe
2009-01-26 09:21 . 2009-01-26 09:21 17573 --sh--w- c:\windows\system32\miyebelu.exe
2009-01-27 21:22 . 2009-01-27 21:22 17562 --sh--w- c:\windows\system32\najohura.exe
2009-01-20 05:36 . 2009-01-20 05:36 3748 --sh--w- c:\windows\system32\nekidayi.exe
2009-01-17 17:35 . 2009-01-17 17:35 3748 --sh--w- c:\windows\system32\neyumaso.exe
2009-01-13 23:32 . 2009-01-13 23:32 17472 --sh--w- c:\windows\system32\nopihizu.exe
2009-01-21 17:37 . 2009-01-21 17:37 17455 --sh--w- c:\windows\system32\noyuhugi.exe
2009-01-19 05:36 . 2009-01-19 05:36 17449 --sh--w- c:\windows\system32\noyutubi.exe
2009-01-18 05:35 . 2009-01-18 05:35 23478 --sh--w- c:\windows\system32\nuyuwebo.exe
2009-01-18 17:35 . 2009-01-18 17:35 17449 --sh--w- c:\windows\system32\pihufapu.exe
2009-01-25 06:40 . 2009-01-25 06:40 17573 --sh--w- c:\windows\system32\porolusi.exe
2009-01-15 00:33 . 2009-01-15 00:33 17493 --sh--w- c:\windows\system32\pufozuje.exe
2009-01-17 00:34 . 2009-01-17 00:34 17449 --sh--w- c:\windows\system32\puhozepe.exe
2009-01-16 12:34 . 2009-01-16 12:34 17498 --sh--w- c:\windows\system32\rugujosa.exe
2009-01-30 10:24 . 2009-01-30 10:24 30204 --sh--w- c:\windows\system32\sajeradi.exe
2009-01-23 18:39 . 2009-01-23 18:39 3748 --sh--w- c:\windows\system32\siwonufo.exe
2009-01-12 08:40 . 2009-01-12 08:40 1995 --sh--w- c:\windows\system32\sunofefa.exe
2009-01-24 06:39 . 2009-01-24 06:39 23567 --sh--w- c:\windows\system32\varapogo.exe
2009-01-16 00:33 . 2009-01-16 00:33 3748 --sh--w- c:\windows\system32\vikuzuyu.exe
2009-01-23 18:39 . 2009-01-23 18:39 23582 --sh--w- c:\windows\system32\vozipizo.exe
2009-01-27 09:22 . 2009-01-27 09:22 23661 --sh--w- c:\windows\system32\vuyowuvo.exe
2009-01-28 09:22 . 2009-01-28 09:22 23645 --sh--w- c:\windows\system32\wuhomuro.exe
2009-01-30 10:24 . 2009-01-30 10:24 17556 --sh--w- c:\windows\system32\yawewune.exe
2009-01-27 21:22 . 2009-01-27 21:22 23645 --sh--w- c:\windows\system32\yazijoma.exe
2009-01-24 06:39 . 2009-01-24 06:39 17573 --sh--w- c:\windows\system32\yidufore.exe
2009-01-18 05:35 . 2009-01-18 05:35 3748 --sh--w- c:\windows\system32\yogogiti.exe
2009-01-21 05:37 . 2009-01-21 05:37 17455 --sh--w- c:\windows\system32\zesayawo.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-10-06 866584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-04-17 16143872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-27 434528]

c:\documents and settings\Start Menu\Programs\Startup\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Start Menu^Programs^Startup^Nikon Monitor.lnk]
path=c:\documents and settings\Start Menu\Programs\Startup\Nikon Monitor.lnk
backup=c:\windows\pss\Nikon Monitor.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WUSB54GCSVC"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"usnjsvc"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"sdCoreService"=2 (0x2)
"sdAuxService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\WINDOWS\\system32\\scrnsave.scr"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\RTHDCPL.exe"=
"c:\\Documents and Settings\\Application Data\\Microsoft\\Installer\\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\\_5C99E29DDF4411B426A6B2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 msftesql$PRIMAVERA;SQL Server FullText Search (PRIMAVERA);c:\program files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe [8/28/2006 2:53 AM 92952]
R2 MSSQL$PRIMAVERA;SQL Server (PRIMAVERA);c:\program files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/10/2007 5:29 AM 29178224]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [9/19/2008 4:03 AM 65536]
R2 PrmBackAgent;Primavera Background Agent;c:\program files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe [3/30/2007 6:59 PM 673280]
R2 WMP300NSvc;WMP300NSvc;c:\program files\Linksys\WMP300N\WLService.exe [4/30/2009 4:21 PM 53307]
R3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver;c:\windows\system32\drivers\WMP300Nv1.sys [4/30/2009 4:22 PM 822400]
S2 gupdate1c9f3058e2885fa;Google Update Service (gupdate1c9f3058e2885fa);c:\program files\Google\Update\GoogleUpdate.exe [6/22/2009 1:49 AM 133104]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/23/2008 11:26 AM 24652]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [10/5/2006 10:11 PM 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\docume~1\APPLIC~1\Mozilla\Firefox\Profiles\vs8icyb3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {10CE1AF5-858F-4E3F-B205-1D8E6F80814E} - c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 16:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql$PRIMAVERA]
"ImagePath"="\"c:\program files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:PRIMAVERA"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(976)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\System32\BCMLogon.dll
c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll

- - - - - - - > 'lsass.exe'(1032)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(2636)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\windows\system32\wscntfy.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\Linksys\WMP300N\WMP300N.exe
.
**************************************************************************
.
Completion time: 2009-07-23 16:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-23 21:11

Pre-Run: 9,791,918,080 bytes free
Post-Run: 14,449,610,752 bytes free

461 --- E O F --- 2009-07-15 16:02






Logfile of random's system information tool 1.06 (written by random/random)
Run by at 2009-07-23 16:17:48
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 14 GB (5%) free of 286 GB
Total RAM: 2047 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:17:51 PM, on 7/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys\WMP300N\WLService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Linksys\WMP300N\WMP300N.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Desktop\RSIT.exe
C:\Program Files\trend micro\

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-746137067-1123561945-839522115-1006\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} (Enlite 2.x Simulation Engine Installer) - http://myitlab.pearsoned.com/Pegasus/Modul...ces/ax/stub.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9f3058e2885fa) (gupdate1c9f3058e2885fa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Primavera Background Agent (PrmBackAgent) - Unknown owner - C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: WMP300NSvc - GEMTEKS - C:\Program Files\Linksys\WMP300N\WLService.exe

--
End of file - 8515 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-04-28 7573504]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-10-05 866584]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-23 203928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe [2007-03-15 454784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2006-04-28 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2009-03-15 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-12-08 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-06-13 185784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE [2007-05-11 738968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
C:\PROGRA~1\Google\GOOGLE~2\GOOGLE~1.EXE -systray -startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Start Menu^Programs^Startup^Nikon Monitor.lnk]
C:\PROGRA~1\COMMON~1\Nikon\Monitor\NKMONI~1.EXE [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WUSB54GCSVC"=2
"WMPNetworkSvc"=3
"WinDefend"=2
"Viewpoint Manager Service"=2
"usnjsvc"=3
"iPod Service"=3
"Apple Mobile Device"=2
"sdCoreService"=2
"sdAuxService"=2
"McTskshd.exe"=2
"mcupdmgr.exe"=3
"Bonjour Service"=2

