Browsers making the internet drop on certain pages. Really strange pro, Included a HiJackThis and RSIT logs. Keep losing internet-Please help. |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
  |
  Dec 1 2008, 12:16 PM
Post
#1
|
|
|
New Member  Posts: 5 OS: Vista Home Premium  |
it drops my internet connection. Internet Explorer is dropping the internet too.The only way to get it back is to restart the computer, and then restart the wireless router. I have a wireless Dynex G Desktop card, cause where my computer is, there is really no easy way to get the cable modem or router over to it. My router was a Linksys WRT54GS, but I thought my router was taking a dump, so I got a Netgear WGR614 However, the problem must not be the routers. I have tried every spyware scanner and virus scan that I know of, and and I am not a newbie. Something just does not seem quite right. Please take a look at my HiJackThis and RSIT logs and let me know what you think. Thanks, Greg Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:05:16 PM, on 12/1/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\zHotkey.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Portrait Displays\forteManager\dthtml.exe C:\Windows\System32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Windows\ehome\ehmsas.exe C:\Windows\System32\mobsync.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch...TP&M=GT5654 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O2 - BHO: (no name) - {D430AF92-0AE5-473E-A343-8C8884F1BFEA} - C:\Windows\system32\cihqs.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [EPSON Stylus CX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE /FU "C:\Users\GREG\AppData\Local\Temp\E_SA29F.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe RSIT Log: Logfile of random's system information tool 1.04 (written by random/random) Run by GREG at 2008-12-01 12:06:06 Microsoft® Windows Vista™ Home Premium Service Pack 1 System drive C: has 31 GB (23%) free of 136 GB Total RAM: 3070 MB (59% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:06:08 PM, on 12/1/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\zHotkey.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Portrait Displays\forteManager\dthtml.exe C:\Windows\System32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Windows\ehome\ehmsas.exe C:\Windows\System32\mobsync.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\SearchFilterHost.exe C:\Users\GREG\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\GREG.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch...TP&M=GT5654 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O2 - BHO: (no name) - {D430AF92-0AE5-473E-A343-8C8884F1BFEA} - C:\Windows\system32\cihqs.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [EPSON Stylus CX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE /FU "C:\Users\GREG\AppData\Local\Temp\E_SA29F.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 6780 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-26 2210608] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-30 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}] CBrowserHelperObject Object - c:\windows\system32\BAE.dll [2006-02-01 94208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D430AF92-0AE5-473E-A343-8C8884F1BFEA}] C:\Windows\system32\cihqs.dll [2008-11-30 93184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-30 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "CHotkey"=C:\Windows\zHotkey.exe [2006-11-07 547840] "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-04-23 4435968] "DT LGE"=C:\Program Files\Portrait Displays\forteManager\DTHtml.exe [2007-06-12 291328] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-09-17 13580832] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-09-17 92704] "amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-30 