Need Help with Trojan.Vundo.H and Trojan.BHO [Solved] |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
 Feb 9 2009, 09:08 PM
Post
#1
|
|
|
Member  Posts: 22 OS: XP  |
Hello, I really need help removing Trojan.Vundo.H and Trojan.BHO! Can someone please offer some assistance? Many thanks in advance! Below are my Malwarebytes and Hijack This logs...
Malwarebytes' Anti-Malware 1.30 Database version: 1402 Windows 5.1.2600 Service Pack 3 2/9/2009 9:37:37 PM mbam-log-2009-02-09 (21-37-37).txt Scan type: Quick Scan Objects scanned: 58886 Time elapsed: 17 minute(s), 10 second(s) Memory Processes Infected: 0 Memory Modules Infected: 3 Registry Keys Infected: 5 Registry Values Infected: 5 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 7 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\yizofuyu.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\hiwumeku.dll (Trojan.Vundo.H) -> Delete on reboot. c:\WINDOWS\system32\diwevari.dll (Trojan.BHO) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\487e6780 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm4b4d541c (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wipinebiju (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: c:\windows\system32\diwevari.dll -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: system32\diwevari.dll -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\hiwumeku.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ukemuwih.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mizuyoha.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ahoyuzim.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\yizofuyu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uyufoziy.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. c:\WINDOWS\system32\diwevari.dll (Trojan.BHO) -> Delete on reboot. Hijack This log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:05:49 PM, on 2/9/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\Program Files\Palm\Hotsync.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\Program Files\SlimServer\SlimTray.exe C:\Program Files\WoFi\wofi.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\SlimServer\server\slim.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: {051e9286-50bf-88fb-7cc4-11c047e56ba2} - {2ab65e74-0c11-4cc7-bf88-fb056829e150} - C:\WINDOWS\system32\bkwoui.dll O2 - BHO: (no name) - {4B0D0D0F-C0FE-48E4-938D-5E7A809E20A4} - C:\WINDOWS\system32\nnnLedBs.dll (file missing) O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: (no name) - {6FE62B86-B62C-4C06-8BEB-5BA86510B9C2} - C:\WINDOWS\system32\jkKeDsPI.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: (no name) - {f020802e-bf6a-49dd-9648-7748a44a46b7} - C:\WINDOWS\system32\mohohimu.dll (file missing) O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [AV-Update-9] "C:\Program Files\Symantec AntiVirus\vpdn_lu.exe" /s O4 - HKLM\..\Run: [LiveUpdate Runner] "C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [wipinebiju] Rundll32.exe "C:\WINDOWS\system32\kefuguhi.dll",s O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-19\..\Run: [wipinebiju] Rundll32.exe "C:\WINDOWS\system32\kefuguhi.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [wipinebiju] Rundll32.exe "C:\WINDOWS\system32\kefuguhi.dll",s (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: Shortcut to wofi.exe.lnk = C:\Program Files\WoFi\wofi.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: SlimServer Tray Tool.lnk = C:\Program Files\SlimServer\SlimTray.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134596730281 O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab O20 - AppInit_DLLs: mzyikg.dll c:\windows\system32\pivojobe.dll C:\WINDOWS\system32\jisagade.dll bkwoui.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SlimServer (slimsvc) - Unknown owner - C:\Program Files\SlimServer\server\slim.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 12458 bytes |
 |
 
|
|
Feb 10 2009, 12:17 AM
Post
#2
|
|
 Trusted Helper  Posts: 9,275 OS: Windows XP |
Hello, my name is fenzodahl512 and welcome to Geekstogo.. Please do the following....
Please download RSIT by random/random and save it to your Desktop.
NEXT Please download GMER and unzip it to your Desktop.