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

C:\Documents and Settings\Start Menu\Programs\Startup
Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-13 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-10-05 83224]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe"="C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe:*:Enabled:LaunchPad"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\QuickTime\QuickTimePlayer.exe"="C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player"
"C:\WINDOWS\system32\scrnsave.scr"="C:\WINDOWS\system32\scrnsave.scr:*:Enabled:scrnsave"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\RTHDCPL.exe"="C:\WINDOWS\RTHDCPL.exe:*:Enabled:RTHDCPL"
"C:\Documents and Settings\Application Data\Microsoft\Installer\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\_5C99E29DDF4411B426A6B2.exe"="C:\Documents and Settings\Application Data\Microsoft\Installer\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\_5C99E29DDF4411B426A6B2.exe:*:Enabled:_5C99E29DDF4411B426A6B2"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.scr - open - "C:\WINDOWS\system32\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-07-23 16:11:32 ----D---- C:\WINDOWS\temp
2009-07-23 16:11:31 ----A---- C:\ComboFix.txt
2009-07-23 15:43:31 ----A---- C:\WINDOWS\zip.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\SWSC.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\SWREG.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\sed.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\PEV.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\NIRCMD.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\grep.exe
2009-07-23 15:43:19 ----D---- C:\WINDOWS\ERDNT
2009-07-23 15:43:09 ----D---- C:\Qoobox
2009-07-22 20:29:51 ----D---- C:\rsit
2009-07-22 20:29:51 ----D---- C:\Program Files\trend micro
2009-07-22 15:02:48 ----D---- C:\Program Files\SUPERAntiSpyware
2009-07-22 15:02:48 ----D---- C:\Documents and Settings\Application Data\SUPERAntiSpyware.com
2009-07-22 15:02:38 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-07-15 11:02:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-15 11:02:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-15 11:01:10 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-02 13:14:23 ----D---- C:\Program Files\AutoCAD 2008
2009-07-02 13:14:23 ----D---- C:\Documents and Settings\Application Data\Autodesk
2009-07-02 13:14:23 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2009-07-02 13:12:45 ----D---- C:\Program Files\Common Files\Autodesk Shared
2009-07-02 13:12:45 ----D---- C:\Program Files\Autodesk
2009-07-02 12:48:49 ----D---- C:\Program Files\Alcohol Soft
2009-07-02 12:43:25 ----D---- C:\Program Files\PowerISO
2009-06-29 16:33:14 ----D---- C:\Program Files\Primavera
2009-06-29 16:33:14 ----D---- C:\Program Files\Common Files\Primavera Common
2009-06-29 16:33:14 ----D---- C:\Program Files\Common Files\Borland Shared
2009-06-29 16:29:08 ----D---- C:\Program Files\MSSQL
2009-06-29 16:27:52 ----D---- C:\Program Files\MSXML 6.0
2009-06-29 16:26:11 ----D---- C:\Program Files\Microsoft SQL Server
2009-06-29 16:12:26 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-06-29 15:57:58 ----D---- C:\WINDOWS\system32\XPSViewer
2009-06-29 15:57:48 ----D---- C:\Program Files\Reference Assemblies
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-06-29 15:57:12 ----D---- C:\9d5a35ddca906c17504171ef46c7
2009-06-29 15:51:27 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-06-29 15:51:20 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-29 15:51:16 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-29 15:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-29 15:51:06 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-29 15:50:34 ----D---- C:\WINDOWS\ie8updates
2009-06-29 15:50:16 ----D---- C:\WINDOWS\WBEM
2009-06-29 15:48:26 ----HDC---- C:\WINDOWS\ie8
2009-06-29 15:47:11 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-29 15:45:42 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-06-29 15:45:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-06-29 15:45:30 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-06-29 15:45:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-06-29 15:45:06 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-06-29 15:45:01 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-06-29 15:44:50 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-06-29 15:44:40 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-06-29 15:44:36 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-29 15:44:31 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-06-29 15:44:26 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-06-29 15:44:21 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-06-29 15:44:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-06-29 15:34:23 ----D---- C:\WINDOWS\Prefetch
2009-06-29 15:32:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-06-29 15:32:02 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2009-06-29 15:31:54 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-06-29 15:31:50 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2009-06-29 15:31:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-06-29 15:31:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-06-29 15:31:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-06-29 15:31:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2009-06-29 15:31:18 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-06-29 15:31:12 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-29 15:31:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2009-06-29 15:30:58 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
2009-06-29 15:30:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-06-29 15:30:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-06-29 15:30:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-06-29 15:30:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-06-29 15:30:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-29 15:30:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2009-06-29 15:30:23 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-06-29 15:30:18 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-06-29 15:30:13 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-06-29 15:30:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
2009-06-29 15:30:03 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-06-29 15:29:59 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2009-06-29 15:28:24 ----A---- C:\WINDOWS\setuplog.txt
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\scripting
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\en-us
2009-06-29 15:27:34 ----D---- C:\WINDOWS\system32\en
2009-06-29 15:27:34 ----D---- C:\WINDOWS\l2schemas
2009-06-29 15:27:33 ----D---- C:\WINDOWS\system32\bits
2009-06-29 15:25:34 ----D---- C:\WINDOWS\ServicePackFiles
2009-06-29 15:22:38 ----D---- C:\WINDOWS\network diagnostic
2009-06-29 15:17:56 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-06-29 15:17:55 ----D---- C:\WINDOWS\EHome
2009-06-29 15:10:10 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-06-29 14:38:23 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$

