Hi,
Thanks for this. I think I may have got rid of this, but I have had three false alarms (thinking I'd removed it) already. Pleae find the logs attached...
Regards
Darren
Logfile of random's system information tool 1.06 (written by random/random)
Run by DazAndMich at 2010-03-19 19:23:25
Microsoft Windows XP Professional Service Pack 3
System drive C: has 20 GB (51%) free of 38 GB
Total RAM: 503 MB (12% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:23:54, on 19/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\windows\RTHDCPL.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Xmarks\IE Extension\xmarkssync.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\windows\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Downloads\RSIT.exe
C:\Program Files\trend micro\DazAndMich.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MPlayerForWindows_UpdateReminder] "C:\Program Files\MPlayer for Windows\AutoUpdate.exe" /L=1033 /TASK
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Xmarks] C:\Program Files\Xmarks\IE Extension\xmarkssync.exe -q
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - {638F11AA-DF27-433b-BA2E-7281CE561D71} - C:\Program Files\Xmarks\IE Extension\xmarkssync.exe (HKCU)
O9 - Extra 'Tools' menuitem: Xmarks for IE... - {638F11AA-DF27-433b-BA2E-7281CE561D71} - C:\Program Files\Xmarks\IE Extension\xmarkssync.exe (HKCU)
O15 - Trusted IP range:
http://192.168.0.1O15 - ESC Trusted IP range:
http://192.168.0.1O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat...b?1239974078046O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) -
http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-27-0.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{4C5C5C23-628A-4489-A823-F81CF4479695}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CS1\Services\Tcpip\..\{4C5C5C23-628A-4489-A823-F81CF4479695}: NameServer = 208.67.222.222,208.67.220.220
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Google Update Service (gupdate1c9ccea59430db0) (gupdate1c9ccea59430db0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 6179 bytes
======Scheduled tasks folder======
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\windows\tasks\HP Usg Daily.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll [2009-12-10 394608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL [2009-11-17 79224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-17 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-17 79648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll [2009-12-10 394608]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-01-13 131072]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-01-13 163840]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-01-13 135168]
"High Definition Audio Property Page Shortcut"=C:\windows\system32\HDAShCut.exe [2005-01-07 61952]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2005-07-08 176128]
"HPHUPD05"=C:\Program Files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe [2005-07-08 49152]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2004-05-12 241664]
"HPHmon05"=C:\WINDOWS\system32\hphmon05.exe [2005-07-08 491520]
"RTHDCPL"=C:\windows\RTHDCPL.EXE [2009-04-17 17880576]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"MPlayerForWindows_UpdateReminder"=C:\Program Files\MPlayer for Windows\AutoUpdate.exe [2010-03-02 234919]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Xmarks"=C:\Program Files\Xmarks\IE Extension\xmarkssync.exe [2009-11-12 1007616]
"ctfmon.exe"=C:\windows\system32\ctfmon.exe [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2007-01-13 204800]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro35]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro35.sys]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======File associations======
.txt - open -
======List of files/folders created in the last 3 months======
2010-03-19 19:23:30 ----D---- C:\Program Files\trend micro
2010-03-19 19:23:25 ----D---- C:\rsit
2010-03-18 23:21:59 ----SHD---- C:\RECYCLER
2010-03-18 21:53:29 ----A---- C:\windows\MBR.exe
2010-03-18 21:53:27 ----A---- C:\windows\zip.exe
