Well i forgot i can turn DEP off for Notepad! Doh, so fixed notepad..
Deckard's System Scanner v20071014.68
Run by user on 2008-06-30 22:01:43
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-30 22:01:49
Platform: Windows XP Service Pack 3 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Pwrchute\ups.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\user\Desktop\dss.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =
http://www.microsoft...amp;ar=iesearchO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {D2EEB637-A4A5-4BBB-8C0C-96AF821110C2} - C:\WINDOWS\system32\ljJCsPhI.dll
O2 - BHO: (no name) - {E8F9B79D-6852-44F2-A099-7AE1C0D21D88} - C:\WINDOWS\system32\awtRKAQG.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [686a6c1f] rundll32.exe "C:\WINDOWS\system32\fkycovot.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.mi...b?1207365669576O20 - Winlogon Notify: ljJCsPhI - C:\WINDOWS\system32\ljJCsPhI.dll
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: UPS - APC PowerChute plus (UPS) - APC - C:\Program Files\Pwrchute\ups.exe
--
End of file - 4359 bytes
-- Files created between 2008-05-30 and 2008-06-30 -----------------------------
2008-06-30 21:23:19 45212590 --a------ C:\registrybackup.reg
2008-06-30 19:49:44 91520 --a------ C:\WINDOWS\system32\fkycovot.dll
2008-06-29 20:28:41 0 d-------- C:\Program Files\Enigma Software Group
2008-06-29 20:08:56 0 d-------- C:\Documents and Settings\user\Application Data\Desktopicon
2008-06-29 19:37:23 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-06-29 19:31:24 1508 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-29 19:26:36 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2008-06-29 19:07:02 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-06-29 19:07:02 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-06-29 19:07:02 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-06-29 19:07:02 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-06-29 19:07:02 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-06-29 19:07:02 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-06-29 19:07:02 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-06-29 19:07:02 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-06-29 19:07:02 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-06-29 19:07:02 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-06-29 19:07:02 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-06-29 19:07:02 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-06-29 19:07:02 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-06-29 19:07:02 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-06-29 18:53:24 0 d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-06-29 18:19:21 0 d-------- C:\Program Files\uTorrent
2008-06-29 18:19:18 0 d-------- C:\Documents and Settings\user\Application Data\uTorrent
2008-06-29 17:35:38 0 d-------- C:\WINDOWS\system32\oodag
2008-06-29 16:49:26 96966 --ahs---- C:\WINDOWS\system32\GQAKRtwa.ini2
2008-06-29 16:49:21 318720 --a------ C:\WINDOWS\system32\awtRKAQG.dll
2008-06-29 16:44:16 28288 --a------ C:\WINDOWS\system32\ljJCsPhI.dll
2008-06-29 14:21:04 0 d-------- C:\Documents and Settings\user\Application Data\InfraRecorder
2008-06-29 14:20:45 0 d-------- C:\Program Files\InfraRecorder
2008-06-29 14:17:31 0 d-------- C:\Documents and Settings\All Users\Application Data\TrueCrypt
2008-06-29 14:07:29 66048 --a------ C:\WINDOWS\system32\xnmte450.dll
2008-06-29 14:07:29 25088 --a------ C:\WINDOWS\system32\xnmhn450.dll
2008-06-29 14:07:29 86528 --a------ C:\WINDOWS\system32\xnmhb450.dll
2008-06-29 14:07:29 373760 --a------ C:\WINDOWS\system32\xnmba450.dll
2008-06-29 14:07:27 36864 --a------ C:\WINDOWS\system32\apcctrs.dll <Not Verified; American Power Conversion; PowerChute plus Performance DLL>
2008-06-29 14:07:26 0 d-------- C:\Program Files\Pwrchute