======List of files/folders modified in the last 1 months======

2009-07-23 16:15:43 ----D---- C:\Program Files\Mozilla Firefox
2009-07-23 16:11:33 ----D---- C:\WINDOWS\system32\drivers
2009-07-23 16:11:33 ----D---- C:\WINDOWS\system32
2009-07-23 16:11:32 ----HD---- C:\WINDOWS
2009-07-23 16:10:34 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-23 16:10:10 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-23 16:04:53 ----A---- C:\WINDOWS\system.ini
2009-07-23 16:02:28 ----D---- C:\Program Files
2009-07-23 15:59:36 ----D---- C:\WINDOWS\AppPatch
2009-07-23 15:59:27 ----D---- C:\Program Files\Common Files
2009-07-23 15:54:18 ----AH---- C:\WINDOWS\SchedLgU.Txt
2009-07-23 15:13:02 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee.com
2009-07-23 15:12:41 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-23 14:13:11 ----AH---- C:\WINDOWS\NeroDigital.ini
2009-07-23 13:32:41 ----AH---- C:\WINDOWS\ntbtlog.txt
2009-07-22 15:24:22 ----SH---- C:\boot.ini
2009-07-22 15:04:12 ----SHD---- C:\WINDOWS\Installer
2009-07-22 15:04:12 ----SHD---- C:\Config.Msi
2009-07-16 16:44:17 ----D---- C:\Documents and Settings\All Users\Application Data\myitlab
2009-07-15 11:02:40 ----HD---- C:\WINDOWS\inf
2009-07-15 11:02:37 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-15 11:02:36 ----A---- C:\WINDOWS\imsins.BAK
2009-07-13 13:28:06 ----D---- C:\Program Files\New Folder
2009-07-09 17:44:48 ----D---- C:\WINDOWS\Help
2009-07-02 13:48:27 ----D---- C:\New Folder (2)
2009-07-02 13:19:56 ----RSD---- C:\WINDOWS\assembly
2009-07-02 13:19:56 ----D---- C:\WINDOWS\Microsoft.NET
2009-07-02 13:19:07 ----RSD---- C:\WINDOWS\Fonts
2009-07-02 13:18:54 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-07-02 13:18:11 ----D---- C:\WINDOWS\WinSxS
2009-07-02 13:14:05 ----HD---- C:\Program Files\Uninstall Information
2009-07-02 13:12:32 ----D---- C:\WINDOWS\system32\DirectX
2009-07-02 13:12:15 ----D---- C:\Program Files\Common Files\DESIGNER
2009-07-02 13:12:14 ----D---- C:\Program Files\Microsoft Office
2009-07-02 13:12:14 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-06-30 10:51:32 ----SD---- C:\WINDOWS\Tasks
2009-06-29 16:32:33 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-06-29 16:32:14 ----SD---- C:\Documents and Settings\Application Data\Microsoft
2009-06-29 16:26:36 ----D---- C:\WINDOWS\Registration
2009-06-29 16:13:40 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-29 16:04:22 ----D---- C:\WINDOWS\SxsCaPendDel
2009-06-29 16:04:21 ----D---- C:\Program Files\Internet Explorer
2009-06-29 16:04:20 ----D---- C:\WINDOWS\system32\wbem
2009-06-29 15:57:54 ----D---- C:\Program Files\MSBuild
2009-06-29 15:57:24 ----D---- C:\WINDOWS\system32\spool
2009-06-29 15:50:18 ----D---- C:\WINDOWS\system32\config
2009-06-29 15:50:05 ----D---- C:\WINDOWS\Media
2009-06-29 15:35:44 ----AH---- C:\WINDOWS\OEWABLog.txt
2009-06-29 15:33:53 ----D---- C:\WINDOWS\system32\Setup
2009-06-29 15:30:05 ----D---- C:\Program Files\Messenger
2009-06-29 15:29:47 ----D---- C:\WINDOWS\security
2009-06-29 15:27:49 ----D---- C:\WINDOWS\ime
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\usmt
2009-06-29 15:27:33 ----D---- C:\WINDOWS\PeerNet
2009-06-29 15:27:33 ----D---- C:\Program Files\Movie Maker
2009-06-29 15:25:27 ----D---- C:\WINDOWS\system32\Restore
2009-06-29 15:25:27 ----D---- C:\WINDOWS\system32\npp
2009-06-29 15:25:26 ----D---- C:\WINDOWS\msagent
2009-06-29 15:25:24 ----D---- C:\WINDOWS\srchasst
2009-06-29 15:25:23 ----D---- C:\Program Files\NetMeeting
2009-06-29 15:25:21 ----D---- C:\WINDOWS\system32\Com
2009-06-29 15:25:18 ----D---- C:\Program Files\Windows Media Player
2009-06-29 15:25:17 ----D---- C:\Program Files\Windows NT
2009-06-29 15:25:17 ----D---- C:\Program Files\Outlook Express
2009-06-29 15:25:12 ----D---- C:\Program Files\Common Files\System
2009-06-29 15:24:48 ----D---- C:\WINDOWS\system32\oobe
2009-06-29 15:24:46 ----D---- C:\WINDOWS\system

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-08-03 20747]
R2 elagopro;GoProto Protocol Driver for LELA; C:\WINDOWS\system32\DRIVERS\elagopro.sys [2007-03-22 28672]
R2 elaunidr;UniDriver for LELA; C:\WINDOWS\system32\DRIVERS\elaunidr.sys [2007-03-22 5376]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 catchme;catchme; \??\C:\DOCUME~1\LOCALS~1\Temp\catchme.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\Linksys\WMP300N\GTNDIS5.SYS []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-04-28 3663040]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver; C:\WINDOWS\system32\DRIVERS\WMP300Nv1.sys [2007-10-18 822400]
S3 ac1c44qa;ac1c44qa; C:\WINDOWS\system32\drivers\ac1c44qa.sys []
S3 AR5211;Gigabyte Super Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-11-04 487552]
S3 BCM42RLY;BCM42RLY; \??\C:\WINDOWS\System32\BCM42RLY.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 RT73;Linksys Home Wireless-G USB Adapter Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2005-11-24 245248]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2008-09-23 303104]
R2 msftesql$PRIMAVERA;SQL Server FullText Search (PRIMAVERA); C:\Program Files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe [2006-08-28 92952]
R2 MSSQL$PRIMAVERA;SQL Server (PRIMAVERA); C:\Program Files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-04-28 143426]
R2 pgsql-8.3;PostgreSQL Database Server 8.3; C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe [2008-09-19 65536]
R2 PrmBackAgent;Primavera Background Agent; C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe [2007-03-30 673280]
R2 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2007-07-23 24064]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S2 gupdate1c9f3058e2885fa;Google Update Service (gupdate1c9f3058e2885fa); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
S2 WMP300NSvc;WMP300NSvc; C:\Program Files\Linksys\WMP300N\WLService.exe [2005-07-04 53307]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-07-02 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 HP Port Resolver;HP Port Resolver; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE [2005-05-20 81920]
S3 HP Status Server;HP Status Server; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE [2004-10-16 73728]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S4 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-10-05 13592]
S4 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 WUSB54GCSVC;WUSB54GCSVC; C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe [2005-07-04 53307]

-----------------EOF-----------------

#4 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:25 AM

Posted 23 July 2009 - 05:19 PM

Hello,

* Open notepad - don't use any other text editor than notepad or the script will fail.
Copy/paste the text in the quote box below into notepad:

