AntiVirus XP 2008 - Please HELP! [CLOSED], Installed when downloading a "Video activex object" codec |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
  |
 Aug 11 2008, 09:47 AM
Post
#1
|
|
|
Member  Posts: 11 OS: Windows XP Professional SP2  |
Thanx in advance for helping me! Ok so here is what happened. I was trying to watch a video of the Olympics opening ceremony and I accepted a download request for a "Video activex object" codec. It turned out to be a nasty virus or trojan and my computer began to: 1. installed Antivirus XP 2008, which I tried to uninstall but would it kept aborting 2. repeatedly auto-scanning my computer and popups would appear that tried to get me to pay for one of their full featured anti-virus programs 3. my desktop wallpaper changed into a bright blue display that said my computer was infected Then I installed Kaspersky and restarted my computer and many programs or applications would not work (AIM, My Computer, etc). I updated Kaspersky, ran it and restarted again, and now everything appears to be running somewhat-okay for the time being. I also read many instructions and ran a number of scans and fixes, including: ComboFix Malwarebytes Anti-Malware Super AntiSpyware Free Edition FiexIEDef SmitfraudFix My computer seems to be working decentlyl now (I do not see AntiVirus XP 2008 in my Programs List anymore), however viewing on Kaspersky, I am still getting repeated phishing attacks on my computer. I just want to make sure that this stuff is completely off my computer. Thank you so much for taking the time to read my problem!! I am posting the my HJT file: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:46:29 AM, on 8/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\ULi5287\ULi5287.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe c:\program files\power shutdown\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\NETGEAR\NETGEAR Storage Central Manager Utility\Z-SANService.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Mozilla Firefox 3 Beta 5\firefox.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: TBSB00321 - {0E9B2F53-3E3E-4E66-8BFA-1C822F395ACA} - C:\Program Files\DigiClick\DigiClick! Toolbar\digiclick4.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: DigiClick! Toolbar - {FFC77067-4045-419B-9AEF-DE9BE2E2AFF7} - C:\Program Files\DigiClick\DigiClick! Toolbar\digiclick4.dll O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: MultiMon Taskbar.lnk = C:\Program Files\MMTaskbar\MultiMon.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1194547183640 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Power Shutdown - Snowportion - c:\program files\power shutdown\svchost.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Z-SAN Service (Z-SANService) - Zetera Corporation - C:\Program Files\NETGEAR\NETGEAR Storage Central Manager Utility\Z-SANService.exe -- End of file - 9586 bytes |
 |
 
|
|
Aug 22 2008, 12:44 PM
Post
#2
|
|
|
Member Posts: 11 OS: Windows XP Professional SP2 |
Hello,
I'm still waiting for some assistance. I've done a number of scans since the last time I posted, and I am still having problems on my computer. Here is my HJT log that I took today: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:44:10 AM, on 8/22/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\ULi5287\ULi5287.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\NETGEAR\NETGEAR Storage Central Manager Utility\Z-SANService.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\AIM\aim.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: TBSB00321 - {0E9B2F53-3E3E-4E66-8BFA-1C822F395ACA} - C:\Program Files\DigiClick\DigiClick! Toolbar\digiclick4.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: DigiClick! Toolbar - {FFC77067-4045-419B-9AEF-DE9BE2E2AFF7} - C:\Program Files\DigiClick\DigiClick! Toolbar\digiclick4.dll O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: MultiMon Taskbar.lnk = C:\Program Files\MMTaskbar\MultiMon.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co...ex/qtplugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1194547183640 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Z-SAN Service (Z-SANService) - Zetera Corporation - C:\Program Files\NETGEAR\NETGEAR Storage Central Manager Utility\Z-SANService.exe -- End of file - 9392 bytes |
|
|
|
|
Aug 27 2008, 02:28 AM
Post
#3
|
|
 Trusted Helper  Posts: 3,293 OS: XP Pro |
Hello Yooniexchic,
Welcome to Geekstogo. I am having a look at your log and will get back to you in a bit. regards emeraldnzl |
|
|
|
|
Aug 27 2008, 01:08 PM
Post
#4
|
|
|
Trusted Helper Posts: 3,293 OS: XP Pro |
Hello again Yooniexchic,
Please go to Start > Control Panel > Add or Remove Programs and uninstall the following programs: DigiClick Viewpoint Next Download OTViewIt to your desktop.