2008-06-29 14:06:45 299008 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-06-29 14:06:41 0 d-------- C:\Documents and Settings\user\WINDOWS
2008-06-24 16:40:03 0 d-------- C:\Program Files\GameSpy Arcade
2008-06-24 16:37:52 0 d-------- C:\Program Files\EA GAMES
2008-06-24 16:20:12 0 d-------- C:\Program Files\TrueCrypt
2008-06-24 16:20:02 0 d-------- C:\Documents and Settings\user\Application Data\TrueCrypt
2008-06-24 16:19:39 0 d-------- C:\Program Files\Jetico
2008-06-24 16:08:08 0 d-------- C:\Documents and Settings\user\Application Data\VSRevoGroup
2008-06-24 16:04:34 0 d-------- C:\Program Files\VS Revo Group
2008-06-23 19:47:49 0 d-------- C:\Program Files\Prey
2008-06-22 12:28:19 0 d-------- C:\Program Files\[bleep] NFO Viewer
2008-06-22 12:10:19 0 d-------- C:\Program Files\Common Files\ASCOM
2008-06-22 12:09:32 0 d-------- C:\Program Files\Common Files\Adobe
2008-06-22 12:09:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-06-22 12:08:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-22 12:08:33 0 d-------- C:\Program Files\QuickTime
2008-06-22 12:02:55 0 d--h----- C:\Program Files\Zero G Registry
2008-06-22 12:02:55 0 d-------- C:\Program Files\Starry Night Pro Plus 6
2008-06-22 12:02:31 0 d--h----- C:\Documents and Settings\user\InstallAnywhere
2008-06-19 17:23:36 0 d-------- C:\Program Files\World of Warcraft
2008-06-19 16:57:43 0 d-------- C:\Program Files\Common Files\EasyInfo
2008-06-18 23:08:38 908 --a------ C:\WINDOWS\eReg.dat
2008-06-18 22:49:59 0 d-------- C:\WINDOWS\nvidia icons
2008-06-18 22:49:14 0 d-------- C:\NVIDIA
2008-06-18 21:58:20 0 d-------- C:\Documents and Settings\user\Application Data\Macromedia
2008-06-18 21:40:00 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-06-18 21:34:51 0 d-------- C:\Documents and Settings\user\Application Data\Adobe
2008-06-18 21:34:16 4298 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-06-18 21:04:43 0 d-------- C:\Program Files\GameSpy
2008-06-18 20:54:28 0 d-------- C:\WINDOWS\Prefetch
2008-06-18 20:49:28 0 d-------- C:\WINDOWS\system32\scripting
2008-06-18 20:49:27 0 d-------- C:\WINDOWS\system32\en
2008-06-18 20:49:27 0 d-------- C:\WINDOWS\l2schemas
2008-06-18 20:49:26 0 d-------- C:\WINDOWS\system32\bits
2008-06-18 20:47:15 0 d-------- C:\WINDOWS\ServicePackFiles
2008-06-18 20:43:54 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-06-18 20:41:08 0 d-------- C:\WINDOWS\EHome
2008-06-18 20:20:43 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-18 19:41:46 5702 --ah----- C:\WINDOWS\nod32restoretemdono.reg
2008-06-18 19:41:46 568 --ah----- C:\WINDOWS\nod32fixtemdono.reg
2008-06-18 19:40:24 0 d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-06-18 19:39:21 0 d-------- C:\Documents and Settings\user\Application Data\WinRAR
2008-06-18 19:35:51 0 d-------- C:\WINDOWS\pss
2008-06-18 19:31:57 0 d-------- C:\Documents and Settings\user\Application Data\dvdcss
2008-06-18 19:27:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-06-10 16:03:40 0 d-------- C:\Program Files\Windows Media Connect 2
2008-06-10 16:00:47 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-06-10 15:59:28 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-06-05 19:59:55 0 d-------- C:\Program Files\Ubisoft
2008-06-05 19:58:41 0 d-------- C:\WINDOWS\Cache
2008-06-05 19:40:42 0 d-------- C:\WINDOWS\system32\URTTemp
2008-06-05 19:38:24 669184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-06-05 19:38:24 0 d-------- C:\WINDOWS\system32\LogFiles
2008-06-05 19:32:17 0 d-------- C:\Program Files\Electronic Arts
2008-06-05 19:27:36 0 d-------- C:\WINDOWS\nview
2008-06-05 19:27:16 1630208 --a------ C:\WINDOWS\system32\nwiz.exe
2008-06-05 19:27:14 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-06-05 19:27:14 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-06-05 19:27:14 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-06-05 19:27:14 1486848 --a------ C:\WINDOWS\system32\nview.dll