KILLALL::
File::
c:\windows\system32\balineko.exe
c:\windows\system32\bidineli.exe
c:\windows\system32\dedayizo.exe
c:\windows\system32\duhotumi.exe
c:\windows\system32\dujoyuma.exe
c:\windows\system32\duvazuge.exe
c:\windows\system32\fironage.exe
c:\windows\system32\ginejoyi.exe
c:\windows\system32\hitakire.exe
c:\windows\system32\hogonina.exe
c:\windows\system32\hoguwagi.exe
c:\windows\system32\hunigira.exe
c:\windows\system32\husekafi.exe
c:\windows\system32\husowipe.exe
c:\windows\system32\janapeko.exe
c:\windows\system32\javezome.exe
c:\windows\system32\jewipaje.exe
c:\windows\system32\jipuyahe.exe
c:\windows\system32\kawowuzu.exe
c:\windows\system32\kerumobu.exe
c:\windows\system32\kiwifage.exe
c:\windows\system32\kumudoze.exe
c:\windows\system32\kuzeduhu.exe
c:\windows\system32\leyiwuni.exe
c:\windows\system32\lipabiva.exe
c:\windows\system32\lujegofe.exe
c:\windows\system32\lutawudi.exe
c:\windows\system32\mahefeba.exe
c:\windows\system32\mimegepa.exe
c:\windows\system32\miyebelu.exe
c:\windows\system32\najohura.exe
c:\windows\system32\nekidayi.exe
c:\windows\system32\neyumaso.exe
c:\windows\system32\nopihizu.exe
c:\windows\system32\noyuhugi.exe
c:\windows\system32\noyutubi.exe
c:\windows\system32\nuyuwebo.exe
c:\windows\system32\pihufapu.exe
c:\windows\system32\porolusi.exe
c:\windows\system32\pufozuje.exe
c:\windows\system32\puhozepe.exe
c:\windows\system32\rugujosa.exe
c:\windows\system32\sajeradi.exe
c:\windows\system32\siwonufo.exe
c:\windows\system32\sunofefa.exe
c:\windows\system32\varapogo.exe
c:\windows\system32\vikuzuyu.exe
c:\windows\system32\vozipizo.exe
c:\windows\system32\vuyowuvo.exe
c:\windows\system32\wuhomuro.exe
c:\windows\system32\yawewune.exe
c:\windows\system32\yazijoma.exe
c:\windows\system32\yidufore.exe
c:\windows\system32\yogogiti.exe
c:\windows\system32\zesayawo.exe


Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

Posted Image

This will start ComboFix again.

After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 14.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version.
-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

Please also let me know how it's running now. :thumbup2:

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#5 buyerat

buyerat
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:25 AM

Posted 23 July 2009 - 05:54 PM

ComboFix 09-07-23.01 - 07/23/2009 17:36.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1518 [GMT -5:00]
Running from: c:\documents and settings\Desktop\buyerat.exe.exe
Command switches used :: c:\documents and settings\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\balineko.exe"
"c:\windows\system32\bidineli.exe"
"c:\windows\system32\dedayizo.exe"
"c:\windows\system32\duhotumi.exe"
"c:\windows\system32\dujoyuma.exe"
"c:\windows\system32\duvazuge.exe"
"c:\windows\system32\fironage.exe"
"c:\windows\system32\ginejoyi.exe"
"c:\windows\system32\hitakire.exe"
"c:\windows\system32\hogonina.exe"
"c:\windows\system32\hoguwagi.exe"
"c:\windows\system32\hunigira.exe"
"c:\windows\system32\husekafi.exe"
"c:\windows\system32\husowipe.exe"
"c:\windows\system32\janapeko.exe"
"c:\windows\system32\javezome.exe"
"c:\windows\system32\jewipaje.exe"
"c:\windows\system32\jipuyahe.exe"
"c:\windows\system32\kawowuzu.exe"
"c:\windows\system32\kerumobu.exe"
"c:\windows\system32\kiwifage.exe"
"c:\windows\system32\kumudoze.exe"
"c:\windows\system32\kuzeduhu.exe"
"c:\windows\system32\leyiwuni.exe"
"c:\windows\system32\lipabiva.exe"
"c:\windows\system32\lujegofe.exe"
"c:\windows\system32\lutawudi.exe"
"c:\windows\system32\mahefeba.exe"
"c:\windows\system32\mimegepa.exe"
"c:\windows\system32\miyebelu.exe"
"c:\windows\system32\najohura.exe"
"c:\windows\system32\nekidayi.exe"
"c:\windows\system32\neyumaso.exe"
"c:\windows\system32\nopihizu.exe"
"c:\windows\system32\noyuhugi.exe"
"c:\windows\system32\noyutubi.exe"
"c:\windows\system32\nuyuwebo.exe"
"c:\windows\system32\pihufapu.exe"
"c:\windows\system32\porolusi.exe"
"c:\windows\system32\pufozuje.exe"
"c:\windows\system32\puhozepe.exe"
"c:\windows\system32\rugujosa.exe"
"c:\windows\system32\sajeradi.exe"
"c:\windows\system32\siwonufo.exe"
"c:\windows\system32\sunofefa.exe"
"c:\windows\system32\varapogo.exe"
"c:\windows\system32\vikuzuyu.exe"
"c:\windows\system32\vozipizo.exe"
"c:\windows\system32\vuyowuvo.exe"
"c:\windows\system32\wuhomuro.exe"
"c:\windows\system32\yawewune.exe"
"c:\windows\system32\yazijoma.exe"
"c:\windows\system32\yidufore.exe"
"c:\windows\system32\yogogiti.exe"
"c:\windows\system32\zesayawo.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}
c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}\chrome.manifest
c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}\chrome\content\_cfg.js
c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}\chrome\content\c.js
c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}\chrome\content\overlay.xul
c:\documents and settings\Local Settings\Application Data\{10CE1AF5-858F-4E3F-B205-1D8E6F80814E}\install.rdf
c:\windows\system32\balineko.exe
c:\windows\system32\bidineli.exe
c:\windows\system32\dedayizo.exe
c:\windows\system32\duhotumi.exe
c:\windows\system32\dujoyuma.exe
c:\windows\system32\duvazuge.exe
c:\windows\system32\fironage.exe
c:\windows\system32\ginejoyi.exe
c:\windows\system32\hitakire.exe
c:\windows\system32\hogonina.exe
c:\windows\system32\hoguwagi.exe
c:\windows\system32\hunigira.exe
c:\windows\system32\husekafi.exe
c:\windows\system32\husowipe.exe
c:\windows\system32\janapeko.exe
c:\windows\system32\javezome.exe
c:\windows\system32\jewipaje.exe
c:\windows\system32\jipuyahe.exe
c:\windows\system32\kawowuzu.exe
c:\windows\system32\kerumobu.exe
c:\windows\system32\kiwifage.exe
c:\windows\system32\kumudoze.exe
c:\windows\system32\kuzeduhu.exe
c:\windows\system32\leyiwuni.exe
c:\windows\system32\lipabiva.exe
c:\windows\system32\lujegofe.exe
c:\windows\system32\lutawudi.exe
c:\windows\system32\mahefeba.exe
c:\windows\system32\mimegepa.exe
c:\windows\system32\miyebelu.exe
c:\windows\system32\najohura.exe
c:\windows\system32\nekidayi.exe
c:\windows\system32\neyumaso.exe
c:\windows\system32\nopihizu.exe
c:\windows\system32\noyuhugi.exe
c:\windows\system32\noyutubi.exe
c:\windows\system32\nuyuwebo.exe
c:\windows\system32\pihufapu.exe
c:\windows\system32\porolusi.exe
c:\windows\system32\pufozuje.exe
c:\windows\system32\puhozepe.exe
c:\windows\system32\rugujosa.exe
c:\windows\system32\sajeradi.exe
c:\windows\system32\siwonufo.exe
c:\windows\system32\sunofefa.exe
c:\windows\system32\varapogo.exe
c:\windows\system32\vikuzuyu.exe
c:\windows\system32\vozipizo.exe
c:\windows\system32\vuyowuvo.exe
c:\windows\system32\wuhomuro.exe
c:\windows\system32\yawewune.exe
c:\windows\system32\yazijoma.exe
c:\windows\system32\yidufore.exe
c:\windows\system32\yogogiti.exe
c:\windows\system32\zesayawo.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-23 to 2009-07-23 )))))))))))))))))))))))))))))))
.