136600] "egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-03-01 1443072] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"=C:\Windows\SMINST\launcher.exe [2007-07-13 40072] "Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2008-10-22 399504] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952] "EPSON Stylus CX7400 Series"=C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE [2007-02-15 179200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-26 2210608] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] shell\AutoRun\command - E:\Installer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\P] shell\AutoRun\command - P:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cb13ad0-e9a1-11dc-bfc2-001e9074464e}] shell\AutoRun\command - L:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a150fc01-22fd-11dd-a259-001e9074464e}] shell\AutoRun\command - P:\LaunchU3.exe -a ======List of files/folders created in the last 1 months====== 2008-12-01 11:36:49 ----D---- C:\rsit 2008-12-01 00:35:06 ----D---- C:\Users\GREG\AppData\Roaming\Malwarebytes 2008-12-01 00:35:01 ----D---- C:\ProgramData\Malwarebytes 2008-12-01 00:35:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-11-30 22:12:29 ----A---- C:\Windows\system32\tmp.txt 2008-11-30 22:12:27 ----A---- C:\rapport.txt 2008-11-30 11:40:15 ----D---- C:\Users\GREG\AppData\Roaming\ESET 2008-11-30 11:39:37 ----D---- C:\ProgramData\ESET 2008-11-30 11:39:37 ----D---- C:\Program Files\ESET 2008-11-30 11:39:14 ----A---- C:\Windows\system32\cihqs.dll 2008-11-30 11:00:21 ----D---- C:\Program Files\Dynex G Desktop Card Adapter 2008-11-30 11:00:08 ----D---- C:\Users\GREG\AppData\Roaming\InstallShield 2008-11-30 10:43:34 ----HDC---- C:\ProgramData\{148D8B8A-8F96-4822-81EC-D510B626B7D5} 2008-11-30 00:17:27 ----A---- C:\Windows\system32\javaws.exe 2008-11-30 00:17:27 ----A---- C:\Windows\system32\javaw.exe 2008-11-30 00:17:27 ----A---- C:\Windows\system32\deploytk.dll 2008-11-30 00:17:26 ----A---- C:\Windows\system32\java.exe 2008-11-30 00:01:20 ----D---- C:\Windows\Sun 2008-11-29 19:19:23 ----A---- C:\Windows\system32\AegisE5.dll 2008-11-29 19:19:23 ----A---- C:\Windows\system32\AegisE2.dll 2008-11-29 19:12:45 ----A---- C:\Windows\system32\AtherosAB.dll 2008-11-29 18:40:04 ----D---- C:\Windows\system32\New Folder (2) 2008-11-29 16:43:41 ----D---- C:\Program Files\Dynex Wireless G Adapter 2008-11-29 16:11:04 ----D---- C:\Windows\system32\msmq 2008-11-29 16:11:04 ----D---- C:\inetpub 2008-11-28 23:33:42 ----D---- C:\Program Files\AMD 2008-11-28 13:25:09 ----D---- C:\Netgear 2008-11-27 10:18:44 ----A---- C:\Windows\system32\WindowsCodecsExt.dll 2008-11-27 10:18:44 ----A---- C:\Windows\system32\WindowsCodecs.dll 2008-11-27 10:18:44 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll 2008-11-27 10:18:43 ----A---- C:\Windows\system32\PortableDeviceApi.dll 2008-11-27 10:18:43 ----A---- C:\Windows\system32\connect.dll 2008-11-23 01:17:15 ----D---- C:\Program Files\Left4Dead 2008-11-22 18:44:46 ----D---- C:\Program Files\HP 2008-11-19 13:16:15 ----D---- C:\Program Files\Common Files\Adobe AIR 2008-11-15 00:33:05 ----D---- C:\Program Files\Dream Aquarium 2008-11-15 00:18:52 ----A---- C:\Windows\system32\YTClownFish.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\YellowBFish.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\ThreadfinBF.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\TDiscusFish.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\SeahorseFish.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\ScissortailFish.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\SaddlebackCF.