2008-06-05 19:27:14 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-06-05 19:27:14 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-06-05 19:27:14 425984 --a------ C:\WINDOWS\system32\keystone.exe
2008-06-05 19:26:01 0 d-------- C:\Program Files\VDOTool
2008-06-05 19:25:20 5248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2008-06-05 19:25:20 155136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2008-06-05 19:25:18 0 d-------- C:\Program Files\D-Tools
2008-06-05 19:25:07 0 d-------- C:\WINDOWS\Downloaded Installations
2008-06-01 16:02:22 0 d-------- C:\Documents and Settings\user\Application Data\AVGTOOLBAR
-- Find3M Report ---------------------------------------------------------------
2008-06-29 18:27:29 0 d-------- C:\Program Files\Common Files
2008-06-24 16:50:54 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-18 23:01:27 0 d-------- C:\Program Files\Common Files\InstallShield
2008-06-18 20:49:42 0 d-------- C:\Program Files\Messenger
2008-06-18 20:49:26 0 d-------- C:\Program Files\Movie Maker
2008-06-18 20:47:01 0 d-------- C:\Program Files\Windows NT
2008-06-18 19:30:13 0 d-------- C:\Program Files\Common Files\Ahead
2008-05-20 20:14:37 262144 --a------ C:\WINDOWS\BCUnInstall.exe <Not Verified; Jetico; BCUnInstall>
2008-04-06 03:12:12 62 --ahs---- C:\Documents and Settings\user\Application Data\desktop.ini
2008-04-05 15:36:41 0 -rahs---- C:\MSDOS.SYS
2008-04-05 15:36:41 0 -rahs---- C:\IO.SYS
2008-04-05 15:36:41 0 --a------ C:\CONFIG.SYS
2008-04-05 15:36:41 0 --a------ C:\AUTOEXEC.BAT
2008-04-05 15:33:59 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D2EEB637-A4A5-4BBB-8C0C-96AF821110C2}]
29/06/2008 16:44 28288 --a------ C:\WINDOWS\system32\ljJCsPhI.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E8F9B79D-6852-44F2-A099-7AE1C0D21D88}]
29/06/2008 16:49 318720 --a------ C:\WINDOWS\system32\awtRKAQG.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [23/01/2005 10:36]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [23/01/2005 10:31]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [14/10/2004 14:42]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [02/05/2008 22:46]
"nwiz"="nwiz.exe" [02/05/2008 22:46 C:\WINDOWS\system32\nwiz.exe]
"egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [20/02/2008 11:06]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [02/05/2008 22:46]
"BCWipeTM Startup"="C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" [11/03/2008 20:16]
"OODefragTray"="C:\WINDOWS\system32\oodtray.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [22/06/2008 12:08]
"686a6c1f"="C:\WINDOWS\system32\fkycovot.dll" [30/06/2008 19:49]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [14/04/2008 05:42]
"TrueCrypt"="C:\Program Files\TrueCrypt\TrueCrypt.exe" [24/06/2008 16:20]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{D2EEB637-A4A5-4BBB-8C0C-96AF821110C2}"= C:\WINDOWS\system32\ljJCsPhI.dll [29/06/2008 16:44 28288]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJCsPhI]
ljJCsPhI.dll 29/06/2008 16:44 28288 C:\WINDOWS\system32\ljJCsPhI.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awtRKAQG
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc
-- End of Deckard's System Scanner: finished at 2008-06-30 22:04:50 ------------
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft Windows XP Home Edition (build 2600) SP 3.0
Architecture: X86; Language: English
CPU 0: Intel® Celeron® CPU 2.80GHz
Percentage of Memory in Use: 29%
Physical Memory (total/avail): 1022.01 MiB / 721.4 MiB
Pagefile Memory (total/avail): 2447.25 MiB / 2243.87 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1923.75 MiB
A: is Removable (Unformatted)
C: is Fixed (NTFS) - 74.5 GiB total, 47.21 GiB free.
