Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan-backdoor-progdav


  • This topic is locked This topic is locked
4 replies to this topic

#1 mcirami

mcirami

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:05 PM

Posted 19 November 2006 - 05:34 PM

Logfile of HijackThis v1.99.1
Scan saved at 4:24:08 PM, on 11/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\PROGRA~1\CHARTE~1\backweb\3528733\Program\SERVIC~1.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\fsgk32st.exe
C:\Program Files\Charter High-Speed Security Suite\backweb\3528733\program\fsbwsys.exe
C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\FSGK32.EXE
C:\Program Files\Charter High-Speed Security Suite\Common\FSMA32.EXE
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\Charter High-Speed Security Suite\Common\FSMB32.EXE
C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\fssm32.exe
C:\Program Files\Charter High-Speed Security Suite\backweb\3528733\Program\fspex.exe
C:\Program Files\Charter High-Speed Security Suite\Common\FCH32.EXE
C:\Program Files\LogMeIn\LogMeIn.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Charter High-Speed Security Suite\Common\FAMEH32.EXE
C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\fsqh.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\fsrw.exe
C:\Program Files\Charter High-Speed Security Suite\FSPC\fspc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Charter High-Speed Security Suite\FSPC\fshttps\fshttps.exe
C:\Program Files\Charter High-Speed Security Suite\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Charter High-Speed Security Suite\Common\FSM32.EXE
C:\Program Files\Charter High-Speed Security Suite\FSGUI\ispnews.exe
C:\Program Files\Webroot\Washer\wwDisp.exe
C:\PROGRA~1\CHARTE~1\ANTI-S~1\fsaw.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Charter High-Speed Security Suite\FSGUI\fsguidll.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Hardware\Mouse\POINT32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 209.200.49.172:12357
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Popup-Blocker Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - C:\WINDOWS\system32\SearchEnhancer\nsa71B.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Charter High-Speed Security Suite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Charter High-Speed Security Suite\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Charter High-Speed Security Suite\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Charter High-Speed Security Suite\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [Window Washer] "C:\Program Files\Webroot\Washer\wwDisp.exe"
O4 - HKCU\..\RunOnce: [Index Washer] C:\Program Files\Webroot\Washer\WashIdx.exe "Matteo Cirami"
O4 - Global Startup: Charter High-Speed Security Suite.lnk = C:\Program Files\Charter High-Speed Security Suite\backweb\3528733\Program\fspex.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &Block this popup - C:\Program Files\Charter High-Speed Security Suite\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Web Filter - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Charter High-Speed Security Suite\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Charter High-Speed Security Suite\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Web Filter - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Charter High-Speed Security Suite\FSPC\fspcmsie.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Charter High-Speed Security Suite\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Charter High-Speed Security Suite\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Charter High-Speed Security Suite (BackWeb Plug-in - 3528733) - BackWeb Technologies Inc. - C:\PROGRA~1\CHARTE~1\backweb\3528733\Program\SERVIC~1.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\Charter High-Speed Security Suite\Anti-Virus\fsgk32st.exe
O23 - Service: FSBWSYS - F-Secure Corp. - C:\Program Files\Charter High-Speed Security Suite\backweb\3528733\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Charter High-Speed Security Suite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\Charter High-Speed Security Suite\FSPC\fshttps\fshttps.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Charter High-Speed Security Suite\Common\FSMA32.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\LogMeIn.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

BC AdBot (Login to Remove)

 


m

#2 mcirami

mcirami
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:05 PM

Posted 20 November 2006 - 12:07 PM

This is my log from Fixwareout...


Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
...

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\WINDOWS\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.