2010-03-18 21:53:27 ----A---- C:\windows\SWXCACLS.exe
2010-03-18 21:53:27 ----A---- C:\windows\SWSC.exe
2010-03-18 21:53:27 ----A---- C:\windows\SWREG.exe
2010-03-18 21:53:27 ----A---- C:\windows\sed.exe
2010-03-18 21:53:27 ----A---- C:\windows\PEV.exe
2010-03-18 21:53:27 ----A---- C:\windows\grep.exe
2010-03-18 21:49:46 ----D---- C:\windows\ERDNT
2010-03-18 21:31:23 ----A---- C:\windows\system32\tmp.txt
2010-03-18 20:27:31 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2010-03-18 18:48:43 ----D---- C:\Documents and Settings\All Users\Application Data\Hitman Pro
2010-03-18 18:48:31 ----D---- C:\Program Files\Hitman Pro 3.5
2010-03-17 21:39:20 ----D---- C:\Documents and Settings\DazAndMich\Application Data\Macromedia
2010-03-17 20:43:29 ----A---- C:\windows\system32\javaws.exe
2010-03-17 20:43:29 ----A---- C:\windows\system32\javaw.exe
2010-03-17 20:43:29 ----A---- C:\windows\system32\java.exe
2010-03-17 20:42:57 ----D---- C:\Program Files\Java
2010-03-16 22:15:00 ----D---- C:\ConverterOutput
2010-03-16 22:13:43 ----A---- C:\Cucu_Video_log.txt
2010-03-16 22:12:02 ----A---- C:\windows\system32\cdga.dll
2010-03-16 22:12:02 ----A---- C:\windows\system32\cdg.dll
2010-03-15 22:41:52 ----A---- C:\windows\iun6002.exe
2010-03-15 22:41:49 ----D---- C:\Program Files\TuneXP
2010-03-15 21:36:54 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-15 21:29:59 ----D---- C:\Program Files\TrendMicro
2010-03-15 20:45:01 ----D---- C:\Documents and Settings\DazAndMich\Application Data\Secunia CSI
2010-03-13 21:51:04 ----D---- C:\Documents and Settings\DazAndMich\Application Data\InfraRecorder
2010-03-13 21:50:32 ----D---- C:\Program Files\InfraRecorder
2010-03-11 20:01:59 ----D---- C:\Program Files\Secunia
2010-03-10 03:04:45 ----HDC---- C:\windows\$NtUninstallKB975561$
2010-03-07 16:47:35 ----A---- C:\windows\system32\mp3Media2.dll
2010-03-07 16:47:34 ----D---- C:\Program Files\Smallvideosoft
2010-03-07 10:20:58 ----A---- C:\windows\system32\unicows.dll
2010-03-07 10:20:58 ----A---- C:\windows\system32\pthreadGC2.dll
2010-03-07 10:20:57 ----A---- C:\windows\system32\ff_vfw.dll.manifest
2010-03-07 10:20:57 ----A---- C:\windows\system32\ff_vfw.dll
2010-03-06 18:44:51 ----A---- C:\windows\imsins.BAK
2010-03-06 18:44:35 ----HDC---- C:\windows\$NtUninstallKB902344$
2010-03-05 20:14:51 ----D---- C:\Program Files\KompoZer
2010-03-05 20:02:31 ----D---- C:\Program Files\KompoZer 0.7.10
2010-03-04 21:53:29 ----D---- C:\Program Files\Cucusoft
2010-03-04 21:17:21 ----A---- C:\windows\Crypkey.ini
2010-03-04 21:17:16 ----A---- C:\windows\Ckrfresh.exe
2010-03-04 21:17:16 ----A---- C:\windows\Ckconfig.exe
2010-03-04 21:17:15 ----RA---- C:\windows\Setup_ck.exe
2010-03-04 21:17:15 ----A---- C:\windows\Setup_ck.dll
2010-03-04 21:01:48 ----D---- C:\Program Files\Blue Cat Audio
2010-02-28 15:59:39 ----A---- C:\windows\system32\GEARAspi.dll
2010-02-27 20:50:15 ----D---- C:\Program Files\AnvSoft
2010-02-26 07:02:22 ----N---- C:\windows\system32\browserchoice.exe
2010-02-24 23:48:00 ----HDC---- C:\windows\$NtUninstallKB979306$
2010-02-24 23:34:23 ----D---- C:\Program Files\WinZip14
2010-02-17 21:18:54 ----D---- C:\Program Files\FileZilla FTP Client
2010-02-15 20:50:33 ----A---- C:\windows\system32\AudPlayer.dll
2010-02-15 20:50:33 ----A---- C:\windows\system32\AudioVisu.dll
2010-02-15 20:50:33 ----A---- C:\windows\system32\AudioRecord.dll
2010-02-15 20:50:33 ----A---- C:\windows\system32\AudioInfos.dll
2010-02-15 20:50:33 ----A---- C:\windows\system32\AudFile.dll
2010-02-15 20:50:33 ----A---- C:\windows\system32\AudDisplay.dll
2010-02-15 20:50:32 ----A---- C:\windows\system32\VB6STKIT.DLL
2010-02-15 20:50:32 ----A---- C:\windows\system32\VB6FR.DLL
2010-02-15 20:50:32 ----A---- C:\windows\system32\TABCTFR.DLL
2010-02-15 20:50:32 ----A---- C:\windows\system32\inetfr.DLL
2010-02-15 20:50:32 ----A---- C:\windows\system32\AudDesign.dll
2010-02-15 20:50:31 ----A---- C:\windows\system32\MSCMCFR.DLL
2010-02-15 20:50:31 ----A---- C:\windows\system32\Mscc2fr.dll
2010-02-15 20:50:31 ----A---- C:\windows\system32\CMDLGFR.DLL
2010-02-15 20:50:30 ----A---- C:\windows\system32\lame_enc.dll