D: is CDROM (UDF)
F: is Fixed (NTFS) - 232.88 GiB total, 184.73 GiB free.
\\.\PHYSICALDRIVE0 - WDC WD800JD-75JNA0 - 74.5 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 74.5 GiB - C:
\\.\PHYSICALDRIVE1 - Maxtor Basics Desktop USB Device - 232.88 GiB - 1 partition
\PARTITION0 - Installable File System - 232.88 GiB - F:
-- Security Center -------------------------------------------------------------
AUOptions is set to notify before install.
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\user\Application Data
CLASSPATH=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=USER-63F3DD10DC
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\user
LOGONSERVER=\\USER-63F3DD10DC
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0401
ProgramFiles=C:\Program Files
PROMPT=$P$G
PWRCHUTE=C:\Program Files\Pwrchute
QTJAVA=C:\Program Files\QuickTime\QTSystem\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\user\LOCALS~1\Temp
TMP=C:\DOCUME~1\user\LOCALS~1\Temp
USERDOMAIN=USER-63F3DD10DC
USERNAME=user
USERPROFILE=C:\Documents and Settings\user
windir=C:\WINDOWS
-- User Profiles ---------------------------------------------------------------
user
(admin)Administrator
(admin)-- Add/Remove Programs ---------------------------------------------------------
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0.8 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
ASCOM Platform 4.1 --> C:\PROGRA~1\COMMON~1\ASCOM\TELESC~1\UNWISE.EXE C:\PROGRA~1\COMMON~1\ASCOM\TELESC~1\INSTALL.LOG
Battlefield 1942 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\setup.exe" -l0x9
Battlefield 1942: Secret Weapons of WWII --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B73B4A99-4173-4747-BBEC-0F05E966F9D2}\setup.exe" -l0x9
Battlefield 1942: The Road To Rome --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}\setup.exe" -l0x9
Battlefield 2142 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}\setup.exe" -l0x9 -removeonly
BCWipe 3.0 --> "C:\WINDOWS\BCUnInstall.exe" C:\Program Files\Jetico\BCWipe\UnInstall.log
Broadcom Gigabit Integrated Controller --> MsiExec.exe /X{7E369B27-13E2-41A5-9879-358EE1C8B5AD}
DAEMON Tools --> MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
ESET NOD32 Antivirus --> MsiExec.exe /I{7D974ACA-4EE5-412C-8E6A-A5B57B305727}
Far Cry --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC} /l2057
First Strike Mod --> C:\Program Files\Electronic Arts\Battlefield 2142\Mods\FirstStrike\Uninst.exe
GameSpy Arcade --> C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
InfraRecorder --> C:\Program Files\InfraRecorder\uninstall.exe
Intel® Graphics Media Accelerator Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2782 PCI\VEN_8086&DEV_2582
Lightroom --> MsiExec.exe /I{D4134B0B-EA9B-4835-A77A-60BEE6277101}
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (2.0.0.13) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NOD32 v3.0.642 FiX1.2 by TemDono (31 days remaining forever up --> "C:\Program Files\ESET\ESET NOD32 Antivirus\unins000.exe"
NVIDIA Drivers --> C:\WINDOWS\system32\nvuninst.exe UninstallGUI
PowerChute plus 5.2 --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Pwrchute\DeIsL1.isu" -c"C:\Program Files\Pwrchute\uninst.dll
Prey --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A785BBA7-3FB9-4D81-BC35-4A2028915ACB}\setup.exe" -l0x9 -removeonly
PunkBuster for Battlefield 1942 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{127B684B-A002-44C8-99A7-6CF8F1E26873}\setup.exe" -l0x9
PunkBuster Services --> C:\WINDOWS\system32\pbsvc.exe -u
QuickTime --> MsiExec.exe /X{C21D5524-A970-42FA-AC8A-59B8C7CDCA31}