Post me these logs in your next reply.. Post each log in separate post.. 1. RSIT log.txt 2. RSIT info.txt 3. Attach GMER result.. |
|
|
|
|
Feb 10 2009, 11:13 PM
Post
#3
|
|
|
Member Posts: 22 OS: XP |
fenzodahl512: thanks so much for your help. i am unable to run the GMER application. every time i hit "Scan", it automatically reboots my computer and i can't save any logs. in any case, here is the log.txt from the RSIT application
Logfile of random's system information tool 1.05 (written by random/random) Run by Ronaldo Garces at 2009-02-11 00:11:38 Microsoft Windows XP Professional Service Pack 3 System drive C: has 13 GB (17%) free of 76 GB Total RAM: 502 MB (20% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:11:45 AM, on 2/11/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\SlimServer\server\slim.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apoint2K\Apntex.exe C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\Program Files\Palm\Hotsync.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\Program Files\SlimServer\SlimTray.exe C:\Program Files\WoFi\wofi.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Ronaldo Garces\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Ronaldo Garces.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: (no name) - {4B0D0D0F-C0FE-48E4-938D-5E7A809E20A4} - C:\WINDOWS\system32\nnnLedBs.dll (file missing) O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: (no name) - {6FE62B86-B62C-4C06-8BEB-5BA86510B9C2} - C:\WINDOWS\system32\jkKeDsPI.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: (no name) - {f020802e-bf6a-49dd-9648-7748a44a46b7} - C:\WINDOWS\system32\mohohimu.dll (file missing) O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [AV-Update-9] "C:\Program Files\Symantec AntiVirus\vpdn_lu.exe" /s O4 - HKLM\..\Run: [LiveUpdate Runner] "C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [wipinebiju] Rundll32.exe "C:\WINDOWS\system32\kefuguhi.dll",s O4 - HKLM\..\Run: [CPM4b4d541c] Rundll32.exe "c:\windows\system32\dafanose.dll",a O4 - HKLM\..\Run: [487e6780] rundll32.exe "C:\WINDOWS\system32\mupojuwe.dll",b O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-19\..\Run: [wipinebiju] Rundll32.exe "C:\WINDOWS\system32\kefuguhi.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [wipinebiju] Rundll32.exe "C:\WINDOWS\system32\kefuguhi.dll",s (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: Shortcut to wofi.exe.lnk = C:\Program Files\WoFi\wofi.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: SlimServer Tray Tool.lnk = C:\Program Files\SlimServer\SlimTray.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134596730281 O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab O20 - AppInit_DLLs: mzyikg.dll c:\windows\system32\pivojobe.dll C:\WINDOWS\system32\jisagade.dll zjpubs.dll c:\windows\system32\dafanose.dll O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dafanose.dll O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dafanose.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SlimServer (slimsvc) - Unknown owner - C:\Program Files\SlimServer\server\slim.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 12937 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\fogpsgnl.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] &Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [2008-07-15 880880] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B0D0D0F-C0FE-48E4-938D-5E7A809E20A4}] C:\WINDOWS\system32\nnnLedBs.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}] Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 198136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6FE62B86-B62C-4C06-8BEB-5BA86510B9C2}] C:\WINDOWS\system32\jkKeDsPI.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-16 737776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}] SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll [2008-07-15 160496] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [2008-07-15 880880] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2004-11-02 155648] "HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2004-11-02 126976] "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-08-24 88363] "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544] "SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-08-06 860160] "Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2004-11-23 163840] "UpdateManager"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-08-19 110592] "eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [2004-11-01 290816] "hpWirelessAssistant"=C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe [2004-12-08 790528] "vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2004-08-02 124232] "AV-Update-9"=C:\Program Files\Symantec AntiVirus\vpdn_lu.exe [2004-08-02 79176] "LiveUpdate Runner"=C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe [2004-10-14 290816] "HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2005-02-16 49152] "SunServer"=C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [2005-11-11 290816] "ISUSPM"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe -scheduler [] "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [2004-03-04 172032] "HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-01-15 37376] "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-10 289064] "CPM4b4d541c"=c:\windows\system32\dafanose.dll [2009-02-10 108141] "487e6780"=C:\WINDOWS\system32\mupojuwe.dll [2009-02-10 102156] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2006-11-30 4662776] "OfotoNow USB Detection"=C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL [2002-11-05 77824] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-14 68856] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrust PestPatrol Active Protection] none [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2005-05-29 118784] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE [2005-09-23 29696] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe HotSync Manager.lnk - C:\Program Files\Palm\Hotsync.exe LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe SlimServer Tray Tool.lnk - C:\Program Files\SlimServer\SlimTray.exe C:\Documents and Settings\Ronaldo Garces\Start Menu\Programs\Startup Shortcut to wofi.exe.lnk - C:\Program Files\WoFi\wofi.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="mzyikg.dll c:\windows\system32\pivojobe.dll C:\WINDOWS\system32\jisagade.dll zjpubs.dll c:\windows\system32\dafanose.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxsrvc.dll [2004-11-02 348160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] C:\WINDOWS\system32\NavLogon.dll [2004-08-02 83272] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dafanose.dll [2009-02-10 108141] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler] STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\dafanose.dll [2009-02-10 108141] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{076394AD-7FDD-44EF-A075-32C68DBAB99B}"=C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunExecuteHook.dll [2005-11-11 49152] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"=scecli C:\WINDOWS\system32\jisagade.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "DisableCAD"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer" "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"="C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe:*:Enabled:DesktopWeather4" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger" "C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader" "C:\Program Files\Symantec\LiveUpdate\LuComServer.EXE"="C:\Program Files\Symantec\LiveUpdate\LuComServer.EXE:*:Enabled:LiveUpdate Engine COM Module" "C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb" "C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray" "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui" "C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon" "C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:rundll32" "C:\Program Files\CA\eTrustITM\InoRpc.exe"="C:\Program Files\CA\eTrustITM\InoRpc.exe:*:Enabled:eTrust ITM - RPC Service" "C:\Program Files\CA\eTrustITM\Realmon.exe"="C:\Program Files\CA\eTrustITM\Realmon.exe:*:Enabled:eTrust ITM - Realtime monitor" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5997b78a-fa0d-11dc-b18f-0012f05e1fbf}] shell\AutoRun\command - wdsync.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1c05e84-93e4-11db-b0b8-0012f05e1fbf}] shell\AutoRun\command - E:\LaunchU3.exe -a ======List of files/folders created in the last 3 months====== 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\zelayira.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\sikasiso.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\muturebe.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\mupojuwe.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\lilofati.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\juyadewi.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\funesabo.dll 65535-65535-31889 379:31889:443 ----ASH---- C:\WINDOWS\system32\dafanose.dll 2009-02-10 23:43:50 ----D---- C:\WINDOWS\Minidump 2009-02-10 23:38:22 ----A---- C:\WINDOWS\gmer.ini 2009-02-10 23:38:13 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2009-02-10 23:38:12 ----A---- C:\WINDOWS\gmer.dll 2009-02-10 23:38:11 ----A---- C:\WINDOWS\gmer.exe 2009-02-10 23:33:29 ----D---- C:\rsit 2009-02-10 19:41:09 ----SH---- C:\WINDOWS\system32\pinoteye.dll 2009-02-10 19:40:29 ----SH---- C:\WINDOWS\system32\ewujopum.ini 2009-02-10 19:40:06 ----ASH---- C:\WINDOWS\system32\zjpubs.dll 2009-02-09 21:17:09 ----ASH---- C:\WINDOWS\system32\bkwoui.dll 2009-02-07 16:17:45 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$ 2009-02-07 16:17:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$ 2009-02-07 16:15:38 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2009-02-07 16:13:41 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2009-02-07 16:13:17 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2009-02-07 15:47:38 ----D---- C:\WINDOWS\ERDNT 2009-02-07 15:47:02 ----D---- C:\Program Files\ERUNT 2009-02-07 14:29:04 ----SH---- C:\WINDOWS\system32\yubihimo.dll 2009-02-07 14:27:28 ----ASH---- C:\WINDOWS\system32\pvjsej.dll 2009-02-05 23:31:12 ----D---- C:\Program Files\Trend Micro 2009-02-05 21:47:05 ----ASH---- C:\WINDOWS\system32\xqfzxs.dll 2008-12-28 18:54:38 ----SH---- C:\WINDOWS\system32\kekiyala.exe 2008-12-19 13:13:27 ----A---- C:\WINDOWS\system32\dhhzxn.txt 2008-12-11 23:04:59 ----SHD---- C:\Config.Msi 2008-12-07 22:06:40 ----SH---- C:\WINDOWS\system32\eyidawel.ini 2008-12-07 21:34:10 ----SHD---- C:\WINDOWS\Um9uYWxkbyBHYXJjZXM 2008-12-07 21:23:51 ----D---- C:\Documents and Settings\Ronaldo Garces\Application Data\Twain 2008-12-07 21:12:43 ----A---- C:\WINDOWS\system32\digeste.dll 2008-11-16 20:31:15 ----D---- C:\Documents and Settings\Ronaldo Garces\Application