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\RyukinFish.exe 2008-11-15 00:18:52 ----A---- C:\Windows\system32\RedLionFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\PennantCFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\NeonTetraFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\KissingGFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\HarlequinTFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\GoldFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\EmperorAF.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\BlueTangFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\BlueAF.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\BlackMoorFish.exe 2008-11-15 00:18:51 ----A---- C:\Windows\system32\AngelFish.exe 2008-11-14 23:58:58 ----A---- C:\Windows\system32\BeniOku.txt 2008-11-13 15:09:22 ----A---- C:\Windows\system32\msxml3.dll 2008-11-13 15:09:21 ----A---- C:\Windows\system32\msxml6.dll 2008-11-08 21:25:02 ----D---- C:\Program Files\Micro Innovations 2008-11-04 13:57:16 ----A---- C:\Windows\system32\wups2.dll 2008-11-04 13:57:16 ----A---- C:\Windows\system32\wuauclt.exe 2008-11-04 13:57:15 ----A---- C:\Windows\system32\wucltux.dll 2008-11-04 13:57:15 ----A---- C:\Windows\system32\wuaueng.dll 2008-11-04 13:57:04 ----A---- C:\Windows\system32\wups.dll 2008-11-04 13:57:04 ----A---- C:\Windows\system32\wudriver.dll 2008-11-04 13:57:04 ----A---- C:\Windows\system32\wuapi.dll 2008-11-04 13:56:55 ----A---- C:\Windows\system32\wuwebv.dll 2008-11-04 13:56:55 ----A---- C:\Windows\system32\wuapp.exe ======List of files/folders modified in the last 1 months====== 2008-12-01 12:06:08 ----D---- C:\Windows\Prefetch 2008-12-01 12:06:03 ----D---- C:\Windows\Temp 2008-12-01 11:40:51 ----D---- C:\Program Files\Trend Micro 2008-12-01 00:38:26 ----D---- C:\Program Files\Mozilla Firefox 2008-12-01 00:35:39 ----A---- C:\Windows\ntbtlog.txt 2008-12-01 00:35:05 ----D---- C:\Windows\system32\drivers 2008-12-01 00:35:01 ----HD---- C:\ProgramData 2008-12-01 00:35:01 ----D---- C:\Program Files 2008-11-30 22:39:44 ----D---- C:\Windows 2008-11-30 22:39:37 ----D---- C:\Windows\system32\inetsrv 2008-11-30 22:37:30 ----D---- C:\Windows\Registration 2008-11-30 22:37:12 ----D---- C:\Windows\system32\config 2008-11-30 22:33:33 ----D---- C:\Windows\System32 2008-11-30 18:25:56 ----D---- C:\ProgramData\Spybot - Search & Destroy 2008-11-30 18:25:56 ----D---- C:\Program Files\Spybot - Search & Destroy 2008-11-30 18:12:44 ----SHD---- C:\Windows\Installer 2008-11-30 18:12:44 ----D---- C:\Program Files\Common Files 2008-11-30 18:12:41 ----D---- C:\ProgramData\Lavasoft 2008-11-30 11:40:05 ----D---- C:\Windows\system32\catroot 2008-11-30 11:40:04 ----HD---- C:\Windows\inf 2008-11-30 11:00:21 ----HD---- C:\Program Files\InstallShield Installation Information 2008-11-30 00:17:00 ----D---- C:\Program Files\Java 2008-11-29 22:32:59 ----D---- C:\Windows\SMINST 2008-11-29 20:12:12 ----A---- C:\Windows\system32\PerfStringBackup.INI 2008-11-29 19:03:23 ----D---- C:\Windows\system32\Tasks 2008-11-29 19:02:57 ----D---- C:\Documents 2008-11-29 16:28:39 ----D---- C:\Windows\rescache 2008-11-29 16:17:59 ----RSD---- C:\Windows\assembly 2008-11-29 16:17:59 ----D---- C:\Windows\Microsoft.NET 2008-11-29 16:11:04 ----D---- C:\Windows\system32\wbem 2008-11-29 16:11:04 ----D---- C:\Windows\system32\migration 2008-11-29 16:11:04 ----D---- C:\Windows\system32\en-US 2008-11-29 16:11:04 ----D---- C:\Windows\system32\0409 2008-11-29 16:06:10 ----D---- C:\Windows\winsxs 2008-11-29 16:06:08 ----D---- C:\Windows\ShellNew 2008-11-29 15:49:11 ----SD---- C:\Users\GREG\AppData\Roaming\Microsoft 2008-11-29 14:44:22 ----SD---- C:\Windows\Downloaded Program Files 2008-11-29 11:25:19 ----D---- C:\Windows\system32\catroot2 2008-11-29 04:35:17 ----D---- C:\Windows\system32\WDI 2008-11-29 02:51:33 ----D---- C:\Windows\system32\LogFiles 2008-11-29 02:51:13 ----SHD---- C:\System Volume Information 2008-11-29 02:12:13 ----D---- C:\Windows\Debug 2008-11-28 09:14:18 ----D---- C:\Program Files\Mozilla Thunderbird 2008-11-24 07:20:26 ----D---- C:\Users\GREG\AppData\Roaming\uTorrent 2008-11-19 13:16:20 ----D---- C:\ProgramData\Adobe 2008-11-19 13:16:00 ----D---- C:\Users\GREG\AppData\Roaming\Adobe 2008-11-19 02:31:44 ----D---- C:\Windows\LiveKernelReports 2008-11-10 23:25:10 ----D---- C:\ProgramData\Trend Micro 2008-11-03 18:10:25 ----A---- C:\Windows\system32\mrt.