2009-07-23 22:31 . 2009-07-23 22:30 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-07-23 19:13 . 2009-07-23 19:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\DivX
2009-07-23 18:42 . 2009-07-23 18:42 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
2009-07-23 18:34 . 2009-07-23 18:34 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-07-23 18:32 . 2009-07-23 18:32 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-07-23 01:29 . 2009-07-23 21:17 -------- d-----w- c:\program files\trend micro
2009-07-23 01:29 . 2009-07-23 01:30 -------- d-----w- C:\rsit
2009-07-22 20:02 . 2009-07-22 20:02 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-22 20:02 . 2009-07-22 20:02 -------- d-----w- c:\documents and settings\Application Data\SUPERAntiSpyware.com
2009-07-22 20:02 . 2009-07-22 20:02 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-17 07:56 . 2009-07-17 07:56 -------- d-----w- c:\documents and settings\Local Settings\Application Data\Temp
2009-07-02 18:14 . 2009-07-02 18:26 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Autodesk
2009-07-02 18:14 . 2009-07-02 18:19 -------- d-----w- c:\program files\AutoCAD 2008
2009-07-02 18:14 . 2009-07-02 18:14 -------- d-----w- c:\documents and settings\Application Data\Autodesk
2009-07-02 18:12 . 2009-07-02 18:19 -------- d-----w- c:\program files\Common Files\Autodesk Shared
2009-07-02 18:12 . 2009-07-02 18:14 -------- d-----w- c:\documents and settings\Local Settings\Application Data\Autodesk
2009-07-02 18:12 . 2009-07-02 18:12 -------- d-----w- c:\program files\Autodesk
2009-07-02 17:48 . 2009-07-02 17:48 -------- d-----w- c:\program files\Alcohol Soft
2009-07-02 17:47 . 2009-07-02 17:47 -------- d-----w- c:\documents and settings\NetworkService\Application Data\McAfee.com Personal Firewall
2009-07-02 17:45 . 2009-07-02 17:45 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-07-02 17:44 . 2009-07-02 17:44 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-02 17:43 . 2009-07-02 17:43 -------- d-----w- c:\program files\PowerISO
2009-06-30 04:22 . 2009-06-30 04:22 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-29 21:33 . 2009-06-29 21:33 -------- d-----w- c:\program files\Common Files\Primavera Common
2009-06-29 21:33 . 2009-06-29 21:33 -------- d-----w- c:\program files\Primavera
2009-06-29 21:33 . 2009-06-29 21:33 -------- d-----w- c:\program files\Common Files\Borland Shared
2009-06-29 21:29 . 2009-06-29 21:29 -------- d-----w- c:\program files\MSSQL
2009-06-29 21:27 . 2009-06-29 21:27 -------- d-----w- c:\program files\MSXML 6.0
2009-06-29 21:26 . 2009-06-29 21:32 -------- d-----w- c:\program files\Microsoft SQL Server
2009-06-29 21:08 . 2009-06-29 21:08 -------- d-sh--w- c:\documents and settings\PrivacIE
2009-06-29 21:06 . 2009-06-29 21:06 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-29 21:05 . 2009-06-29 21:05 -------- d-sh--w- c:\documents and settings\IETldCache
2009-06-29 20:57 . 2009-06-29 20:57 -------- d-----w- c:\windows\system32\XPSViewer
2009-06-29 20:57 . 2009-06-29 20:57 -------- d-----w- c:\program files\Reference Assemblies
2009-06-29 20:57 . 2009-06-29 20:57 -------- d-----w- C:\9d5a35ddca906c17504171ef46c7
2009-06-29 20:57 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-06-29 20:57 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-06-29 20:57 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-06-29 20:57 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-06-29 20:57 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-06-29 20:57 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-06-29 20:57 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-06-29 20:50 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-06-29 20:50 . 2009-06-29 20:50 -------- d-----w- c:\windows\ie8updates
2009-06-29 20:50 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-29 20:50 . 2009-04-30 21:22 1985024 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-06-29 20:50 . 2009-04-30 21:22 11064832 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-06-29 20:50 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-29 20:48 . 2009-06-29 20:49 -------- dc-h--w- c:\windows\ie8
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\system32\scripting
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\system32\en
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\l2schemas
2009-06-29 20:27 . 2009-06-29 20:27 -------- d-----w- c:\windows\system32\bits
2009-06-29 20:25 . 2009-06-29 20:25 -------- d-----w- c:\windows\ServicePackFiles
2009-06-29 20:17 . 2009-06-29 20:17 -------- d-----w- c:\windows\EHome
2009-06-29 20:11 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-06-29 20:11 . 2009-02-09 12:10 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2009-06-29 20:11 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-06-29 20:11 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-06-29 20:11 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-06-29 20:11 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-06-29 20:11 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-06-29 20:11 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-06-29 20:11 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-06-29 20:10 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-06-29 20:10 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-23 22:30 . 2007-07-27 20:02 -------- d-----w- c:\program files\Java
2009-07-23 20:13 . 2007-03-21 04:36 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\McAfee.com
2009-07-16 21:44 . 2009-06-16 20:47 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\myitlab
2009-07-13 18:28 . 2007-04-09 17:16 -------- d-----w- c:\program files\New Folder
2009-07-02 18:26 . 2006-11-30 22:53 106264 ----a-w- c:\documents and settings\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 21:32 . 2009-06-09 21:56 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Microsoft Help
2009-06-29 20:57 . 2009-06-09 22:00 -------- d-----w- c:\program files\MSBuild
2009-06-29 20:29 . 2006-11-30 21:25 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-22 06:50 . 2007-03-21 04:39 -------- d-----w- c:\program files\Google
2009-06-22 06:50 . 2006-12-28 06:59 -------- d-----w- c:\program files\DivX
2009-06-22 06:49 . 2009-06-22 06:48 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-06-22 01:51 . 2007-01-07 06:04 -------- d-----w- c:\program files\PokerStars
2009-06-20 18:43 . 2009-06-20 18:43 -------- d-----w- c:\program files\QuickTime
2009-06-20 18:41 . 2007-06-07 08:29 -------- d-----w- c:\program files\Apple Software Update
2009-06-19 00:37 . 2009-06-19 00:37 -------- d-----w- c:\program files\GanttProject
2009-06-18 09:23 . 2006-12-05 06:54 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\Viewpoint
2009-06-18 09:23 . 2007-12-10 21:38 -------- d-----w- c:\program files\AIM6
2009-06-18 09:20 . 2006-12-05 06:52 -------- d-----w- c:\docume~1\ALLUSE~1\APPLIC~1\AOL Downloads
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-09 22:00 . 2009-06-09 22:00 -------- d-----w- c:\program files\Microsoft Works
2009-06-09 21:59 . 2009-06-09 21:59 -------- d-----w- c:\program files\Microsoft.NET
2009-06-09 21:57 . 2009-06-09 21:57 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 21:40 . 2009-05-07 21:26 117092 ----a-w- c:\windows\hpoins11.dat
2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 21:02 . 2009-05-01 21:02 90112 ----a-w- c:\windows\system32\dpl100.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll
2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll
2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll
2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll
2009-04-29 04:46 . 2009-04-29 04:46 81920 ------w- c:\windows\system32\ieencode.dll
2009-07-23 22:31 . 2008-12-07 22:31 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-23_21.04.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-23 22:41 . 2009-07-23 22:41 16384 c:\windows\temp\Perflib_Perfdata_144.dat
+ 2007-11-06 16:47 . 2009-07-23 22:30 148888 c:\windows\system32\javaws.exe
+ 2007-11-06 16:47 . 2009-07-23 22:30 144792 c:\windows\system32\javaw.exe
+ 2007-11-06 16:47 . 2009-07-23 22:30 144792 c:\windows\system32\java.exe
+ 2009-07-23 22:30 . 2009-07-23 22:30 1563648 c:\windows\Installer\4e7e55.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-28 7573504]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-10-06 866584]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-23 148888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-04-17 16143872]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-27 434528]