#3 mcirami

mcirami
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:05 PM

Posted 20 November 2006 - 12:16 PM

Here is my log from ComboFix. i'm trying everything. please help me out here


Matteo Cirami - 06-11-20 11:08:00.03 Service Pack 2
ComboFix 06.11.19 - Running from: "C:\Program Files\Mozilla Firefox"

((((((((((((((((((((((((((((((( Files Created from 2006-10-20 to 2006-11-20 ))))))))))))))))))))))))))))))))))


2006-11-20 10:33 <DIR> d-------- C:\fixwareout
2006-11-19 15:24 <DIR> d-------- C:\Program Files\HijackThis
2006-11-19 14:20 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2006-11-19 13:10 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\.housecall6.6
2006-11-18 19:44 <DIR> d-------- C:\Program Files\Lavasoft
2006-11-18 19:44 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Lavasoft
2006-11-18 19:43 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-11-18 19:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-11-18 17:15 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2006-11-18 17:15 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Sony Corporation
2006-11-18 17:12 6,097 --a------ C:\WINDOWS\system32\drivers\sonyhcb.sys
2006-11-18 17:12 53,248 --a------ C:\WINDOWS\system32\SONYHCY.DLL
2006-11-18 17:12 38,739 --a------ C:\WINDOWS\system32\drivers\sonyhcc.sys
2006-11-18 17:12 3,654 --a------ C:\WINDOWS\system32\drivers\Sonyhcp.dll
2006-11-18 17:12 299,923 --a------ C:\WINDOWS\system32\drivers\sonyhcs.sys
2006-11-18 17:12 102,220 --a------ C:\WINDOWS\system32\drivers\sonypvs1.sys
2006-11-18 17:10 <DIR> d-------- C:\Program Files\Sony
2006-11-18 17:08 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\Application Data\F-Secure
2006-11-18 17:04 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\Application Data\ispnews
2006-11-18 17:01 70,896 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2006-11-18 17:01 33,584 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2006-11-18 17:01 1,716,224 --a------ C:\WINDOWS\system32\winsflte.dll
2006-11-18 17:01 1,236,992 --a------ C:\WINDOWS\system32\cfgmig32.dll
2006-11-18 17:01 1,187,840 --a------ C:\WINDOWS\system32\winsflt.dll
2006-11-18 17:01 <DIR> d-------- C:\WINDOWS\rnapxs
2006-11-18 17:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2006-11-18 16:50 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.129-3528733L.exe
2006-11-18 16:50 <DIR> d-------- C:\Program Files\Charter High-Speed Security Suite
2006-11-18 16:14 <DIR> d--hs---- C:\WINDOWS\system32\wsnpoem
2006-11-18 15:32 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys
2006-11-17 16:54 <DIR> d-------- C:\Program Files\AMD Reader
2006-11-17 15:17 684,032 --a------ C:\WINDOWS\system32\libeay32.dll
2006-11-17 15:17 155,648 --a------ C:\WINDOWS\system32\ssleay32.dll
2006-11-17 13:50 63 --a------ C:\WINDOWS\system\SysSD.dll
2006-11-17 13:49 991,232 --a------ C:\WINDOWS\system32\VchReg.dll
2006-11-17 13:06 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2006-11-15 14:23 <DIR> d-------- C:\Program Files\DVDFab Decrypter 3
2006-11-15 10:37 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-11-08 16:55 97,455 --a------ C:\WINDOWS\5-a0c18a429b8010fee34ee31d9073371d.exe
2006-11-08 16:55 622,613 --a------ C:\WINDOWS\4-efb7bab6499fc415ee93f4097033deae.exe
2006-11-08 16:55 365,132 --a------ C:\WINDOWS\7-7c15eb3352bcc3049d7e9e974ad283bf.exe
2006-11-08 16:55 32,579 --a------ C:\WINDOWS\system32\brrot-uninst.exe
2006-11-07 10:16 <DIR> d-------- C:\Program Files\NZSearch
2006-11-07 10:05 <DIR> d-------- C:\WINDOWS\system32\en-US
2006-11-07 10:03 <DIR> d----c--- C:\WINDOWS\ie7
2006-11-07 10:01 <DIR> d-------- C:\WINDOWS\network diagnostic
2006-11-04 14:14 1,245,696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-01 10:33 204,896 --a------ C:\WINDOWS\Renderdll.dll
2006-11-01 10:33 <DIR> d-------- C:\Program Files\MeOnYou Responder
2006-10-25 18:49 13,040 --a------ C:\WINDOWS\system32\LMIport.dll
2006-10-25 18:49 11,504 --a------ C:\WINDOWS\system32\LMIinit.dll
2006-10-25 18:49 <DIR> d-------- C:\Program Files\LogMeIn
2006-10-25 10:45 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-10-25 10:43 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2006-10-24 18:20 <DIR> d-------- C:\Program Files\NetZero
2006-10-22 14:51 <DIR> d-------- C:\Program Files\Kaaza Gold
2006-10-22 14:26 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\Incomplete
2006-10-22 14:20 <DIR> d-------- C:\Program Files\LimeWire
2006-10-22 14:19 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\.limewire
2006-10-20 09:32 <DIR> d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Kazaa Lite