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 easdrv;easdrv; C:\Windows\system32\DRIVERS\easdrv.sys [2008-03-01 29704] R1 epfwtdi;epfwtdi; C:\Windows\system32\DRIVERS\epfwtdi.sys [2008-03-01 54280] R2 eamon;EAMON; C:\Windows\system32\DRIVERS\eamon.sys [2008-03-01 39944] R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2008-03-01 71176] R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672] R2 RMCAST;RMCAST (Pgm) Protocol Driver; C:\Windows\system32\DRIVERS\RMCAST.sys [2008-05-09 113664] R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-04 8192] R3 Afc;PPdus ASPI Shell; C:\Windows\system32\drivers\Afc.sys [2005-02-23 11776] R3 AmdLLD;AMD Low Level Device Driver; C:\Windows\system32\DRIVERS\AmdLLD.sys [2007-06-29 34304] R3 BCM43XX;Dynex 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-18 534016] R3 Epfwndis;Eset Personal Firewall; C:\Windows\system32\DRIVERS\Epfwndis.sys [2008-03-01 30728] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-04-23 1769952] R3 MQAC;@mqutil.dll,-6101; C:\Windows\system32\drivers\mqac.sys [2008-01-19 126976] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-09-17 7379872] R3 PdiPorts;Portrait Displays low level device driver; C:\Windows\System32\Drivers\PdiPorts.sys [2006-11-16 15920] R3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328] S3 ac97intc;Intel® 82801 Audio Driver Install Service (WDM); C:\Windows\system32\drivers\ac97intc.sys [2006-11-02 108032] S3 aq3xq5yu;aq3xq5yu; C:\Windows\system32\drivers\aq3xq5yu.sys [] S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-18 534016] S3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056] S3 Bridge;@%SystemRoot%\system32\bridgeres.dll,-3; C:\Windows\system32\DRIVERS\bridge.sys [2008-01-19 93696] S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2008-01-19 93696] S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2006-11-02 14208] S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632] S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-11-08 986624] S3 HSXHWBS2;HSXHWBS2; C:\Windows\system32\DRIVERS\HSXHWBS2.sys [2006-11-08 258048] S3 ialm;ialm; C:\Windows\system32\DRIVERS\ialmnt5.sys [2006-11-02 1302492] S3 motmodem;Motorola USB CDC ACM Driver; C:\Windows\system32\DRIVERS\motmodem.sys [] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192] S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888] S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016] S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista; C:\Windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184] S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\Windows\system32\DRIVERS\SymIM.sys [] S3 SymIMMP;SymIMMP; C:\Windows\system32\DRIVERS\SymIM.sys [] S3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2008-01-18 15872] S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-11-08 659968] S3 WINUSB;WinUsb Driver; C:\Windows\system32\DRIVERS\WinUSB.SYS [2008-01-18 31616] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936] S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 298496] S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2006-11-02 82432] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AppHostSvc;@%windir%\system32\inetsrv\iisres.dll,-30011; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 Asset Management Daemon;Asset Management Daemon; C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe [2007-06-12 114688] R2 DTSRVC;Portrait Displays Display Tune Service; C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe [2007-06-12 73728] R2 ekrn;Eset Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224] R2 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [2007-01-11 113664] R2 GameConsoleService;GameConsoleService; C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe [2007-08-29 181800] R2 IISADMIN;@%windir%\system32\inetsrv\iisres.dll,-30007; C:\Windows\system32\inetsrv\inetinfo.exe [2008-01-19 13824] R2 iprip;@%Systemroot%\system32\iprip.