Revo Uninstaller 1.71 --> C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe
SoundMAX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\SETUP.exe" -l0x9 -removeonly
Starry Night Pro Plus 6 --> "C:\Program Files\Starry Night Pro Plus 6\Uninstall Starry Night Pro Plus 6\Uninstall Starry Night Pro Plus 6.exe"
TrueCrypt --> "C:\Program Files\TrueCrypt\TrueCrypt Setup.exe" /u
VDOTool 6.1 --> "C:\Program Files\VDOTool\unins000.exe"
VideoLAN VLC media player 0.8.5 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows XP Service Pack 3 --> "C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
World of Warcraft --> C:\Program Files\Common Files\Blizzard Entertainment\World of Warcraft\Uninstall.exe
-- Application Event Log -------------------------------------------------------
Event Record #/Type291 / Error
Event Submitted/Written: 06/30/2008 07:50:57 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application vlc.exe, version 0.8.5.0, faulting module liblibmpeg2_plugin.dll, version 0.0.0.0, fault address 0x000165d1.
Processing media-specific event for [vlc.exe!ws!]
Event Record #/Type290 / Error
Event Submitted/Written: 06/30/2008 07:49:03 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application prevxcsi.exe, version 1.9.112.121, faulting module prevxcsi.exe, version 1.9.112.121, fault address 0x0000caa7.
Processing media-specific event for [prevxcsi.exe!ws!]
Event Record #/Type287 / Error
Event Submitted/Written: 06/29/2008 10:28:54 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application prevxcsi.exe, version 1.9.112.121, faulting module prevxcsi.exe, version 1.9.112.121, fault address 0x0000caa7.
Processing media-specific event for [prevxcsi.exe!ws!]
Event Record #/Type283 / Error
Event Submitted/Written: 06/29/2008 08:15:42 PM
Event ID/Source: 1000 / Application Error
Event Description:
Faulting application notepad.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x00a7000a.
Processing media-specific event for [notepad.exe!ws!]
Event Record #/Type282 / Error
Event Submitted/Written: 06/29/2008 08:13:20 PM
Event ID/Source: 1004 / Application Error
Event Description:
Faulting application lsass.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x009c9377.
Error in creating result PEAP-TLV in response to received PEAP-TLV (lsass.exe!ld!)
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type3472 / Error
Event Submitted/Written: 06/30/2008 09:39:28 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Eset Nod32 Boot service failed to start due to the following error:
%%1053
Event Record #/Type3471 / Error
Event Submitted/Written: 06/30/2008 09:39:28 PM
Event ID/Source: 7009 / Service Control Manager
Event Description:
Timeout (30000 milliseconds) waiting for the Eset Nod32 Boot service to connect.
Event Record #/Type3463 / Error
Event Submitted/Written: 06/30/2008 09:34:28 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1058" attempting to start the service wuauserv with arguments ""
in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}
Event Record #/Type3448 / Error
Event Submitted/Written: 06/30/2008 09:33:49 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Eset Nod32 Boot service failed to start due to the following error:
%%1053
Event Record #/Type3447 / Error
Event Submitted/Written: 06/30/2008 09:33:49 PM
Event ID/Source: 7009 / Service Control Manager
Event Description:
Timeout (30000 milliseconds) waiting for the Eset Nod32 Boot service to connect.
-- End of Deckard's System Scanner: finished at 2008-06-30 21:44:14 ------------
EDITED: As i forgot the 2nd txt file
Edited by Euromir, 30 June 2008 - 04:13 AM.