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-20 11:07 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-20 11:05 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Skype
2006-11-20 10:46 -------- d-------- C:\Program Files\Hotmail Reader
2006-11-20 10:42 379 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb9358.dat
2006-11-20 10:42 -------- d-------- C:\Program Files\Dell
2006-11-20 10:10 20480 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb3420.dat
2006-11-20 10:10 151 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb7488.dat
2006-11-20 10:10 13046 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb3638.dat
2006-11-20 10:10 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1621.dat
2006-11-19 13:10 -------- d-------- C:\Program Files\Internet Explorer
2006-11-18 18:13 88 -r-hs---- C:\WINDOWS\system32\C34FAA13C9.sys
2006-11-18 18:13 6686 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2006-11-18 17:31 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6981.dat
2006-11-18 17:31 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb4020.dat
2006-11-18 17:31 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2328.dat
2006-11-18 17:31 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb176.dat
2006-11-18 17:12 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-18 17:00 -------- d-------- C:\Program Files\Webroot
2006-11-18 17:00 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Webroot
2006-11-18 15:00 379 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1478.dat
2006-11-18 15:00 20480 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6566.dat
2006-11-18 15:00 151 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5950.dat
2006-11-18 15:00 13046 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2412.dat
2006-11-18 15:00 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb950.dat
2006-11-18 14:59 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb9954.dat
2006-11-18 14:59 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb8649.dat
2006-11-18 14:59 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2080.dat
2006-11-18 14:59 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1777.dat
2006-11-18 14:05 379 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5724.dat
2006-11-18 14:05 20480 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5842.dat
2006-11-18 14:05 151 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb8097.dat
2006-11-18 14:05 13046 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5781.dat
2006-11-18 14:05 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb8361.dat
2006-11-18 14:05 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb7430.dat
2006-11-18 14:05 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6989.dat
2006-11-18 14:05 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb3444.dat
2006-11-18 14:05 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2281.dat
2006-11-18 13:34 379 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb9169.dat
2006-11-18 13:34 20480 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1398.dat
2006-11-18 13:34 151 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6183.dat
2006-11-18 13:34 13046 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6781.dat
2006-11-18 13:34 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb3979.dat
2006-11-18 09:50 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb890.dat
2006-11-18 09:50 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb4900.dat
2006-11-18 09:50 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2478.dat
2006-11-18 09:50 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb24.dat
2006-11-17 17:52 69632 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb7624.dat
2006-11-17 17:52 379 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6500.dat
2006-11-17 17:52 151 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5836.dat
2006-11-17 17:52 13046 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2298.dat
2006-11-17 17:52 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb9331.dat
2006-11-17 17:52 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6627.dat