c:\documents and settings\Start Menu\Programs\Startup\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Start Menu^Programs^Startup^Nikon Monitor.lnk]
path=c:\documents and settings\Start Menu\Programs\Startup\Nikon Monitor.lnk
backup=c:\windows\pss\Nikon Monitor.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WUSB54GCSVC"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"WinDefend"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"usnjsvc"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"sdCoreService"=2 (0x2)
"sdAuxService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"Bonjour Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\WINDOWS\\system32\\scrnsave.scr"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\RTHDCPL.exe"=
"c:\\Documents and Settings\\Application Data\\Microsoft\\Installer\\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\\_5C99E29DDF4411B426A6B2.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 msftesql$PRIMAVERA;SQL Server FullText Search (PRIMAVERA);c:\program files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe [8/28/2006 2:53 AM 92952]
R2 MSSQL$PRIMAVERA;SQL Server (PRIMAVERA);c:\program files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/10/2007 5:29 AM 29178224]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [9/19/2008 4:03 AM 65536]
R2 PrmBackAgent;Primavera Background Agent;c:\program files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe [3/30/2007 6:59 PM 673280]
R2 WMP300NSvc;WMP300NSvc;c:\program files\Linksys\WMP300N\WLService.exe [4/30/2009 4:21 PM 53307]
R3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver;c:\windows\system32\drivers\WMP300Nv1.sys [4/30/2009 4:22 PM 822400]
S2 gupdate1c9f3058e2885fa;Google Update Service (gupdate1c9f3058e2885fa);c:\program files\Google\Update\GoogleUpdate.exe [6/22/2009 1:49 AM 133104]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/23/2008 11:26 AM 24652]
S4 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [10/5/2006 10:11 PM 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\docume~1\~1\APPLIC~1\Mozilla\Firefox\Profiles\vs8icyb3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-23 17:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql$PRIMAVERA]
"ImagePath"="\"c:\program files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:PRIMAVERA"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(972)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\System32\BCMLogon.dll
c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll

- - - - - - - > 'lsass.exe'(1028)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(1612)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\hnetcfg.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\Linksys\WMP300N\WMP300N.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-23 17:48 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-23 22:47
ComboFix2.txt 2009-07-23 21:11

Pre-Run: 14,184,005,632 bytes free
Post-Run: 14,144,135,168 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

451 --- E O F --- 2009-07-15 16:02






Logfile of random's system information tool 1.06 (written by random/random)
Run by at 2009-07-23 17:52:06
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 14 GB (5%) free of 286 GB
Total RAM: 2047 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:52:08 PM, on 7/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys\WMP300N\WLService.exe
C:\Program Files\Linksys\WMP300N\WMP300N.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Desktop\RSIT.exe
C:\Program Files\trend micro\
C:\WINDOWS\system32\HPZipm12.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-746137067-1123561945-839522115-1006\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'postgres')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} (Enlite 2.x Simulation Engine Installer) - http://myitlab.pearsoned.com/Pegasus/Modul...ces/ax/stub.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9f3058e2885fa) (gupdate1c9f3058e2885fa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Primavera Background Agent (PrmBackAgent) - Unknown owner - C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: WMP300NSvc - GEMTEKS - C:\Program Files\Linksys\WMP300N\WLService.exe

--
End of file - 8675 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\MP Scheduled Scan.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-23 41368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-23 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-04-28 7573504]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-10-05 866584]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-23 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
C:\Program Files\AIM6\aim6.exe [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-23 203928]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe [2007-03-15 454784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2006-04-28 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE [2009-03-15 180224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-12-08 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-06-13 185784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE [2007-05-11 738968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
C:\PROGRA~1\Google\GOOGLE~2\GOOGLE~1.EXE -systray -startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Start Menu^Programs^Startup^Nikon Monitor.lnk]
C:\PROGRA~1\COMMON~1\Nikon\Monitor\NKMONI~1.EXE [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WUSB54GCSVC"=2
"WMPNetworkSvc"=3
"WinDefend"=2
"Viewpoint Manager Service"=2
"usnjsvc"=3
"iPod Service"=3
"Apple Mobile Device"=2
"sdCoreService"=2
"sdAuxService"=2
"McTskshd.exe"=2
"mcupdmgr.exe"=3
"Bonjour Service"=2