|
|
|
|
|
Aug 27 2008, 01:23 PM
Post
#5
|
|
|
Member Posts: 11 OS: Windows XP Professional SP2 |
Here is the OTVietIt Log: OTViewIt logfile created on: 8/27/2008 3:22:08 PM - Run 1 OTViewIt by OldTimer - Version 1.0.0.14 Folder = C:\Documents and Settings\Enoch\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.94 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 72.33% Memory free 3.78 Gb Paging File | 3.42 Gb Available in Paging File | 90.51% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 298.08 Gb Total Space | 166.89 Gb Free Space | 55.99% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ASUS-64 Current User Name: Enoch Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user ===== Processes - Non-Microsoft Only ===== [06/28/2005 10:55 PM | 00,376,832 | ---- | M] (ATI Technologies Inc.) - C:\WINDOWS\system32\ati2evxx.exe [03/19/2008 05:08 PM | 00,607,576 | ---- | M] (Lavasoft) - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe [06/28/2005 10:55 PM | 00,376,832 | ---- | M] (ATI Technologies Inc.) - C:\WINDOWS\system32\ati2evxx.exe [06/28/2005 10:05 PM | 00,344,064 | ---- | M] (ATI Technologies, Inc.) - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [08/23/2005 09:59 PM | 00,409,600 | ---- | M] () - C:\Program Files\ULi5287\ULi5287.exe [07/22/2005 03:00 AM | 00,081,920 | R--- | M] (Realtek Semiconductor Corp.) - C:\WINDOWS\SOUNDMAN.EXE [06/10/2008 04:27 AM | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [07/09/2008 01:30 PM | 00,289,064 | ---- | M] (Apple Inc.) - C:\Program Files\iTunes\iTunesHelper.exe [07/03/2008 02:22 AM | 00,116,040 | ---- | M] (Apple Inc.) - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [07/24/2007 03:17 PM | 00,229,376 | ---- | M] (Apple Inc.) - C:\Program Files\Bonjour\mDNSResponder.exe [09/20/2007 10:51 AM | 00,853,288 | ---- | M] (Nero AG) - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [08/05/2005 03:08 PM | 00,067,160 | ---- | M] (America Online, Inc.) - C:\Program Files\AIM\aim.exe [08/08/2007 08:54 PM | 00,376,891 | ---- | M] (Zetera Corporation) - C:\Program Files\NETGEAR\NETGEAR Storage Central Manager Utility\Z-SANService.exe [07/09/2008 01:30 PM | 00,532,264 | ---- | M] (Apple Inc.) - C:\Program Files\iPod\bin\iPodService.exe [07/03/2008 10:25 PM | 08,767,575 | ---- | M] (Evenflow, Inc.) - C:\Program Files\Dropbox\dropbox.exe [08/27/2008 03:13 PM | 01,299,968 | ---- | M] (OldTimer Tools) - C:\Documents and Settings\Enoch\Desktop\OTViewIt.exe ===== Win32 Services - Non-Microsoft Only ===== (aawservice) Ad-Aware 2007 Service [Auto | Running] [03/19/2008 05:08 PM | 00,607,576 | ---- | M] (Lavasoft) - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe (Adobe LM Service) Adobe LM Service [On_Demand | Stopped] [11/08/2007 03:00 PM | 00,072,704 | ---- | M] (Adobe Systems) - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Version Cue CS2) Adobe Version Cue CS2 [Disabled | Stopped] [04/04/2005 07:58 PM | 00,163,840 | ---- | M] (Adobe Systems Incorporated) - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe (Adobe Version Cue CS3) Adobe Version Cue CS3 [On_Demand | Stopped] [03/20/2007 05:41 PM | 00,153,792 | ---- | M] (Adobe Systems Incorporated) - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (Apple Mobile Device) Apple Mobile Device [Auto | Running] [07/03/2008 02:22 AM | 00,116,040 | ---- | M] (Apple Inc.) - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Ati HotKey Poller) Ati HotKey Poller [Auto | Running] [06/28/2005 10:55 PM | 00,376,832 | ---- | M] (ATI Technologies Inc.) - C:\WINDOWS\system32\ati2evxx.exe (AVP) Kaspersky Anti-Virus [Auto | Stopped] [07/29/2008 08:20 PM | 00,206,088 | ---- | M] (Kaspersky Lab) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Bonjour Service) Bonjour Service [Auto | Running] [07/24/2007 03:17 PM | 00,229,376 | ---- | M] (Apple Inc.) - C:\Program Files\Bonjour\mDNSResponder.exe (dmadmin) Logical Disk Manager Administrative Service [On_Demand | Stopped] [04/13/2008 08:12 PM | 00,224,768 | ---- | M] (Microsoft Corp., Veritas Software) - C:\WINDOWS\system32\dmadmin.exe (FLEXnet Licensing Service) FLEXnet Licensing Service [On_Demand | Stopped] [12/10/2007 05:02 PM | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (iPod Service) iPod Service [On_Demand | Running] [07/09/2008 01:30 PM | 00,532,264 | ---- | M] (Apple Inc.) - C:\Program Files\iPod\bin\iPodService.exe (Macromedia Licensing Service) Macromedia Licensing Service [On_Demand | Stopped] [05/13/2008 12:57 AM | 00,068,096 | ---- | M] () - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe (Nero BackItUp Scheduler 3) Nero BackItUp Scheduler 3 [Auto | Running] [09/20/2007 10:51 AM | 00,853,288 | ---- | M] (Nero AG) - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (NMIndexingService) NMIndexingService [On_Demand | Stopped] [09/20/2007 04:35 PM | 00,382,248 | ---- | M] (Nero AG) - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Z-SANService) Z-SAN Service [Auto | Running] [08/08/2007 08:54 PM | 00,376,891 | ---- | M] (Zetera Corporation) - C:\Program Files\NETGEAR\NETGEAR Storage Central Manager Utility\Z-SANService.exe ===== Driver Services - Non-Microsoft Only ===== (ALCXWDM) Service for Realtek AC97 Audio (WDM) [On_Demand | Running] [07/26/2005 05:03 AM | 03,644,032 | R--- | M] (Realtek Semiconductor Corp.) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS (AliIde) AliIde [Boot | Running] [02/28/2006 08:00 AM | 00,005,248 | ---- | M] (Acer Laboratories Inc.) - C:\WINDOWS\system32\drivers\aliide.sys (ati2mtag) ati2mtag [On_Demand | Running] [06/28/2005 11:01 PM | 01,241,088 | ---- | M] (ATI Technologies Inc.) - C:\WINDOWS\system32\drivers\ati2mtag.sys (catchme) catchme [On_Demand | Stopped] File not found - C:\ComboFix\catchme.sys (dmboot) dmboot [Disabled | Stopped] [04/13/2008 02:44 PM | 00,799,744 | ---- | M] (Microsoft Corp., Veritas Software) - C:\WINDOWS\system32\drivers\dmboot.sys (dmio) Logical Disk Manager Driver [Boot | Running] [04/13/2008 02:44 PM | 00,153,344 | ---- | M] (Microsoft Corp., Veritas Software) - C:\WINDOWS\system32\drivers\dmio.sys (dmload) dmload [Boot | Running] [02/28/2006 08:00 AM | 00,005,888 | ---- | M] (Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\drivers\dmload.sys (ElbyDelay) ElbyDelay [Unknown | Running] File not found - (GEARAspiWDM) GEARAspiWDM [On_Demand | Running] [01/29/2008 12:01 PM | 00,016,168 | ---- | M] (GEAR Software Inc.) - C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (kl1) kl1 [Boot | Running] [07/21/2008 06:34 PM | 00,121,872 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\kl1.sys (klbg) Kaspersky Lab Boot Guard Driver [Boot | Running] [01/29/2008 06:29 PM | 00,032,784 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klbg.sys (KLIF) Kaspersky Lab Driver [System | Running] [08/08/2008 06:17 PM | 00,213,008 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klif.sys (klim5) Kaspersky Anti-Virus NDIS Filter [On_Demand | Running] [04/30/2008 06:06 PM | 00,024,592 | ---- | M] (Kaspersky Lab) - C:\WINDOWS\system32\drivers\klim5.sys (m5287) m5287 [Boot | Running] [08/19/2005 11:18 AM | 00,101,120 | ---- | M] (ULi Electronics Inc.) - C:\WINDOWS\system32\drivers\m5287.sys (MTsensor) ATK0110 ACPI UTILITY [On_Demand | Running] [08/12/2004 10:56 PM | 00,005,810 | R--- | M] () - C:\WINDOWS\system32\drivers\ASACPI.sys (pfc) Padus ASPI Shell [On_Demand | Running] [11/08/2007 01:14 PM | 00,009,856 | ---- | M] (Padus, Inc.) - C:\WINDOWS\system32\drivers\pfc.sys (Ptilink) Direct Parallel Link Driver [On_Demand | Running] [02/28/2006 08:00 AM | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) - C:\WINDOWS\system32\drivers\ptilink.sys (PxHelp20) PxHelp20 [Boot | Running] [12/04/2007 02:38 PM | 00,043,528 | ---- | M] (Sonic Solutions) - C:\WINDOWS\system32\drivers\PxHelp20.sys (SASDIFSV) SASDIFSV [System | Running] [05/28/2008 10:33 AM | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SASENUM) SASENUM [On_Demand | Stopped] [05/28/2008 10:33 AM | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\SASENUM.SYS (SASKUTIL) SASKUTIL [System | Running] [05/28/2008 10:33 AM | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (Secdrv) Secdrv [On_Demand | Stopped] [11/13/2007 06:25 AM | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) - C:\WINDOWS\system32\drivers\secdrv.sys (SFSZ) DataPlow SFS for Zetera Storage Devices [Auto | Running] [08/14/2007 10:29 PM | 00,345,984 | ---- | M] (DataPlow, Incorporated) - C:\WINDOWS\system32\drivers\sfsz.sys (VClone) VClone [System | Stopped] File not found - C:\WINDOWS\System32\DRIVERS\VClone.sys (yukonwxp) NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller [On_Demand | Running] [09/19/2005 09:41 AM | 00,241,280 | ---- | M] (Marvell) - C:\WINDOWS\system32\drivers\yk51x86.sys (ZetBus) Zetera Virtual Bus [On_Demand | Running] [08/08/2007 08:57 PM | 00,015,488 | ---- | M] (Zetera Corporation) - C:\WINDOWS\system32\drivers\ZetBus.sys (ZetMPD) ZetMPD [On_Demand | Stopped] [08/08/2007 08:57 PM | 00,005,120 | ---- | M] (Zetera Corporation) - C:\WINDOWS\system32\drivers\ZetMPD.sys (ZetSFD) ZetSFD [Boot | Running] [08/08/2007 08:57 PM | 00,012,800 | ---- | M] (Zetera Corporation) - C:\WINDOWS\system32\drivers\ZetSFD.sys ===== Run Keys ===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher" = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [06/12/2008 02:38 AM | 00,034,672 | ---- | M] (Adobe Systems Incorporated) "AppleSyncNotifier" = C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [07/03/2008 02:23 AM | 00,116,040 | ---- | M] (Apple Inc.) "ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [06/28/2005 10:05 PM | 00,344,064 | ---- | M] (ATI Technologies, Inc.) "AVP" = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [07/29/2008 08:20 PM | 00,206,088 | ---- | M] (Kaspersky Lab) "iTunesHelper" = "C:\Program Files\iTunes\iTunesHelper.exe" [07/09/2008 01:30 PM | 00,289,064 | ---- | M] (Apple Inc.) "NBKeyScan" = "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [09/20/2007 10:51 AM | 01,836,328 | ---- | M] (Nero AG) "QuickTime Task" = "C:\Program Files\QuickTime\qttask.exe" -atboottime [05/27/2008 10:50 AM | 00,413,696 | ---- | M] (Apple Inc.) "SoundMan" = SOUNDMAN.EXE [07/22/2005 03:00 AM | 00,081,920 | R--- | M] (Realtek Semiconductor Corp.) "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM | 00,144,784 | ---- | M] (Sun Microsystems, Inc.) "ULiRaid" = C:\Program Files\ULi5287\ULi5287.exe [08/23/2005 09:59 PM | 00,409,600 | ---- | M] () [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "load" = Reg Error: Value load does not exist or could not be read. "run" = Reg Error: Value run does not exist or could not be read. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "load" = Reg Error: Value load does not exist or could not be read. "run" = Reg Error: Value run does not exist or could not be read. ===== Startup Folders ===== [All Users Startup Folder - C:\Documents and Settings\All Users\Start Menu\Programs\Startup] [11/09/2005 04:34 PM | 00,294,912 | ---- | M] () - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MultiMon Taskbar.lnk = C:\Program Files\MMTaskbar\MultiMon.exe [Enoch Startup Folder - C:\Documents and Settings\Enoch\Start Menu\Programs\Startup] [07/03/2008 10:25 PM | 08,767,575 | ---- | M] (Evenflow, Inc.) - C:\Documents and Settings\Enoch\Start Menu\Programs\Startup\Dropbox.lnk = C:\Program Files\Dropbox\dropbox.exe ===== BHO's ===== [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] HKLM CLSID: (Adobe PDF Reader Link Helper) - [06/11/2008 10:33 PM | 00,061,816 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] HKLM CLSID: (Adobe PDF Link Helper) - [06/11/2008 10:33 PM | 00,075,128 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] HKLM CLSID: (IEVkbdBHO Class) - [07/29/2008 08:21 PM | 00,062,728 | ---- | M] (Kaspersky Lab) C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] HKLM CLSID: (SSVHelper Class) - [06/10/2008 04:27 AM | 00,509,328 | ---- | M] (Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] HKLM CLSID: (Adobe PDF Conversion Toolbar Helper) - [10/23/2006 12:20 AM | 00,321,120 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll ===== Toolbars ===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" HKLM CLSID: (Adobe PDF) - [10/23/2006 12:20 AM | 00,321,120 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" HKLM CLSID: (Adobe PDF) - [10/23/2006 12:20 AM | 00,321,120 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll "{724D43A0-0D85-11D4-9908-00400523E39A}" HKLM CLSID: (Reg Error: Key does not exist or could not be opened.) - File not found Reg Error: Key does not exist or could not be opened. "{FFC77067-4045-419B-9AEF-DE9BE2E2AFF7}" HKLM CLSID: (Reg Error: Key does not exist or could not be opened.) - File not found Reg Error: Key does not exist or could not be opened. ===== Policies ===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun" = 255 "NoDriveAutoRun" = 67108863 "NoDrives" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System] "dontdisplaylastusername" = 0 "legalnoticecaption" = "legalnoticetext" = "shutdownwithoutlogon" = 1 "undockwithoutlogon" = 1 "HideLegacyLogonScripts" = 0 "HideLogoffScripts" = 0 "RunLogonScriptSync" = 1 "RunStartupScriptSync" = 0 "HideStartupScripts" = 0 "DisableRegistryTools" = 0 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] "NoDriveTypeAutoRun" = 145 "NoDrives" = 0 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System] "HideLegacyLogonScripts" = 0 "HideLogoffScripts" = 0 "RunLogonScriptSync" = 1 "RunStartupScriptSync" = 0 "HideStartupScripts" = 0 ===== Desktop Components ===== ===== Shared Task Scheduler ===== ===== AppInit_Dlls ===== ===== Lsa Authentication Packages ===== ===== Lsa Security Packages ===== ===== Authorized Applications List ===== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe [04/13/2008 08:12 PM | 00,141,312 | ---- | M] (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = C:\WINDOWS\network diagnostic\xpnetdiag.exe [04/13/2008 02:53 PM | 00,558,080 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe [10/18/2007 12:34 PM | 05,724,184 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe [10/02/2007 06:18 PM | 00,304,488 | ---- | M] (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe [04/13/2008 08:12 PM | 00,141,312 | ---- | M] (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = C:\WINDOWS\network diagnostic\xpnetdiag.exe [04/13/2008 02:53 PM | 00,558,080 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe [10/18/2007 12:34 PM | 05,724,184 | ---- | M] (Microsoft Corporation) "C:\Program Files\Windows Live\Messenger\livecall.exe" = C:\Program Files\Windows Live\Messenger\livecall.exe [10/02/2007 06:18 PM | 00,304,488 | ---- | M] (Microsoft Corporation) "C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe [11/03/2006 03:17 AM | 00,010,800 | ---- | M] (AOL LLC) "C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" = C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [04/04/2005 07:58 PM | 00,163,840 | ---- | M] (Adobe Systems Incorporated) "C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" = C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe [03/20/2007 05:41 PM | 00,153,792 | ---- | M] (Adobe Systems Incorporated) "C:\Program Files\EmFTP\EmFTP.exe" = C:\Program Files\EmFTP\EmFTP.exe [03/28/2007 12:23 PM | 00,492,440 | ---- | M] () "C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe [09/29/2007 04:22 PM | 00,050,528 | ---- | M] (AOL LLC) "C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe" = C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe [04/13/2008 08:12 PM | 00,769,024 | ---- | M] (Microsoft Corporation) "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe [08/05/2005 03:08 PM | 00,067,160 | ---- | M] (America Online, Inc.) "C:\Program Files\Azureus\Azureus.exe" = C:\Program Files\Azureus\Azureus.exe [12/03/2007 08:28 PM | 00,254,976 | ---- | M] (Azureus Inc) "C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe [07/24/2007 03:17 PM | 00,229,376 | ---- | M] (Apple Inc.) "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe [07/09/2008 01:30 PM | 20,246,824 | ---- | M] (Apple Inc.) ===== HKLM Winlogon Settings ===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell] "Explorer.exe" - [04/13/2008 08:12 PM | 01,033,728 | ---- | M] (Microsoft Corporation) C:\WINDOWS\explorer.