2006-11-17 17:52 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb398.dat
2006-11-17 17:52 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb3606.dat
2006-11-17 17:52 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1327.dat
2006-11-17 16:17 382 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1942.dat
2006-11-17 16:16 69632 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb4827.dat
2006-11-17 16:16 151 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb9912.dat
2006-11-17 16:16 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb7812.dat
2006-11-17 14:06 -------- d-------- C:\Program Files\AFF Mail Reader OCR
2006-11-17 12:57 -------- d-------- C:\Program Files\MySpace Responder
2006-11-16 10:16 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb2391.dat
2006-11-12 16:57 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5105.dat
2006-11-12 16:57 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb1869.dat
2006-11-09 16:56 -------- d-------- C:\Program Files\Windows Media Player
2006-11-08 17:06 49 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb41.dat
2006-11-08 17:05 -------- d-------- C:\Program Files\GemMaster
2006-11-08 17:03 -------- d-------- C:\Program Files\MUSICMATCH
2006-11-08 17:00 9216 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb8467.dat
2006-11-08 17:00 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb6334.dat
2006-11-08 16:55 23 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\inifile41.ini
2006-11-08 16:55 0 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\internaldb5436.dat
2006-11-06 14:34 -------- d-------- C:\Program Files\Common Files\Webroot Shared
2006-11-06 14:19 194376 --a------ C:\Documents and Settings\Matteo Cirami\Application Data\shb.dat
2006-11-01 16:51 152 -r-hs---- C:\WINDOWS\system32\C913AA4FC3.sys
2006-10-31 14:12 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Macromedia
2006-10-30 16:41 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Ahead
2006-10-23 21:22 -------- d-------- C:\Program Files\Mate1 Reader
2006-10-22 14:23 -------- d-------- C:\Program Files\Java
2006-10-18 22:58 8704 --a------ C:\WINDOWS\system32\wdfmgr.exe
2006-10-18 22:58 8704 --a------ C:\WINDOWS\system32\uwdf.exe
2006-10-18 22:47 99840 --a------ C:\WINDOWS\system32\wmpshell.dll
2006-10-18 22:47 991744 --a------ C:\WINDOWS\system32\drmv2clt.dll
2006-10-18 22:47 937984 --a------ C:\WINDOWS\system32\WMNetMgr.dll
2006-10-18 22:47 8231936 --a------ C:\WINDOWS\system32\wmploc.dll
2006-10-18 22:47 767488 --------- C:\WINDOWS\system32\WMVSENCD.dll
2006-10-18 22:47 757248 --a------ C:\WINDOWS\system32\WMADMOD.dll
2006-10-18 22:47 7168 --a------ C:\WINDOWS\system32\asferror.dll
2006-10-18 22:47 656896 --------- C:\WINDOWS\system32\WMVXENCD.dll
2006-10-18 22:47 63488 --a------ C:\WINDOWS\system32\wpdmtpus.dll
2006-10-18 22:47 629760 --a------ C:\WINDOWS\system32\wpd_ci.dll
2006-10-18 22:47 613376 --------- C:\WINDOWS\system32\wmpmde.dll
2006-10-18 22:47 603648 --a------ C:\WINDOWS\system32\WMSPDMOD.dll
2006-10-18 22:47 542720 --a------ C:\WINDOWS\system32\blackbox.dll
2006-10-18 22:47 535040 --a------ C:\WINDOWS\system32\wmdrmsdk.dll
2006-10-18 22:47 429056 --a------ C:\WINDOWS\system32\wmdrmdev.dll
2006-10-18 22:47 414208 --a------ C:\WINDOWS\system32\msscp.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\wmvdmod.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\WMVADVE.DLL
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\WMVADVD.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\wmsdmod.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\wdfapi.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\MPG4DMOD.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\MP4SDMOD.dll
2006-10-18 22:47 4096 --a------ C:\WINDOWS\system32\MP43DMOD.dll
2006-10-18 22:47 38400 --------- C:\WINDOWS\system32\wpdshextres.dll
2006-10-18 22:47 37376 --a------ C:\WINDOWS\system32\wmdmps.dll
2006-10-18 22:47 35840 --a------ C:\WINDOWS\system32\wpdconns.dll
2006-10-18 22:47 356352 --a------ C:\WINDOWS\system32\wpdsp.dll
2006-10-18 22:47 348672 --a------ C:\WINDOWS\system32\wmdrmnet.dll
2006-10-18 22:47 33792 --a------ C:\WINDOWS\system32\wmdmlog.dll