2010-02-15 20:50:29 ----D---- C:\Program Files\Free Audio Pack
2010-02-10 21:06:18 ----HDC---- C:\windows\$NtUninstallKB978262$
2010-02-10 21:05:26 ----HDC---- C:\windows\$NtUninstallKB971468$
2010-02-10 20:56:16 ----HDC---- C:\windows\$NtUninstallKB978037$
2010-02-10 20:55:59 ----HDC---- C:\windows\$NtUninstallKB975713$
2010-02-10 20:55:50 ----HDC---- C:\windows\$NtUninstallKB978251$
2010-02-10 20:54:35 ----HDC---- C:\windows\$NtUninstallKB975560$
2010-02-10 20:52:57 ----HDC---- C:\windows\$NtUninstallKB977914$
2010-02-10 20:50:44 ----HDC---- C:\windows\$NtUninstallKB978706$
2010-02-10 20:47:30 ----HDC---- C:\windows\$NtUninstallKB977165$
2010-01-30 21:33:03 ----D---- C:\Program Files\ffdshow
2010-01-30 21:28:02 ----D---- C:\Program Files\Haali
2010-01-30 21:23:00 ----D---- C:\Temp
2010-01-30 21:22:59 ----A---- C:\windows\system32\MagUIInter.dll
2010-01-30 21:22:59 ----A---- C:\windows\system32\MagUIEngine.dll
2010-01-30 21:22:59 ----A---- C:\windows\system32\MagPCMac.dll
2010-01-30 21:22:59 ----A---- C:\windows\system32\MagCore.dll
2010-01-30 21:22:59 ----A---- C:\windows\system32\dtsdecoderdll.dll
2010-01-30 21:22:58 ----A---- C:\windows\system32\libFLAC.dll
2010-01-30 21:22:58 ----A---- C:\windows\system32\checkactivate.dll
2010-01-30 21:22:55 ----A---- C:\windows\system32\yv12vfw.dll
2010-01-30 21:15:51 ----D---- C:\Program Files\RipBot
2010-01-27 22:04:58 ----D---- C:\Documents and Settings\All Users\Application Data\Sun
2010-01-27 22:04:52 ----D---- C:\Program Files\Common Files\Java
2010-01-26 20:26:35 ----D---- C:\Documents and Settings\DazAndMich\Application Data\AccurateRip
2010-01-26 20:11:23 ----D---- C:\Program Files\Exact Audio Copy
2010-01-19 21:21:14 ----D---- C:\Program Files\MPlayer for Windows
2010-01-16 09:28:29 ----D---- C:\Program Files\Windows Installer Clean Up
2010-01-16 09:28:09 ----D---- C:\Program Files\MSECACHE
2010-01-15 21:49:48 ----D---- C:\Program Files\Common Files\Apple
2010-01-15 21:08:40 ----D---- C:\Config.Msi
2010-01-14 22:21:50 ----HDC---- C:\windows\$NtUninstallKB955759$
2010-01-12 21:41:15 ----HDC---- C:\windows\$NtUninstallKB972270$
2010-01-06 22:24:16 ----D---- C:\Documents and Settings\DazAndMich\Application Data\SPlayer
======List of files/folders modified in the last 3 months======
2010-03-19 19:23:30 ----RD---- C:\Program Files
2010-03-19 19:23:25 ----D---- C:\windows\Prefetch
2010-03-19 19:23:15 ----D---- C:\windows\Temp
2010-03-19 19:22:43 ----D---- C:\Downloads
2010-03-19 19:12:56 ----SHD---- C:\System Volume Information
2010-03-19 00:15:51 ----A---- C:\windows\SchedLgU.Txt
2010-03-19 00:14:04 ----SHD---- C:\windows\Installer
2010-03-19 00:14:04 ----D---- C:\Program Files\Common Files
2010-03-18 22:20:52 ----D---- C:\windows\system32\drivers
2010-03-18 22:18:57 ----D---- C:\windows\system32\CatRoot2
2010-03-18 22:11:24 ----D---- C:\WINDOWS
2010-03-18 22:11:24 ----A---- C:\windows\system.ini
2010-03-18 22:06:57 ----D---- C:\windows\system32
2010-03-18 22:06:57 ----D---- C:\windows\system
2010-03-18 22:03:39 ----D---- C:\windows\AppPatch
2010-03-18 21:53:26 ----D---- C:\windows\system32\Restore
2010-03-17 21:09:33 ----D---- C:\Documents and Settings\DazAndMich\Application Data\uTorrent
2010-03-17 20:50:32 ----D---- C:\Program Files\Mp3tag
2010-03-17 20:43:00 ----A---- C:\windows\system32\deploytk.dll
2010-03-17 19:44:59 ----HD---- C:\windows\inf
2010-03-16 20:29:23 ----RSD---- C:\windows\assembly
2010-03-16 20:29:04 ----D---- C:\windows\system32\URTTemp
2010-03-16 20:28:45 ----D---- C:\windows\Registration
2010-03-16 20:28:33 ----A---- C:\windows\system32\PerfStringBackup.INI
2010-03-15 23:33:59 ----A---- C:\windows\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt
2010-03-15 22:48:20 ----A---- C:\windows\win.ini
2010-03-15 06:51:10 ----D---- C:\windows\Microsoft.NET
2010-03-10 07:16:02 ----D---- C:\windows\RegisteredPackages
2010-03-10 07:13:51 ----SD---- C:\windows\Tasks
2010-03-10 03:04:49 ----RSHDC---- C:\windows\system32\dllcache
2010-03-10 03:04:49 ----D---- C:\Program Files\Movie Maker
2010-03-10 03:04:13 ----HD---- C:\windows\$hf_mig$
2010-03-10 03:00:51 ----D---- C:\windows\Debug