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

C:\Documents and Settings\Start Menu\Programs\Startup
Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-13 239616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-10-05 83224]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe"="C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe:*:Enabled:LaunchPad"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"C:\Program Files\QuickTime\QuickTimePlayer.exe"="C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player"
"C:\WINDOWS\system32\scrnsave.scr"="C:\WINDOWS\system32\scrnsave.scr:*:Enabled:scrnsave"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\RTHDCPL.exe"="C:\WINDOWS\RTHDCPL.exe:*:Enabled:RTHDCPL"
"C:\Documents and Settings\Application Data\Microsoft\Installer\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\_5C99E29DDF4411B426A6B2.exe"="C:\Documents and Settings\Application Data\Microsoft\Installer\{770E62CE-FF53-4CBD-86F9-9C0FBAEE88BB}\_5C99E29DDF4411B426A6B2.exe:*:Enabled:_5C99E29DDF4411B426A6B2"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.scr - open - "C:\WINDOWS\system32\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2009-07-23 17:48:12 ----A---- C:\ComboFix.txt
2009-07-23 17:39:36 ----D---- C:\WINDOWS\temp
2009-07-23 17:35:26 ----A---- C:\Boot.bak
2009-07-23 17:35:22 ----RASHD---- C:\cmdcons
2009-07-23 17:31:10 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-07-23 15:43:31 ----A---- C:\WINDOWS\zip.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\SWXCACLS.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\SWSC.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\SWREG.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\sed.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\PEV.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\NIRCMD.exe
2009-07-23 15:43:31 ----A---- C:\WINDOWS\grep.exe
2009-07-23 15:43:19 ----D---- C:\WINDOWS\ERDNT
2009-07-23 15:43:09 ----D---- C:\Qoobox
2009-07-22 20:29:51 ----D---- C:\rsit
2009-07-22 20:29:51 ----D---- C:\Program Files\trend micro
2009-07-22 15:02:48 ----D---- C:\Program Files\SUPERAntiSpyware
2009-07-22 15:02:48 ----D---- C:\Documents and Settings\Application Data\SUPERAntiSpyware.com
2009-07-22 15:02:38 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-07-15 11:02:38 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-15 11:02:34 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-15 11:01:10 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-02 13:14:23 ----D---- C:\Program Files\AutoCAD 2008
2009-07-02 13:14:23 ----D---- C:\Documents and Settings\Application Data\Autodesk
2009-07-02 13:14:23 ----D---- C:\Documents and Settings\All Users\Application Data\Autodesk
2009-07-02 13:12:45 ----D---- C:\Program Files\Common Files\Autodesk Shared
2009-07-02 13:12:45 ----D---- C:\Program Files\Autodesk
2009-07-02 12:48:49 ----D---- C:\Program Files\Alcohol Soft
2009-07-02 12:43:25 ----D---- C:\Program Files\PowerISO
2009-06-29 16:33:14 ----D---- C:\Program Files\Primavera
2009-06-29 16:33:14 ----D---- C:\Program Files\Common Files\Primavera Common
2009-06-29 16:33:14 ----D---- C:\Program Files\Common Files\Borland Shared
2009-06-29 16:29:08 ----D---- C:\Program Files\MSSQL
2009-06-29 16:27:52 ----D---- C:\Program Files\MSXML 6.0
2009-06-29 16:26:11 ----D---- C:\Program Files\Microsoft SQL Server
2009-06-29 16:12:26 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-06-29 15:57:58 ----D---- C:\WINDOWS\system32\XPSViewer
2009-06-29 15:57:48 ----D---- C:\Program Files\Reference Assemblies
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-06-29 15:57:12 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-06-29 15:57:12 ----D---- C:\9d5a35ddca906c17504171ef46c7
2009-06-29 15:51:27 ----HDC---- C:\WINDOWS\$NtUninstallKB969897$
2009-06-29 15:51:20 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-29 15:51:16 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-29 15:51:12 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-29 15:51:06 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-29 15:50:34 ----D---- C:\WINDOWS\ie8updates
2009-06-29 15:50:16 ----D---- C:\WINDOWS\WBEM
2009-06-29 15:48:26 ----HDC---- C:\WINDOWS\ie8
2009-06-29 15:47:11 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-29 15:45:42 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-06-29 15:45:37 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-06-29 15:45:30 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-06-29 15:45:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-06-29 15:45:06 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-06-29 15:45:01 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-06-29 15:44:50 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-06-29 15:44:40 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-06-29 15:44:36 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-29 15:44:31 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-06-29 15:44:26 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-06-29 15:44:21 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-06-29 15:44:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-06-29 15:34:23 ----D---- C:\WINDOWS\Prefetch
2009-06-29 15:32:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-06-29 15:32:02 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2009-06-29 15:31:54 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-06-29 15:31:50 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2009-06-29 15:31:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-06-29 15:31:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-06-29 15:31:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-06-29 15:31:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2009-06-29 15:31:18 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-06-29 15:31:12 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-06-29 15:31:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2009-06-29 15:30:58 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
2009-06-29 15:30:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-06-29 15:30:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-06-29 15:30:43 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-06-29 15:30:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-06-29 15:30:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-29 15:30:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2009-06-29 15:30:23 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-06-29 15:30:18 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-06-29 15:30:13 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-06-29 15:30:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
2009-06-29 15:30:03 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-06-29 15:29:59 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2009-06-29 15:28:24 ----A---- C:\WINDOWS\setuplog.txt
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\scripting
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\en-us
2009-06-29 15:27:34 ----D---- C:\WINDOWS\system32\en
2009-06-29 15:27:34 ----D---- C:\WINDOWS\l2schemas
2009-06-29 15:27:33 ----D---- C:\WINDOWS\system32\bits
2009-06-29 15:25:34 ----D---- C:\WINDOWS\ServicePackFiles
2009-06-29 15:22:38 ----D---- C:\WINDOWS\network diagnostic
2009-06-29 15:17:56 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-06-29 15:17:55 ----D---- C:\WINDOWS\EHome
2009-06-29 15:10:10 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2009-06-29 14:38:23 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$