2006-10-18 22:47 321536 --a------ C:\WINDOWS\system32\mswmdm.dll
2006-10-18 22:47 317440 --------- C:\WINDOWS\system32\MP4SDECD.dll
2006-10-18 22:47 314880 --a------ C:\WINDOWS\system32\wmpdxm.dll
2006-10-18 22:47 295936 --------- C:\WINDOWS\system32\wmpeffects.dll
2006-10-18 22:47 284160 --a------ C:\WINDOWS\system32\portabledeviceapi.dll
2006-10-18 22:47 276992 --a------ C:\WINDOWS\system32\audiodev.dll
2006-10-18 22:47 27136 --a------ C:\WINDOWS\system32\mspmsnsv.dll
2006-10-18 22:47 2603008 --------- C:\WINDOWS\system32\WpdShext.dll
2006-10-18 22:47 259072 --------- C:\WINDOWS\system32\MPG4DECD.dll
2006-10-18 22:47 259072 --------- C:\WINDOWS\system32\MP43DECD.dll
2006-10-18 22:47 2450944 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-10-18 22:47 242688 --a------ C:\WINDOWS\system32\wmpasf.dll
2006-10-18 22:47 229376 --a------ C:\WINDOWS\system32\cewmdm.dll
2006-10-18 22:47 227328 --a------ C:\WINDOWS\system32\wmerror.dll
2006-10-18 22:47 222208 --a------ C:\WINDOWS\system32\WMASF.dll
2006-10-18 22:47 212992 --a------ C:\WINDOWS\system32\MFPLAT.dll
2006-10-18 22:47 211456 --a------ C:\WINDOWS\system32\qasf.dll
2006-10-18 22:47 204288 --a------ C:\WINDOWS\system32\wmpsrcwp.dll
2006-10-18 22:47 199168 --------- C:\WINDOWS\system32\PortableDeviceWMDRM.dll
2006-10-18 22:47 179712 --a------ C:\WINDOWS\system32\msnetobj.dll
2006-10-18 22:47 175616 --a------ C:\WINDOWS\system32\mspmsp.dll
2006-10-18 22:47 166912 --a------ C:\WINDOWS\system32\portabledevicetypes.dll
2006-10-18 22:47 1661440 --a------ C:\WINDOWS\system32\wmpencen.dll
2006-10-18 22:47 1574912 --------- C:\WINDOWS\system32\WMVENCOD.dll
2006-10-18 22:47 157184 --a------ C:\WINDOWS\system32\wmidx.dll
2006-10-18 22:47 154624 --a------ C:\WINDOWS\system32\wpdmtp.dll
2006-10-18 22:47 1543680 --------- C:\WINDOWS\system32\WMVDECOD.dll
2006-10-18 22:47 1382912 --------- C:\WINDOWS\system32\WMVSDECD.dll
2006-10-18 22:47 133632 --a------ C:\WINDOWS\system32\wpdshserviceobj.dll
2006-10-18 22:47 1329152 --a------ C:\WINDOWS\system32\WMSPDMOE.dll
2006-10-18 22:47 132096 --------- C:\WINDOWS\system32\PortableDeviceWiaCompat.dll
2006-10-18 22:47 130048 --------- C:\WINDOWS\system32\wmpps.dll
2006-10-18 22:47 11264 --a------ C:\WINDOWS\system32\LAPRXY.dll
2006-10-18 22:47 1117696 --a------ C:\WINDOWS\system32\WMADMOE.dll
2006-10-18 22:47 101888 --------- C:\WINDOWS\system32\PortableDeviceClassExtension.dll
2006-10-18 21:03 100864 --a------ C:\WINDOWS\system32\logagent.exe
2006-10-18 21:00 38528 --a------ C:\WINDOWS\system32\drivers\wpdusb.sys
2006-10-18 21:00 249856 --a------ C:\WINDOWS\system32\drmupgds.exe
2006-10-18 21:00 17408 --------- C:\WINDOWS\system32\wpdshextautoplay.exe
2006-10-14 09:27 -------- d-------- C:\Program Files\Google
2006-10-13 06:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 06:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 06:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 04:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-10-11 10:10 -------- d-------- C:\Program Files\Hi5 Responder
2006-10-11 09:16 -------- d-------- C:\Program Files\AdultDateLink Responder
2006-10-09 16:12 456192 --a------ C:\WINDOWS\system32\encdec.dll
2006-10-09 16:12 235008 --a------ C:\WINDOWS\system32\psisdecd.dll
2006-10-06 19:56 9584 --a------ C:\WINDOWS\system32\LMImirr2.dll
2006-10-06 19:56 8048 --a------ C:\WINDOWS\system32\drivers\LMImirr.sys
2006-10-06 19:56 23024 --a------ C:\WINDOWS\system32\LMImirr.dll
2006-10-03 18:32 -------- d-------- C:\Program Files\Common Files\Real
2006-10-03 18:32 -------- d-------- C:\Program Files\Common Files
2006-10-03 18:32 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Real
2006-10-02 15:28 312128 --------- C:\WINDOWS\system32\msdelta.dll
2006-09-28 20:13 95344 --------- C:\WINDOWS\system32\WUDFCoinstaller.dll
2006-09-28 19:00 82944 --------- C:\WINDOWS\system32\drivers\WudfRd.sys
2006-09-28 18:56 55808 --------- C:\WINDOWS\system32\WudfSvc.dll
2006-09-28 18:56 316416 --------- C:\WINDOWS\system32\WUDFx.dll
2006-09-28 18:56 165376 --------- C:\WINDOWS\system32\WudfPlatform.dll
2006-09-28 18:56 146432 --------- C:\WINDOWS\system32\WudfHost.exe
2006-09-28 18:55 77568 --------- C:\WINDOWS\system32\drivers\WudfPf.sys