2010-03-08 22:31:12 ----D---- C:\Documents and Settings\DazAndMich\Application Data\FileZilla
2010-03-08 21:48:13 ----D---- C:\Program Files\Mozilla Firefox
2010-03-06 19:02:10 ----D---- C:\windows\WinSxS
2010-03-06 18:47:35 ----D---- C:\Program Files\Internet Explorer
2010-03-06 18:47:30 ----D---- C:\windows\ie8updates
2010-03-04 19:19:18 ----D---- C:\Program Files\uTorrent
2010-03-02 05:30:12 ----A---- C:\windows\system32\MRT.exe
2010-03-01 18:07:13 ----D---- C:\Documents and Settings\DazAndMich\Application Data\Mozilla
2010-02-28 22:06:14 ----SD---- C:\Documents and Settings\DazAndMich\Application Data\Microsoft
2010-02-28 15:50:40 ----D---- C:\Program Files\CCleaner
2010-02-27 20:50:22 ----D---- C:\Documents and Settings\DazAndMich\Application Data\AnvSoft
2010-02-25 20:17:53 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
2010-02-19 18:58:43 ----D---- C:\windows\system32\CatRoot
2010-02-19 18:52:11 ----D---- C:\Program Files\Windows Media Player
2010-02-18 22:24:37 ----D---- C:\windows\Help
2010-02-17 23:33:59 ----D---- C:\windows\security
2010-02-16 20:27:29 ----D---- C:\Program Files\Google
2010-02-06 09:09:48 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2010-02-01 19:33:13 ----SD---- C:\windows\Downloaded Program Files
2010-01-30 21:07:13 ----D---- C:\Program Files\AviSynth 2.5
2010-01-27 22:07:36 ----D---- C:\Program Files\AlbumArtDownloader
2010-01-24 08:41:58 ----D---- C:\Program Files\NortonInstaller
2010-01-23 08:11:44 ----N---- C:\windows\system32\tzchange.exe
2010-01-18 21:17:06 ----D---- C:\Program Files\Adobe
2010-01-18 21:14:37 ----D---- C:\Program Files\Hewlett-Packard
2010-01-18 21:13:57 ----D---- C:\Program Files\Microsoft Bootvis
2010-01-18 21:12:58 ----D---- C:\Program Files\Xilisoft
2010-01-18 20:57:13 ----D---- C:\Program Files\Acro Software
2010-01-18 20:53:54 ----D---- C:\Documents and Settings\DazAndMich\Application Data\Any Video Converter
2010-01-18 20:50:22 ----D---- C:\Documents and Settings\DazAndMich\Application Data\Amazon
2010-01-18 20:42:11 ----D---- C:\Program Files\ElcomSoft
2010-01-18 20:11:48 ----D---- C:\Program Files\Common Files\Adobe
2010-01-16 11:46:18 ----D---- C:\Documents and Settings\DazAndMich\Application Data\Adobe
2010-01-16 11:23:20 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-01-16 09:24:58 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2010-01-15 23:04:00 ----DC---- C:\windows\system32\DRVSTORE
2010-01-12 18:46:58 ----D---- C:\Documents and Settings\DazAndMich\Application Data\DivX
2010-01-09 21:07:54 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-12-22 22:32:14 ----A---- C:\windows\APDFPRP.INI
2009-12-21 19:14:05 ----N---- C:\windows\system32\wininet.dll
2009-12-21 19:14:05 ----A---- C:\windows\system32\urlmon.dll
2009-12-21 19:14:04 ----N---- C:\windows\system32\mshtml.dll
2009-12-21 19:14:04 ----A---- C:\windows\system32\occache.dll
2009-12-21 19:14:03 ----A---- C:\windows\system32\msfeedsbs.dll
2009-12-21 19:14:03 ----A---- C:\windows\system32\msfeeds.dll
2009-12-21 19:14:03 ----A---- C:\windows\system32\jsproxy.dll
2009-12-21 19:14:03 ----A---- C:\windows\system32\iertutil.dll
2009-12-21 19:14:03 ----A---- C:\windows\system32\iepeers.dll
2009-12-21 19:14:02 ----A---- C:\windows\system32\ieframe.dll
2009-12-21 19:14:01 ----A---- C:\windows\system32\iedkcs32.dll
2009-12-21 13:19:18 ----A---- C:\windows\system32\ie4uinit.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 BHDrvx86;BHDrvx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100211.001\BHDrvx86.sys []
R1 ccHP;Symantec Hash Provider; C:\windows\system32\drivers\NIS\1105000.07F\ccHPx86.sys [2009-12-09 501888]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:\windows\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\windows\system32\DRIVERS\kbdhid.sys [2008-04-14 14592]
R1 SRTSP;Symantec Real Time Storage Protection; C:\windows\System32\Drivers\NIS\1105000.07F\SRTSP.SYS [2009-12-03 325168]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\windows\system32\drivers\NIS\1105000.07F\SRTSPX.SYS [2009-12-03 43696]
R1 SymIRON;Symantec Iron Driver; C:\windows\system32\drivers\NIS\1105000.07F\Ironx86.SYS [2009-11-26 116272]