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit] "C:\WINDOWS\system32\userinit.exe" - [04/13/2008 08:12 PM | 00,026,112 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\userinit.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost] "logonui.exe" - [04/13/2008 08:12 PM | 00,514,560 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\logonui.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet] "rundll32 shell32" - [04/13/2008 08:12 PM | 08,461,312 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll "Control_RunDLL "sysdm.cpl"" - [04/13/2008 08:12 PM | 00,300,544 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\sysdm.cpl ===== User's Winlogon Settings ===== ===== Winlogon Notify Settings ===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] "DllName" = C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [04/19/2007 01:41 PM | 00,294,912 | ---- | M] (SUPERAntiSpyware.com) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DllName" = C:\WINDOWS\system32\ati2evxx.dll [06/28/2005 10:56 PM | 00,046,080 | ---- | M] (ATI Technologies Inc.) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] "DllName" = C:\WINDOWS\system32\klogon.dll [07/29/2008 08:21 PM | 00,218,376 | ---- | M] (Kaspersky Lab) ===== Safeboot Options ===== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] "AlternateShell" = cmd.exe ===== Disabled MsConfig Items ===== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services] "CiSvc" = 3 "Adobe Version Cue CS2" = 3 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk] "backup" = C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnk File not found "location" = Common Startup "command" = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000003}\_SC_Acrobat.exe [12/10/2007 05:13 PM | 00,295,606 | R--- | M] () "item" = Adobe Acrobat Speed Launcher [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk] "backup" = C:\WINDOWS\pss\Adobe Acrobat Synchronizer.lnk File not found "location" = Common Startup "command" = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [10/23/2006 01:01 AM | 00,734,872 | ---- | M] () "item" = Adobe Acrobat Synchronizer [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk] "backup" = C:\WINDOWS\pss\Adobe Gamma.lnk File not found "location" = Common Startup "command" = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [03/16/2005 08:16 PM | 00,113,664 | ---- | M] (Adobe Systems, Inc.) "item" = Adobe Gamma [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Acrobat Assistant 8.0] "key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run "item" = Acrotray "hkey" = HKLM "command" = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe [10/23/2006 12:24 AM | 00,620,152 | ---- | M] (Adobe Systems Inc.) "inimapping" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Version Cue CS2] "key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run "item" = VersionCueCS2Tray "hkey" = HKLM "command" = C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [04/04/2005 07:58 PM | 00,856,064 | ---- | M] (Adobe Sytems Incorporated) "inimapping" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck] "key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run "item" = NeroCheck "hkey" = HKLM "command" = C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [03/01/2007 04:57 PM | 00,153,136 | ---- | M] (Nero AG) "inimapping" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\swg] "key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run "item" = GoogleToolbarNotifier "hkey" = HKCU "inimapping" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TrojanScanner] "key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run "item" = Trjscan "hkey" = HKLM "command" = C:\Program Files\Trojan Remover\Trjscan.exe [08/11/2008 10:20 AM | 00,909,904 | ---- | M] (Simply Super Software) "inimapping" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state] "system.ini" = 0 "win.ini" = 0 "bootini" = 0 "services" = 2 "startup" = 2 ===== DNS Name Servers ===== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{29734D2A-E117-4AE1-958E-FC9B75BB05AA}] Servers: | Description: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{839D0903-86B5-401B-AB11-AEBAAE6CB4BA}] Servers: | Description: 1394 Net Adapter ===== CDRom AutoRun Settings ===== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom] "AutoRun" = 1 ===== Autorun Files on Drives ===== AUTOEXEC.BAT [] [11/08/2007 12:30 PM | 00,000,000 | ---- | M] () C:\AUTOEXEC.BAT [ NTFS ] ===== MountPoints2 ===== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5572df08-8e1b-11dc-bfdc-0015f2828fed}\Shell] "" = None [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5572df08-8e1b-11dc-bfdc-0015f2828fed}\Shell\Autoplay] "MUIVerb" = C:\WINDOWS\system32\shell32.dll [04/13/2008 08:12 PM | 08,461,312 | ---- | M] (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5572df08-8e1b-11dc-bfdc-0015f2828fed}\Shell\Autoplay\DropTarget] "CLSID" = {f26a669a-bcbb-4e37-abf9-7325da15f931} ===== Hosts File ===== HOSTS File = (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts First 25 entries... 