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 MSMQ;@mqutil.dll,-6102; C:\Windows\system32\mqsvc.exe [2006-11-02 8704] R2 MSMQTriggers;@mqutil.dll,-6203; C:\Windows\system32\mqtgsvc.exe [2008-01-19 125952] R2 NetMsmqActivator;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-01-05 122880] R2 NetPipeActivator;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-01-05 122880] R2 NetTcpActivator;@%systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-01-05 122880] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-09-17 196608] R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 simptcp;@%SystemRoot%\system32\simptcp.dll,-200; C:\Windows\System32\tcpsvcs.exe [2006-11-02 9728] R2 SNMP;@%SystemRoot%\system32\snmp.exe,-3; C:\Windows\System32\snmp.exe [2008-01-19 47616] R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968] R2 W3SVC;@%windir%\system32\inetsrv\iisres.dll,-30003; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-04 386560] R3 WAS;@%windir%\system32\inetsrv\iisres.dll,-30001; C:\Windows\system32\svchost.exe [2008-01-19 21504] S3 aspnet_state;@%windir%\system32\inetsrv\iisres.dll,-30009; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-01-05 33800] S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [2008-03-01 19200] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 774144] S3 NtmsSvc;@%SystemRoot%\system32\ntmssvc.dll,-2; C:\Windows\system32\svchost.exe [2008-01-19 21504] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WMSvc;@%windir%\system32\inetsrv\iisres.dll,-20001; C:\Windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264] S4 PDAgent;PDAgent; C:\Program Files\Raxco\PerfectDisk\PDAgent.exe [2007-02-02 407056] S4 PDEngine;PDEngine; C:\Program Files\Raxco\PerfectDisk\PDEngine.exe [2007-02-02 734736] S4 TlntSvr;@%SystemRoot%\system32\tlntsvr.exe,-119; C:\Windows\System32\tlntsvr.exe [2008-01-19 75776] -----------------EOF----------------- This post has been edited by neogreg: Dec 3 2008, 11:27 PM |
 |
 
|
|
Dec 3 2008, 11:26 PM
Post
#2
|
|
|
New Member Posts: 5 OS: Vista Home Premium |
Anybody have any ideas?
I would really appreciate some help. Thanks. |
|
|
|
|
Dec 4 2008, 02:41 AM
Post
#3
|
|
 Malware Moderator  Posts: 1,757 From: The Land Down Under OS: Windows XP pro |
While we try to help everyone as quickly as possible, our malware team is vastly outnumbered by people needing help. Some of our experts work from the older topics towards the newer ones and some take on newer topics rather than older ones. We encourage the former practice, but that's not always practical.
Some of the helpers are more comfortable with certain infections and seek them out...still other helpers will look for the tougher infections to take on. This may explain, at least partially, the seemingly random nature of how topics are selected. We DO try to get to everyone in a timely manner, but as you've seen, the Malware Forum presents a pretty formidable workload for the number of staff members we have. If your topic goes more than three days without a reply, post a link to your topic in The Waiting Room and a staff member will pick it up as soon as they can. |
|
|
|
|
Dec 4 2008, 11:04 PM
Post
#4
|
|
 Trusted Helper  Posts: 3,944 From: Ohio, USA OS: linux, Windows XP |
Hello neogreg and welcome to Geeks to go.