R1 SYMTDI;Symantec Network Dispatch Driver; C:\windows\System32\Drivers\NIS\1105000.07F\SYMTDI.SYS [2009-11-22 362032]
R2 mdmxsdk;mdmxsdk; C:\windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R3 Arp1394;1394 ARP Client Protocol; C:\windows\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\windows\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\windows\system32\DRIVERS\GEARAspiWDM.sys [2009-12-23 15664]
R3 HBtnKey;ThinkPad Tablet Keyboard and Buttons HID Driver; C:\windows\system32\DRIVERS\tkbtnpn.sys [2005-11-15 7463]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\windows\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HSF_DPV;HSF_DPV; C:\windows\system32\DRIVERS\HSF_DPV.sys [2008-10-15 985856]
R3 HSFHWAZL;HSFHWAZL; C:\windows\system32\DRIVERS\HSFHWAZL.sys [2008-10-15 210048]
R3 ialm;ialm; C:\windows\system32\DRIVERS\igxpmp32.sys [2007-01-13 5672032]
R3 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100312.001\IDSxpx86.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RtkHDAud.sys [2009-04-20 5070848]
R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100317.051\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100317.051\NAVEX15.SYS []
R3 NIC1394;1394 Net Driver; C:\windows\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\windows\system32\DRIVERS\Rtnicxp.sys [2009-03-25 130432]
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SymIMMP;SymIMMP; C:\windows\system32\DRIVERS\SymIM.sys [2009-12-03 47408]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\windows\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\windows\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\windows\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\windows\system32\DRIVERS\w29n51.sys [2008-01-07 2216064]
R3 winachsf;winachsf; C:\windows\system32\DRIVERS\HSF_CNXT.sys [2008-10-15 731264]
S3 Ambfilt;Ambfilt; C:\windows\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\windows\system32\DRIVERS\HPZid412.sys [2005-07-08 51088]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\windows\system32\DRIVERS\HPZipr12.sys [2005-07-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\windows\system32\DRIVERS\HPZius12.sys [2005-07-08 21744]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1; C:\windows\system32\drivers\libusb0.sys [2007-03-20 28672]
S3 MHNDRV;MHN driver; C:\windows\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 Monfilt;Monfilt; C:\windows\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\windows\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
S3 SYMFW;Symantec Network Filter Driver; C:\windows\System32\Drivers\NIS\1007020.00B\SYMFW.SYS []
S3 SYMIDS;Symantec Network Filter Driver; C:\windows\System32\Drivers\NIS\1007020.00B\SYMIDS.SYS []
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\windows\system32\DRIVERS\SymIM.sys [2009-12-03 47408]
S3 SYMNDIS;Symantec Network Filter Driver; C:\windows\System32\Drivers\NIS\1007020.00B\SYMNDIS.SYS []
S3 UIUSys;Conexant Setup API; C:\windows\system32\DRIVERS\UIUSYS.SYS []
S3 USBAAPL;Apple Mobile USB Driver; C:\windows\System32\Drivers\usbaapl.sys []
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\windows\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB PRINTER Class; C:\windows\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WpdUsb;WpdUsb; C:\windows\System32\Drivers\wpdusb.sys [2005-01-28 18944]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\windows\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\windows\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-17 153376]
R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe [2009-12-09 126392]
R2 UMWdf;Windows User Mode Driver Framework; C:\windows\system32\wdfmgr.exe [2005-01-28 38912]
R3 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2004-03-18 65536]
S2 gupdate1c9ccea59430db0;Google Update Service (gupdate1c9ccea59430db0); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-04 133104]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-04-18 72704]
S3 aspnet_state;ASP.NET State Service; C:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\windows\system32\svchost.exe [2008-04-14 14336]