2006-09-25 17:58 23856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2006-09-22 21:24 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Talkback
2006-09-22 21:24 -------- d-------- C:\Documents and Settings\Matteo Cirami\Application Data\Mozilla
2006-09-12 23:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-08-25 09:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 06:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 03:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Window Washer"="\"C:\\Program Files\\Webroot\\Washer\\wwDisp.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"IntelWireless"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless"
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"DLA"="C:\\WINDOWS\\System32\\DLA\\DLACTRLW.EXE"
"LogMeIn GUI"="\"C:\\Program Files\\LogMeIn\\LogMeInSystray.exe\""
"F-Secure Manager"="\"C:\\Program Files\\Charter High-Speed Security Suite\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\\Program Files\\Charter High-Speed Security Suite\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"F-Secure Startup Wizard"="\"C:\\Program Files\\Charter High-Speed Security Suite\\FSGUI\\FSSW.EXE\" /reboot"
"News Service"="\"C:\\Program Files\\Charter High-Speed Security Suite\\FSGUI\\ispnews.exe\""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\America Online 9.0 Tray Icon.lnk"
"backup"="C:\\WINDOWS\\pss\\America Online 9.0 Tray Icon.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\AMERIC~1.0\\aoltray.exe -check"
"item"="America Online 9.0 Tray Icon"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Bluetooth Manager.lnk"
"backup"="C:\\WINDOWS\\pss\\Bluetooth Manager.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Toshiba\\BLUETO~1\\TOSBTM~1.EXE "
"item"="Bluetooth Manager"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="\"iexplore"
"hkey"="HKLM"
"command"="\"iexplore.exe\" \"http://iesettingsupdate\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MediaDetect"
"hkey"="HKLM"
"command"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="quickset"
"hkey"="HKLM"
"command"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DMXLauncher"
"hkey"="HKLM"
"command"="C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleDesktop"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mimboot"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~3\\mimboot.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="netWaiting"
"hkey"="HKCU"
"command"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetZero_uoltray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="exec"
"hkey"="HKCU"
"command"="C:\\Program Files\\NetZero\\exec.exe regrun"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="pccguide"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Trend Micro\\Internet Security 12\\pccguide.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RealPlay"
"hkey"="HKLM"
"command"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKLM"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Skype"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="GoogleToolbarNotifier"
"hkey"="HKCU"
"command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SynTPEnh"
"hkey"="HKLM"
"command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Scheduled scanning task.job

Completion time: 06-11-20 11:09:15.78
C:\ComboFix.txt ... 06-11-20 11:09

#4 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:05 PM

Posted 27 November 2006 - 04:00 PM

Hello and welcome to BC. :thumbsup:

Sorry for the delayed response. If you are not receiving help elsewhere and still need help, please post a fresh HijackThis log and I'll be happy to help you.

#5 amateur

amateur

    Malware Fighter


  • Malware Response Team
  • 2,775 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:05 PM

Posted 03 December 2006 - 04:52 PM

Due to lack of response, this thread will now be closed. If you need this topic reopened, please PM me with the address of the thread.and we will reopen it for you. This applies only to the original topic starter. Everyone else please begin a New Topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users