127.0.0.1 localhost [Files/Folders - Created Within 30 days] [08/11/2008 10:09 AM | ---D | C] - C:\QooBox [08/11/2008 10:23 AM | ---D | C] - C:\SDFix [08/21/2008 11:26 AM | 00,000,244 | -H-- | C] () - C:\sqmnoopt01.sqm [08/21/2008 11:26 AM | 00,000,268 | -H-- | C] () - C:\sqmdata01.sqm [08/25/2008 08:14 PM | ---D | C] - C:\ComboFix [08/26/2008 01:00 PM | -HSD | C] - C:\RECYCLER [07/29/2008 08:20 PM | 00,024,774 | ---- | C] () - C:\WINDOWS\System32\drivers\klopp.dat [08/08/2008 06:17 PM | 00,213,008 | ---- | C] (Kaspersky Lab) - C:\WINDOWS\System32\drivers\klif.sys [08/08/2008 06:18 PM | 00,003,012 | -HS- | C] () - C:\WINDOWS\System32\drivers\fidbox2.idx [08/08/2008 06:18 PM | 00,043,276 | -HS- | C] () - C:\WINDOWS\System32\drivers\fidbox.idx [08/08/2008 06:18 PM | 00,087,855 | ---- | C] () - C:\WINDOWS\System32\drivers\klick.dat [08/08/2008 06:18 PM | 00,096,976 | ---- | C] () - C:\WINDOWS\System32\drivers\klin.dat [08/08/2008 06:18 PM | 00,565,280 | -HS- | C] () - C:\WINDOWS\System32\drivers\fidbox2.dat [08/08/2008 06:18 PM | 05,401,120 | -HS- | C] () - C:\WINDOWS\System32\drivers\fidbox.dat [08/11/2008 10:24 AM | 00,017,144 | ---- | C] (Malwarebytes Corporation) - C:\WINDOWS\System32\drivers\mbam.sys [08/11/2008 10:24 AM | 00,038,472 | ---- | C] (Malwarebytes Corporation) - C:\WINDOWS\System32\drivers\mbamswissarmy.sys [08/18/2008 09:31 AM | 00,003,135 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv08nt5.dll [08/18/2008 09:31 AM | 00,003,615 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv05nt5.dll [08/18/2008 09:31 AM | 00,003,647 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv07nt5.dll [08/18/2008 09:31 AM | 00,003,711 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv09nt5.dll [08/18/2008 09:31 AM | 00,003,775 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv11nt5.dll [08/18/2008 09:31 AM | 00,003,901 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\siint5.dll [08/18/2008 09:31 AM | 00,003,967 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv02nt5.dll [08/18/2008 09:31 AM | 00,004,255 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\adv01nt5.dll [08/18/2008 09:31 AM | 00,011,359 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\atv02nt5.dll [08/18/2008 09:31 AM | 00,011,615 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1mdxx.sys [08/18/2008 09:31 AM | 00,011,868 | ---- | C] (Conexant) - C:\WINDOWS\System32\drivers\mdmxsdk.sys [08/18/2008 09:31 AM | 00,012,047 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1pdxx.sys [08/18/2008 09:31 AM | 00,013,240 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\slwdmsup.sys [08/18/2008 09:31 AM | 00,013,776 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\recagent.sys [08/18/2008 09:31 AM | 00,013,824 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinmdxx.sys [08/18/2008 09:31 AM | 00,013,824 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinttxx.sys [08/18/2008 09:31 AM | 00,014,143 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\atv06nt5.dll [08/18/2008 09:31 AM | 00,014,336 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinpdxx.sys [08/18/2008 09:31 AM | 00,015,423 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\ch7xxnt5.dll [08/18/2008 09:31 AM | 00,017,279 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\atv10nt5.dll [08/18/2008 09:31 AM | 00,021,183 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\atv01nt5.dll [08/18/2008 09:31 AM | 00,021,343 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1ttxx.sys [08/18/2008 09:31 AM | 00,025,471 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\atv04nt5.dll [08/18/2008 09:31 AM | 00,026,367 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1snxx.sys [08/18/2008 09:31 AM | 00,028,672 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinsnxx.sys [08/18/2008 09:31 AM | 00,029,455 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1xbxx.sys [08/18/2008 09:31 AM | 00,030,671 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1raxx.sys [08/18/2008 09:31 AM | 00,031,744 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinxbxx.sys [08/18/2008 09:31 AM | 00,034,735 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1xsxx.sys [08/18/2008 09:31 AM | 00,036,463 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1tuxx.sys [08/18/2008 09:31 AM | 00,040,960 | ---- | C] (Silicon Integrated Systems Corporation) - C:\WINDOWS\System32\drivers\sisagp.sys [08/18/2008 09:31 AM | 00,043,008 | ---- | C] (Advanced Micro Devices, Inc.) - C:\WINDOWS\System32\drivers\amdagp.sys [08/18/2008 09:31 AM | 00,052,224 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinraxx.sys [08/18/2008 09:31 AM | 00,056,623 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1btxx.sys [08/18/2008 09:31 AM | 00,057,856 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinbtxx.sys [08/18/2008 09:31 AM | 00,063,488 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinxsxx.sys [08/18/2008 09:31 AM | 00,063,663 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati1rvxx.sys [08/18/2008 09:31 AM | 00,064,352 | ---- | C] () - C:\WINDOWS\System32\drivers\ativmc20.cod [08/18/2008 09:31 AM | 00,067,866 | ---- | C] () - C:\WINDOWS\System32\drivers\netwlan5.img [08/18/2008 09:31 AM | 00,073,216 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atintuxx.sys [08/18/2008 09:31 AM | 00,095,424 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\slnthal.sys [08/18/2008 09:31 AM | 00,104,960 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\atinrvxx.sys [08/18/2008 09:31 AM | 00,126,686 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\mtlmnt5.sys [08/18/2008 09:31 AM | 00,129,045 | ---- | C] () - C:\WINDOWS\System32\drivers\cxthsfs2.cty [08/18/2008 09:31 AM | 00,129,535 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\slnt7554.sys [08/18/2008 09:31 AM | 00,144,384 | ---- | C] (Windows ® Server 2003 DDK provider) - C:\WINDOWS\System32\drivers\hdaudbus.sys [08/18/2008 09:31 AM | 00,166,912 | ---- | C] (S3 Graphics, Inc.) - C:\WINDOWS\System32\drivers\s3gnbm.sys [08/18/2008 09:31 AM | 00,180,360 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\ntmtlfax.sys [08/18/2008 09:31 AM | 00,220,032 | ---- | C] (Conexant Systems, Inc.) - C:\WINDOWS\System32\drivers\hsfbs2s2.sys [08/18/2008 09:31 AM | 00,327,040 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\drivers\ati2mtaa.sys [08/18/2008 09:31 AM | 00,404,990 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\slntamr.sys [08/18/2008 09:31 AM | 00,452,736 | ---- | C] (Matrox Graphics Inc.) - C:\WINDOWS\System32\drivers\mtxparhm.sys [08/18/2008 09:31 AM | 00,685,056 | ---- | C] (Conexant Systems, Inc.) - C:\WINDOWS\System32\drivers\hsfcxts2.sys [08/18/2008 09:31 AM | 01,041,536 | ---- | C] (Conexant Systems, Inc.) - C:\WINDOWS\System32\drivers\hsfdpsp2.sys [08/18/2008 09:31 AM | 01,309,184 | ---- | C] (Smart Link) - C:\WINDOWS\System32\drivers\mtlstrm.sys [08/18/2008 09:31 AM | 01,897,408 | ---- | C] (NVIDIA Corporation) - C:\WINDOWS\System32\drivers\nv4_mini.sys [08/18/2008 09:32 AM | 00,011,295 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\wadv08nt.sys [08/18/2008 09:32 AM | 00,011,325 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\vchnt5.dll [08/18/2008 09:32 AM | 00,011,807 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\wadv07nt.sys [08/18/2008 09:32 AM | 00,011,871 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\wadv09nt.sys [08/18/2008 09:32 AM | 00,011,935 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\wadv11nt.sys [08/18/2008 09:32 AM | 00,022,271 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\watv06nt.sys [08/18/2008 09:32 AM | 00,025,471 | ---- | C] (Intel® Corporation) - C:\WINDOWS\System32\drivers\watv10nt.sys [1 C:\WINDOWS\System32\*.tmp files] [07/29/2008 08:21 PM | 00,218,376 | ---- | C] (Kaspersky Lab) - C:\WINDOWS\System32\klogon.dll [08/07/2008 10:20 AM | 00,135,168 | ---- | C] (Sun Microsystems, Inc.) - C:\WINDOWS\System32\java.exe [08/07/2008 10:20 AM | 00,135,168 | ---- | C] (Sun Microsystems, Inc.) - C:\WINDOWS\System32\javaw.exe [08/07/2008 10:20 AM | 00,139,264 | ---- | C] (Sun Microsystems, Inc.) - C:\WINDOWS\System32\javaws.exe [08/08/2008 05:55 PM | 00,001,152 | ---- | C] () - C:\WINDOWS\System32\windrv.sys [08/11/2008 11:14 AM | 00,002,864 | ---- | C] () - C:\WINDOWS\System32\tmp.reg [08/11/2008 11:14 AM | 00,025,600 | ---- | C] () - C:\WINDOWS\System32\WS2Fix.exe.vir [08/11/2008 11:14 AM | 00,051,200 | ---- | C] () - C:\WINDOWS\System32\dumphive.exe [08/11/2008 11:14 AM | 00,053,248 | ---- | C] (http://www.beyondlogic.org) - C:\WINDOWS\System32\Process.exe [08/11/2008 11:14 AM | 00,082,432 | ---- | C] (S!Ri.URZ) - C:\WINDOWS\System32\404Fix.exe [08/11/2008 11:14 AM | 00,082,432 | ---- | C] (S!Ri.URZ) - C:\WINDOWS\System32\IEDFix.C.exe [08/11/2008 11:14 AM | 00,086,528 | ---- | C] (S!Ri.URZ) - C:\WINDOWS\System32\VACFix.exe [08/11/2008 11:14 AM | 00,288,417 | ---- | C] (S!Ri) - C:\WINDOWS\System32\SrchSTS.exe [08/11/2008 11:14 AM | 00,289,144 | ---- | C] (S!Ri) - C:\WINDOWS\System32\VCCLSID.exe [08/18/2008 09:31 AM | 00,000,974 | ---- | C] () - C:\WINDOWS\System32\pid.inf [08/18/2008 09:31 AM | 00,009,728 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\ativdaxx.ax [08/18/2008 09:31 AM | 00,023,040 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\ativmvxx.ax [08/18/2008 09:31 AM | 00,032,285 | ---- | C] (Conexant Systems, Inc.) - C:\WINDOWS\System32\hsfcisp2.dll [08/18/2008 09:31 AM | 00,032,768 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\ativtmxx.dll [08/18/2008 09:31 AM | 00,032,866 | ---- | C] (Smart Link) - C:\WINDOWS\System32\slrundll.exe [08/18/2008 09:31 AM | 00,073,796 | ---- | C] (Smart Link) - C:\WINDOWS\System32\slserv.exe [08/18/2008 09:31 AM | 00,073,832 | ---- | C] (Smart Link) - C:\WINDOWS\System32\slcoinst.dll [08/18/2008 09:31 AM | 00,086,016 | ---- | C] (Conexant) - C:\WINDOWS\System32\mdmxsdk.dll [08/18/2008 09:31 AM | 00,188,508 | ---- | C] (Smart Link) - C:\WINDOWS\System32\slgen.dll [08/18/2008 09:31 AM | 00,286,792 | ---- | C] (Smart Link) - C:\WINDOWS\System32\slextspk.dll [08/18/2008 09:31 AM | 00,377,984 | ---- | C] (ATI Technologies Inc.) - C:\WINDOWS\System32\ati2dvaa.dll [08/18/2008 09:31 AM | 00,397,056 | ---- | C] (S3 Graphics, Inc.) - C:\WINDOWS\System32\s3gnb.dll [08/18/2008 09:31 AM | 00,870,784 | ---- | C] (ATI Technologies