S4 ATMsrvc;ATM Service; C:\windows\System32\ATMsrvc.exe [2000-05-24 15360]
S4 ehRecvr;Media Center Receiver Service; C:\windows\eHome\ehRecvr.exe [2006-10-09 237568]
S4 ehSched;Media Center Scheduler Service; C:\windows\eHome\ehSched.exe [2005-08-05 102912]
S4 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
S4 MHN;MHN; C:\windows\System32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
-----------------EOF-----------------
info.txt logfile of random's system information tool 1.06 2010-03-19 19:23:59
======Uninstall list======
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->MsiExec.exe /X{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000103}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 9.3.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001}
Adobe Shockwave Player 11.5-->"C:\windows\system32\Adobe\Shockwave 11\uninstaller.exe"
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Album Art Downloader XUI 0.34.1-->C:\Program Files\AlbumArtDownloader\uninst.exe
Any Video Converter Professional 3.0.1-->"C:\Program Files\AnvSoft\Any Video Converter Professional\unins000.exe"
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
Cucusoft DVD to iPod + iPod Video Converter Suite 7.19.7.12-->"C:\Program Files\Cucusoft\ipod-converter\unins000.exe"
Defraggler-->"C:\Program Files\Defraggler\uninst.exe"
Exact Audio Copy 0.99pb5-->C:\Program Files\Exact Audio Copy\uninst.exe
ffdshow [rev 3246] [2010-01-30]-->"C:\Program Files\ffdshow\unins000.exe"
FileZilla Client 3.3.2-->C:\Program Files\FileZilla FTP Client\uninstall.exe
Free Mp3 Wma Converter V 1.9-->"C:\Program Files\Free Audio Pack\unins000.exe"
Freez FLV to MP3 Converter-->"C:\Program Files\Smallvideosoft\Freez FLV to MP3 Converter\unins000.exe"
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Haali Media Splitter-->"C:\Program Files\Haali\MatroskaSplitter\uninstall.exe"
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDA_HSF\UIU32m.exe -U -IPZAZCM5K.INF
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format SDK (KB902344)-->"C:\windows\$NtUninstallKB902344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB979306)-->"C:\windows\$NtUninstallKB979306$\spuninst\spuninst.exe"
InfraRecorder-->C:\Program Files\InfraRecorder\uninstall.exe
Intel® Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall
Japanese Fonts Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5760-0000-900000000003}
Java 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Medieval CUE Splitter-->MsiExec.exe /I{B96D2269-568B-4CBF-9332-12FAE8B158F7}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mp3tag v2.46-->C:\Program Files\Mp3tag\Mp3tagUninstall.EXE
MPlayer for Windows (Full Package)-->C:\Program Files\MPlayer for Windows\Uninstall.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Norton Internet Security-->C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\562C4DD5\17.5.0.127\InstStub.exe /X
OpenOffice.org 3.1-->MsiExec.exe /I{E6B87DC4-2B3D-4483-ADFF-E483BF718991}
overland-->MsiExec.exe /I{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}
Photosmart 140,240,7200,7600,7700,7900 Series-->C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\setup\hpzscr01.exe -datfile hphscr01.dat
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Secunia CSI-->"C:\Program Files\Secunia\CSI\uninstall.exe"
Security Update for Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\windows\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB972260)-->"C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB974455)-->"C:\windows\ie8updates\KB974455-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB976325)-->"C:\windows\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB978207)-->"C:\windows\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB970430)-->"C:\windows\$NtUninstallKB970430$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971468)-->"C:\windows\$NtUninstallKB971468$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973904)-->"C:\windows\$NtUninstallKB973904$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974318)-->"C:\windows\$NtUninstallKB974318$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974392)-->"C:\windows\$NtUninstallKB974392$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975560)-->"C:\windows\$NtUninstallKB975560$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975561)-->"C:\windows\$NtUninstallKB975561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975713)-->"C:\windows\$NtUninstallKB975713$\spuninst\spuninst.exe"