 Sorry about the delay. Please rescan with RSIT and post the log.txt in your next reply. |
|
|
|
 Dec 5 2008, 12:36 AM
Post
#5
|
|
|
New Member Posts: 5 OS: Vista Home Premium |
QUOTE (Jimmy2012 @ Dec 4 2008, 11:04 PM)  Hello neogreg and welcome to Geeks to go. Sorry about the delay. Please rescan with RSIT and post the log.txt in your next reply. See what you think. Thanks! Logfile of random's system information tool 1.04 (written by random/random) Run by GREG at 2008-12-05 00:34:57 Microsoft® Windows Vista™ Home Premium Service Pack 1 System drive C: has 23 GB (17%) free of 136 GB Total RAM: 3070 MB (66% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:35:10 AM, on 12/5/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\zHotkey.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Portrait Displays\forteManager\dthtml.exe C:\Windows\System32\rundll32.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\GREG\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\GREG.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch...TP&M=GT5654 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch...TP&M=GT5654 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll O2 - BHO: (no name) - {D430AF92-0AE5-473E-A343-8C8884F1BFEA} - (no file) O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [DT LGE] C:\Program Files\Portrait Displays\forteManager\DTHtml.exe -startup_folder O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [EPSON Stylus CX7400 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE /FU "C:\Users\GREG\AppData\Local\Temp\E_SA29F.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O23 - Service: Asset Management Daemon - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 6605 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-26 2210608] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-10 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}] CBrowserHelperObject Object - c:\windows\system32\BAE.dll [2006-02-01 94208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D430AF92-0AE5-473E-A343-8C8884F1BFEA}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-10 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "CHotkey"=C:\Windows\zHotkey.exe [2006-11-07 547840] "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-04-23 4435968] "DT LGE"=C:\Program Files\Portrait Displays\forteManager\DTHtml.exe [2007-06-12 291328] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-09-17 13580832] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-09-17 92704] "amd_dc_opt"=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824] "egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2008-03-01 1443072] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-10 136600] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"=C:\Windows\SMINST\launcher.exe [2007-07-13 40072] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952] "EPSON Stylus CX7400 Series"=C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE [2007-02-15 179200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-26 2210608] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] shell\AutoRun\command - E:\Installer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\P] shell\AutoRun\command - P:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cb13ad0-e9a1-11dc-bfc2-001e9074464e}] shell\AutoRun\command - L:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a150fc01-22fd-11dd-a259-001e9074464e}] shell\AutoRun\command - P:\LaunchU3.exe -a ======List of files/folders created in the last 2 months====== 2008-12-05 00:11:00 ----A---- C:\Windows\system32\XAudio2_3.dll 2008-12-05 00:11:00 ----A---- C:\Windows\system32\XAPOFX1_2.dll 2008-12-05 00:11:00 ----A---- C:\Windows\system32\D3DX9_40.dll 2008-12-05 00:11:00 ----A---- C:\Windows\system32\d3dx10_40.dll 2008-12-05 00:11:00 ----A---- C:\Windows\system32\D3DCompiler_40.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\XAudio2_2.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\XAPOFX1_1.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\xactengine3_3.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\xactengine3_2.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\X3DAudio1_5.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\D3DX9_39.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\d3dx10_39.dll 2008-12-05 00:10:59 ----A---- C:\Windows\system32\D3DCompiler_39.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\XAudio2_1.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\XAudio2_0.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\XAPOFX1_0.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\xactengine3_1.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\xactengine3_0.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\X3DAudio1_4.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\D3DX9_38.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\d3dx10_38.dll 2008-12-05 00:10:58 ----A---- C:\Windows\system32\D3DCompiler_38.dll 2008-12-05 00:10:57 ----A---- C:\Windows\system32\X3DAudio1_3.dll 2008-12-05 00:10:57 ----A---- C:\Windows\system32\D3DX9_37.dll 2008-12-05 00:10:57 ----A---- C:\Windows\system32\d3dx10_37.dll 2008-12-05 00:10:57 ----A---- C:\Windows\system32\D3DCompiler_37.dll 2008-12-05 00:10:22 ----D---- C:\Windows\system32\directx 2008-12-05 00:04:35 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2008-12-05 00:04:35 ----A---- C:\Windows\system32\infocardapi.dll 2008-12-05 00:04:34 ----A---- C:\Windows\system32\PresentationHostProxy.dll 2008-12-05 00:04:34 ----A---- C:\Windows\system32\icardres.dll 2008-12-05 00:04:34 ----A---- C:\Windows\system32\icardagt.exe 2008-12-05 00:04:33 ----A---- C:\Windows\system32\PresentationNative_v0300.dll 2008-12-05 00:04:31 ----A-- |