Inc. ) - C:\WINDOWS\System32\ati3d1ag.dll [08/18/2008 09:31 AM | 01,737,856 | ---- | C] (Matrox Graphics Inc.) - C:\WINDOWS\System32\mtxparhd.dll [08/18/2008 09:31 AM | 04,274,816 | ---- | C] (NVIDIA Corporation) - C:\WINDOWS\System32\nv4_disp.dll [08/20/2008 11:15 AM | ---D | C] - C:\WINDOWS\System32\bits [08/20/2008 11:15 AM | ---D | C] - C:\WINDOWS\System32\en [08/20/2008 11:15 AM | ---D | C] - C:\WINDOWS\System32\scripting [2 C:\WINDOWS\*.tmp files] [08/04/2008 02:09 PM | -H-D | C] - C:\WINDOWS\PIF [08/11/2008 10:09 AM | 00,028,672 | ---- | C] (NirSoft) - C:\WINDOWS\Nircmd.exe [08/11/2008 10:09 AM | 00,049,152 | ---- | C] () - C:\WINDOWS\VFind.exe [08/11/2008 10:09 AM | 00,068,096 | ---- | C] () - C:\WINDOWS\zip.exe [08/11/2008 10:09 AM | 00,080,412 | ---- | C] () - C:\WINDOWS\grep.exe [08/11/2008 10:09 AM | 00,089,504 | ---- | C] (Smallfrogs Studio) - C:\WINDOWS\fdsv.exe [08/11/2008 10:09 AM | 00,098,816 | ---- | C] () - C:\WINDOWS\sed.exe [08/11/2008 10:09 AM | 00,136,704 | ---- | C] (SteelWerX) - C:\WINDOWS\swsc.exe [08/11/2008 10:09 AM | 00,161,792 | ---- | C] (SteelWerX) - C:\WINDOWS\swreg.exe [08/11/2008 10:09 AM | 00,212,480 | ---- | C] (SteelWerX) - C:\WINDOWS\swxcacls.exe [08/11/2008 10:09 AM | ---D | C] - C:\WINDOWS\erdnt [08/11/2008 11:33 AM | ---D | C] - C:\WINDOWS\temp [08/18/2008 09:31 AM | 00,032,866 | ---- | C] (Smart Link) - C:\WINDOWS\slrundll.exe [08/20/2008 11:10 AM | -H-D | C] - C:\WINDOWS\$NtServicePackUninstall$ [08/20/2008 11:13 AM | ---D | C] - C:\WINDOWS\ServicePackFiles [08/20/2008 11:15 AM | ---D | C] - C:\WINDOWS\l2schemas [08/20/2008 11:20 AM | ---D | C] - C:\WINDOWS\Prefetch [08/08/2008 06:16 PM | ---D | C] - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files [08/08/2008 06:18 PM | ---D | C] - C:\Documents and Settings\All Users\Application Data\Kaspersky Lab [08/11/2008 10:21 AM | ---D | C] - C:\Documents and Settings\All Users\Application Data\TEMP @Alternate Data Stream - 124 bytes -> %AllUsersProfile%\Application Data\TEMP:CB0AACC9 [08/11/2008 10:24 AM | ---D | C] - C:\Documents and Settings\All Users\Application Data\Malwarebytes [08/11/2008 10:36 AM | ---D | C] - C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com [08/11/2008 10:24 AM | ---D | C] - C:\Documents and Settings\Enoch\Application Data\Malwarebytes [08/11/2008 10:36 AM | ---D | C] - C:\Documents and Settings\Enoch\Application Data\SUPERAntiSpyware.com [08/27/2008 02:38 PM | ---D | C] - C:\Documents and Settings\Enoch\Application Data\Dropbox [08/04/2008 02:07 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\R-Epartner.com [08/06/2008 02:25 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\Print-Banksy-Gallery [08/11/2008 10:19 AM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\Simply Super Software [08/13/2008 01:25 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\AdobeStockPhotos [08/21/2008 04:11 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\sample_site_css [08/21/2008 04:22 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\layout03 [08/21/2008 04:22 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\layout07 [08/21/2008 05:56 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\layout08 [08/22/2008 01:06 PM | 00,001,188 | ---- | C] () - C:\Documents and Settings\Enoch\My Documents\layout10.zip [08/22/2008 01:07 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\layout10 [08/22/2008 12:59 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\layout09 [08/25/2008 02:22 PM | ---D | C] - C:\Documents and Settings\Enoch\My Documents\Stock_Funny [08/26/2008 12:52 PM | 00,730,033 | ---- | C] () - C:\Documents and Settings\Enoch\My Documents\DebtReductionCalculator.zip [08/27/2008 02:38 PM | R--D | C] - C:\Documents and Settings\Enoch\My Documents\My Dropbox [08/07/2008 02:35 PM | 00,001,729 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk [08/11/2008 10:24 AM | 00,000,696 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [08/11/2008 10:36 AM | 00,000,780 | ---- | C] () - C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk [08/08/2008 06:38 PM | 00,001,734 | ---- | C] () - C:\Documents and Settings\Enoch\Desktop\HijackThis.lnk [08/09/2008 03:09 PM | 02,830,141 | R--- | C] () - C:\Documents and Settings\Enoch\Desktop\ComboFix.exe [08/11/2008 10:50 AM | 00,456,263 | ---- | C] (Malwareteks.com) - C:\Documents and Settings\Enoch\Desktop\FixIEDef.exe [08/11/2008 11:11 AM | 01,479,403 | ---- | C] () - C:\Documents and Settings\Enoch\Desktop\SmitfraudFix.exe [08/11/2008 11:11 AM | ---D | C] - C:\Documents and Settings\Enoch\Desktop\SmitfraudFix [08/27/2008 02:38 PM | 07,508,800 | ---- | C] () - C:\Documents and Settings\Enoch\Desktop\Dropbox 0.6.285.exe [08/27/2008 03:13 PM | 01,299,968 | ---- | C] (OldTimer Tools) - C:\Documents and Settings\Enoch\Desktop\OTViewIt.exe [08/27/2008 02:38 PM | 00,000,678 | ---- | C] () - C:\Documents and Settings\Enoch\Start Menu\Programs\Startup\Dropbox.lnk [08/07/2008 02:35 PM | ---D | C] - C:\Program Files\Common Files\Adobe AIR [08/08/2008 05:55 PM | ---D | C] - C:\Program Files\Common Files\Download Manager [08/08/2008 06:18 PM | ---D | C] - C:\Program Files\Kaspersky Lab [08/08/2008 06:38 PM | ---D | C] - C:\Program Files\Trend Micro [08/11/2008 10:24 AM | ---D | C] - C:\Program Files\Malwarebytes' Anti-Malware< |