Security Update for Windows XP (KB977165)-->"C:\windows\$NtUninstallKB977165$\spuninst\spuninst.exe"
Security Update for Windows XP (KB977914)-->"C:\windows\$NtUninstallKB977914$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978037)-->"C:\windows\$NtUninstallKB978037$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978251)-->"C:\windows\$NtUninstallKB978251$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978262)-->"C:\windows\$NtUninstallKB978262$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978706)-->"C:\windows\$NtUninstallKB978706$\spuninst\spuninst.exe"
Simple Port Forwarding-->"C:\windows\Simple Port Forwarding\uninstall.exe" "/U:C:\Program Files\Simple Port Forwarding\Uninstall\uninstall.xml"
Simple Port Tester-->"C:\windows\Simple Port Tester\uninstall.exe" "/U:C:\Program Files\Simple Port Tester\Uninstall\uninstall.xml"
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
ThinkPad Tablet Button Driver-->C:\Program Files\InstallShield Installation Information\{26903C89-780A-463E-8CBD-E47A73927254}\setup.exe -runfromtemp -l0x0009 -removeonly
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Windows (KB971513)-->"C:\windows\$NtUninstallKB971513$\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB968220)-->"C:\WINDOWS\ie8updates\KB968220-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB971930)-->"C:\WINDOWS\ie8updates\KB971930-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB972636)-->"C:\WINDOWS\ie8updates\KB972636-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB973874)-->"C:\windows\ie8updates\KB973874-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB975364)-->"C:\windows\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB976662)-->"C:\windows\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB976749)-->"C:\windows\ie8updates\KB976749-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB978506)-->"C:\windows\ie8updates\KB978506-IE8\spuninst\spuninst.exe"
Update for Windows XP (KB955759)-->"C:\windows\$NtUninstallKB955759$\spuninst\spuninst.exe"
Update for Windows XP (KB971737)-->"C:\windows\$NtUninstallKB971737$\spuninst\spuninst.exe"
Windows Driver Package - Intel (NETw5x32) net (11/17/2008 12.2.0.11)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\netw5x32_E3DB7A2849DF31473325B4F9BDB5DAC54591572B\netw5x32.inf
Windows Driver Package - Intel (w29n51) net (12/19/2007 9.0.4.39)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst32.exe /u C:\WINDOWS\system32\DRVSTORE\w29n51_AEF466EE116FDF742A02BFF75E6143DB4A91003C\w29n51.inf
Windows Installer Clean Up-->MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52}
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
WinZip 14.0-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240BC}
Xmarks for IE-->MsiExec.exe /X{F318330F-DE7D-4B22-AF7C-C3760DDC2EF3}
======Security center information======
AV: Norton Internet Security
FW: Norton Internet Security
======System event log======
Computer Name: MACKIN-LAPTOP01
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 16097
Source Name: Tcpip
Time Written: 20100202201854.000000+000
Event Type: warning
User:
Computer Name: MACKIN-LAPTOP01
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 16067
Source Name: Tcpip
Time Written: 20100201195342.000000+000
Event Type: warning
User:
Computer Name: MACKIN-LAPTOP01
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
Record Number: 16066
Source Name: Tcpip
Time Written: 20100201193921.000000+000
Event Type: warning
User:
Computer Name: MACKIN-LAPTOP01
Event Code: 14103
Message: QoS [Adapter {C391F5EA-6857-4AC9-9A0F-00B673513432}]:
The netcard driver failed the query for OID_GEN_LINK_SPEED.