======List of files/folders modified in the last 1 months======

2009-07-23 17:48:13 ----D---- C:\WINDOWS\system32\drivers
2009-07-23 17:48:13 ----D---- C:\WINDOWS\system32
2009-07-23 17:46:49 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-23 17:41:37 ----HD---- C:\WINDOWS
2009-07-23 17:41:36 ----A---- C:\WINDOWS\system.ini
2009-07-23 17:38:49 ----D---- C:\WINDOWS\AppPatch
2009-07-23 17:38:45 ----D---- C:\Program Files\Common Files
2009-07-23 17:35:26 ----RASH---- C:\boot.ini
2009-07-23 17:34:40 ----AH---- C:\WINDOWS\SchedLgU.Txt
2009-07-23 17:32:00 ----D---- C:\Program Files\Mozilla Firefox
2009-07-23 17:31:15 ----SHD---- C:\WINDOWS\Installer
2009-07-23 17:31:15 ----SHD---- C:\Config.Msi
2009-07-23 17:30:59 ----A---- C:\WINDOWS\system32\javaws.exe
2009-07-23 17:30:59 ----A---- C:\WINDOWS\system32\javaw.exe
2009-07-23 17:30:59 ----A---- C:\WINDOWS\system32\java.exe
2009-07-23 17:30:56 ----D---- C:\Program Files\Java
2009-07-23 16:10:34 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-23 16:02:28 ----D---- C:\Program Files
2009-07-23 15:13:02 ----D---- C:\Documents and Settings\All Users\Application Data\McAfee.com
2009-07-23 15:12:41 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-07-23 14:13:11 ----AH---- C:\WINDOWS\NeroDigital.ini
2009-07-23 13:32:41 ----AH---- C:\WINDOWS\ntbtlog.txt
2009-07-16 16:44:17 ----D---- C:\Documents and Settings\All Users\Application Data\myitlab
2009-07-15 11:02:40 ----HD---- C:\WINDOWS\inf
2009-07-15 11:02:37 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-15 11:02:36 ----A---- C:\WINDOWS\imsins.BAK
2009-07-13 13:28:06 ----D---- C:\Program Files\New Folder
2009-07-09 17:44:48 ----D---- C:\WINDOWS\Help
2009-07-02 13:48:27 ----D---- C:\New Folder (2)
2009-07-02 13:19:56 ----RSD---- C:\WINDOWS\assembly
2009-07-02 13:19:56 ----D---- C:\WINDOWS\Microsoft.NET
2009-07-02 13:19:07 ----RSD---- C:\WINDOWS\Fonts
2009-07-02 13:18:54 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-07-02 13:18:11 ----D---- C:\WINDOWS\WinSxS
2009-07-02 13:14:05 ----HD---- C:\Program Files\Uninstall Information
2009-07-02 13:12:32 ----D---- C:\WINDOWS\system32\DirectX
2009-07-02 13:12:15 ----D---- C:\Program Files\Common Files\DESIGNER
2009-07-02 13:12:14 ----D---- C:\Program Files\Microsoft Office
2009-07-02 13:12:14 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-06-30 10:51:32 ----SD---- C:\WINDOWS\Tasks
2009-06-29 16:32:33 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-06-29 16:32:14 ----SD---- C:\Documents and Settings\Application Data\Microsoft
2009-06-29 16:26:36 ----D---- C:\WINDOWS\Registration
2009-06-29 16:13:40 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-29 16:04:22 ----D---- C:\WINDOWS\SxsCaPendDel
2009-06-29 16:04:21 ----D---- C:\Program Files\Internet Explorer
2009-06-29 16:04:20 ----D---- C:\WINDOWS\system32\wbem
2009-06-29 15:57:54 ----D---- C:\Program Files\MSBuild
2009-06-29 15:57:24 ----D---- C:\WINDOWS\system32\spool
2009-06-29 15:50:18 ----D---- C:\WINDOWS\system32\config
2009-06-29 15:50:05 ----D---- C:\WINDOWS\Media
2009-06-29 15:35:44 ----AH---- C:\WINDOWS\OEWABLog.txt
2009-06-29 15:33:53 ----D---- C:\WINDOWS\system32\Setup
2009-06-29 15:30:05 ----D---- C:\Program Files\Messenger
2009-06-29 15:29:47 ----D---- C:\WINDOWS\security
2009-06-29 15:27:49 ----D---- C:\WINDOWS\ime
2009-06-29 15:27:35 ----D---- C:\WINDOWS\system32\usmt
2009-06-29 15:27:33 ----D---- C:\WINDOWS\PeerNet
2009-06-29 15:27:33 ----D---- C:\Program Files\Movie Maker
2009-06-29 15:25:27 ----D---- C:\WINDOWS\system32\Restore
2009-06-29 15:25:27 ----D---- C:\WINDOWS\system32\npp
2009-06-29 15:25:26 ----D---- C:\WINDOWS\msagent
2009-06-29 15:25:24 ----D---- C:\WINDOWS\srchasst
2009-06-29 15:25:23 ----D---- C:\Program Files\NetMeeting
2009-06-29 15:25:21 ----D---- C:\WINDOWS\system32\Com
2009-06-29 15:25:18 ----D---- C:\Program Files\Windows Media Player
2009-06-29 15:25:17 ----D---- C:\Program Files\Windows NT
2009-06-29 15:25:17 ----D---- C:\Program Files\Outlook Express
2009-06-29 15:25:12 ----D---- C:\Program Files\Common Files\System
2009-06-29 15:24:48 ----D---- C:\WINDOWS\system32\oobe
2009-06-29 15:24:46 ----D---- C:\WINDOWS\system

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-08-03 20747]
R2 elagopro;GoProto Protocol Driver for LELA; C:\WINDOWS\system32\DRIVERS\elagopro.sys [2007-03-22 28672]
R2 elaunidr;UniDriver for LELA; C:\WINDOWS\system32\DRIVERS\elaunidr.sys [2007-03-22 5376]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 catchme;catchme; \??\C:\DOCUME~1\~1\LOCALS~1\Temp\catchme.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\PROGRA~1\Linksys\WMP300N\GTNDIS5.SYS []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-04-28 3663040]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 WMP300Nv1;Linksys Wireless-N PCI Adapter WMP300N Driver; C:\WINDOWS\system32\DRIVERS\WMP300Nv1.sys [2007-10-18 822400]
S3 afotwjow;afotwjow; C:\WINDOWS\system32\drivers\afotwjow.sys []
S3 AR5211;Gigabyte Super Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-11-04 487552]
S3 BCM42RLY;BCM42RLY; \??\C:\WINDOWS\System32\BCM42RLY.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568]
S3 MREMP50;MREMP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS []
S3 MREMP50a64;MREMP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS []
S3 MRESP50;MRESP50 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS []
S3 MRESP50a64;MRESP50a64 NDIS Protocol Driver; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS []
S3 RT73;Linksys Home Wireless-G USB Adapter Driver; C:\WINDOWS\system32\DRIVERS\rt73.sys [2005-11-24 245248]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-23 152984]
R2 McciCMService;McciCMService; C:\Program Files\Common Files\Motive\McciCMService.exe [2008-09-23 303104]
R2 msftesql$PRIMAVERA;SQL Server FullText Search (PRIMAVERA); C:\Program Files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\msftesql.exe [2006-08-28 92952]
R2 MSSQL$PRIMAVERA;SQL Server (PRIMAVERA); C:\Program Files\MSSQL\Primavera\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-04-28 143426]
R2 pgsql-8.3;PostgreSQL Database Server 8.3; C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe [2008-09-19 65536]
R2 PrmBackAgent;Primavera Background Agent; C:\Program Files\Common Files\Primavera Common\BackgroundAgent\PrmBackgroundAgent.exe [2007-03-30 673280]
R2 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]
R2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 wltrysvc;Broadcom Wireless LAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2007-07-23 24064]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S2 gupdate1c9f3058e2885fa;Google Update Service (gupdate1c9f3058e2885fa); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-22 133104]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632]
S2 WMP300NSvc;WMP300NSvc; C:\Program Files\Linksys\WMP300N\WLService.exe [2005-07-04 53307]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2009-07-02 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 HP Port Resolver;HP Port Resolver; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE [2005-05-20 81920]
S3 HP Status Server;HP Status Server; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE [2004-10-16 73728]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S4 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-10-05 13592]
S4 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S4 WUSB54GCSVC;WUSB54GCSVC; C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe [2005-07-04 53307]

-----------------EOF-----------------

#6 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:25 AM

Posted 23 July 2009 - 06:00 PM

Hello,

How is it running now please?
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#7 buyerat

buyerat
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:10:25 AM

Posted 23 July 2009 - 06:37 PM

It's running so much better now and it all seems to be gone. Thank you so much for you time and help. Words can't express how much I appreciate it. Comp problems are just so frustrating when I rely on it so much nowadays.


Thanks again

#8 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:25 AM

Posted 23 July 2009 - 09:05 PM

Hello,

Excellent to know, and you're welcome. :thumbup2:

I see a couple of ActiveX entries for Norton, a couple of McAfee files but nothing running in the way of AntiVirus. AVG, Avira OR Avast are good FREE antivirus. I use Avira on my own system, but have used the others as well. All good. :)

Please delete ComboFix and its accompanying folder C:\Qoobox. Empty your Recycle bin and reboot your computer.

If there are no further problems: Great tips and info-----> http://mvps.org/winhelp2002/unwanted.htm

Take care,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#9 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:25 AM

Posted 27 July 2009 - 05:39 AM

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users