Record Number: 16026
Source Name: PSched
Time Written: 20100131183344.000000+000
Event Type: error
User:
Computer Name: MACKIN-LAPTOP01
Event Code: 14103
Message: QoS [Adapter {C391F5EA-6857-4AC9-9A0F-00B673513432}]:
The netcard driver failed the query for OID_GEN_LINK_SPEED.
Record Number: 16014
Source Name: PSched
Time Written: 20100131170801.000000+000
Event Type: error
User:
=====Application event log=====
Computer Name: MACKIN-LAPTOP01
Event Code: 20
Message:
Record Number: 3059
Source Name: Google Update
Time Written: 20091016022914.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM
Computer Name: MACKIN-LAPTOP01
Event Code: 20
Message:
Record Number: 3058
Source Name: Google Update
Time Written: 20091016012916.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM
Computer Name: MACKIN-LAPTOP01
Event Code: 20
Message:
Record Number: 3057
Source Name: Google Update
Time Written: 20091016002925.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM
Computer Name: MACKIN-LAPTOP01
Event Code: 20
Message:
Record Number: 3056
Source Name: Google Update
Time Written: 20091015232930.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM
Computer Name: MACKIN-LAPTOP01
Event Code: 20
Message:
Record Number: 3055
Source Name: Google Update
Time Written: 20091015222929.000000+060
Event Type: error
User: NT AUTHORITY\SYSTEM
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\Common Files\Adobe\AGL
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0d08
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
GMER 1.0.15.15281 -
http://www.gmer.netRootkit scan 2010-03-19 20:12:44
Windows 5.1.2600 Service Pack 3
Running: 63n6bdom.exe; Driver: C:\DOCUME~1\DAZAND~1\LOCALS~1\Temp\kwriakog.sys
---- System - GMER 1.0.15 ----
SSDT 8217E050 ZwAlertResumeThread
SSDT 815749D0 ZwAlertThread
SSDT 814854D0 ZwAllocateVirtualMemory
SSDT 8224A1A8 ZwAssignProcessToJobObject
SSDT 8226C0D0 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xA91F1210]
SSDT 814E8BC8 ZwCreateMutant
SSDT 814E86B0 ZwCreateSymbolicLinkObject
SSDT 814858E0 ZwCreateThread
SSDT 82262438 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xA91F1490]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xA91F19F0]
SSDT 81485628 ZwDuplicateObject
SSDT 81485330 ZwFreeVirtualMemory
SSDT 8214D050 ZwImpersonateAnonymousToken
SSDT 821A64C8 ZwImpersonateThread
SSDT 82272100 ZwLoadDriver
SSDT 81485250 ZwMapViewOfSection
SSDT 82129050 ZwOpenEvent
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwOpenKey [0xA91F17A0]
SSDT 814857C8 ZwOpenProcess
SSDT 820F1978 ZwOpenProcessToken
SSDT 815172E8 ZwOpenSection
SSDT 814856F8 ZwOpenThread
SSDT 814E8780 ZwProtectVirtualMemory
SSDT 82137180 ZwResumeThread
SSDT 8213B198 ZwSetContextThread
SSDT 814850F8 ZwSetInformationProcess
SSDT 82148050 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xA91F1C40]
SSDT 821435E0 ZwSuspendProcess
SSDT 82146110 ZwSuspendThread
SSDT 814B1070 ZwTerminateProcess
SSDT 8152CA90 ZwTerminateThread
SSDT 82118AE0 ZwUnmapViewOfSection
SSDT 81485400 ZwWriteVirtualMemory
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
---- EOF - GMER 1.0.15 ----
Edited by aommaster, 19 March 2010 - 04:45 PM.