Data\Malwarebytes 2008-11-16 20:30:46 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-11-16 20:30:46 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-11-16 20:23:07 ----A---- C:\WINDOWS\system32\435da3fe-.txt 2008-11-14 00:10:52 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$ 2008-11-14 00:09:49 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$ 2008-11-14 00:07:43 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$ ======List of files/folders modified in the last 3 months====== 2009-02-11 00:10:03 ----D---- C:\WINDOWS\Prefetch 2009-02-11 00:02:44 ----D---- C:\Program Files\Mozilla Firefox 2009-02-10 23:59:52 ----D---- C:\Program Files\Symantec AntiVirus 2009-02-10 23:58:58 ----D---- C:\WINDOWS\Temp 2009-02-10 23:54:53 ----D---- C:\WINDOWS 2009-02-10 23:38:13 ----D---- C:\WINDOWS\system32\drivers 2009-02-10 20:00:02 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-02-10 19:41:09 ----D---- C:\WINDOWS\system32 2009-02-07 16:25:13 ----D---- C:\Program Files\Internet Explorer 2009-02-07 16:17:52 ----HD---- C:\WINDOWS\inf 2009-02-07 16:17:50 ----RSHD---- C:\WINDOWS\system32\dllcache 2009-02-07 16:17:38 ----HD---- C:\WINDOWS\$hf_mig$ 2009-02-07 16:17:29 ----A---- C:\WINDOWS\imsins.BAK 2009-02-07 16:17:09 ----SHD---- C:\WINDOWS\Installer 2009-02-07 16:10:12 ----A---- C:\WINDOWS\win.ini 2009-02-07 16:05:29 ----D---- C:\WINDOWS\system32\CatRoot2 2009-02-07 15:47:02 ----RD---- C:\Program Files 2009-02-05 21:44:07 ----A---- C:\WINDOWS\hpbafd.ini 2008-12-23 23:34:47 ----ASH---- C:\WINDOWS\system32\vupivino.dll 2008-12-17 13:19:57 ----ASH---- C:\WINDOWS\system32\zavuvuhi.dll 2008-12-17 13:19:57 ----ASH---- C:\WINDOWS\system32\rowewaya.dll 2008-12-17 12:57:23 ----ASH---- C:\WINDOWS\system32\buguretu.dll 2008-12-17 12:57:19 ----ASH---- C:\WINDOWS\system32\tiyezuwo.dll 2008-12-17 00:37:04 ----ASH---- C:\WINDOWS\system32\jedemeja.dll 2008-12-17 00:37:03 ----ASH---- C:\WINDOWS\system32\sikefilo.dll 2008-12-15 16:35:49 ----ASH---- C:\WINDOWS\system32\yatiroku.dll 2008-12-15 16:35:49 ----ASH---- C:\WINDOWS\system32\hapojute.dll 2008-12-15 16:35:48 ----ASH---- C:\WINDOWS\system32\wenevowe.dll 2008-12-15 04:36:37 ----ASH---- C:\WINDOWS\system32\tuyodoha.dll 2008-12-15 04:36:37 ----ASH---- C:\WINDOWS\system32\bupozeje.dll 2008-12-14 16:36:16 ----ASH---- C:\WINDOWS\system32\tuhemoye.dll 2008-12-14 01:10:55 ----ASH---- C:\WINDOWS\system32\gurohodo.dll 2008-12-13 15:45:51 ----D---- C:\Program Files\Common Files 2008-12-13 15:44:52 ----D---- C:\Program Files\CA 2008-12-13 01:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll 2008-12-11 23:15:17 ----D---- C:\Program Files\Java 2008-12-11 22:33:05 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-11 08:05:22 ----ASH---- C:\WINDOWS\system32\guyubaha.dll 2008-12-10 20:05:15 ----ASH---- C:\WINDOWS\system32\jekizaha.dll 2008-12-10 08:05:04 ----ASH---- C:\WINDOWS\system32\yezamase.dll 2008-12-08 22:13:44 ----ASH---- C:\WINDOWS\system32\futukaku.dll 2008-12-08 21:15:29 ----ASH---- C:\WINDOWS\system32\zediteda.dll 2008-12-08 21:15:29 ----ASH---- C:\WINDOWS\system32\sefilowi.dll 2008-12-07 22:06:35 ----ASH---- C:\WINDOWS\system32\wuganabu.dll 2008-12-07 21:13:26 ----SD---- C:\WINDOWS\Tasks 2008-11-14 00:06:16 ----D---- C:\WINDOWS\WinSxS ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567] R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352] R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys [] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832] R2 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys [] R2 SbcpHid;SbcpHid; \??\C:\WINDOWS\system32\Drivers\SbcpHid.sys [] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-10-06 129280] R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-08-24 1268204] R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-11-10 105831] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952] R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-01-29 16168] R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-11-02 773565] R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\naveng.sys [] R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\navex15.sys [] R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-06-28 69760] R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232] R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648] R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS [] R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2004-11-17 147840] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2004-09-20 3210496] S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2004-12-16 55320] S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys [] S3 gmer;gmer; C:\WINDOWS\System32\DRIVERS\gmer.sys [2009-02-10 85969] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100] S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2005-12-23 16694] S3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584] S3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-08-17 35913] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-10 32000] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-10 116040] R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376] R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2004-08-02 30024] R2 iGateway;iTechnology iGateway 4.2; C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe [2007-02-05 106496] R2 InoRPC;eTrust ITM RPC Service; C:\Program Files\CA\eTrustITM\InoRpc.exe [2008-02-08 198472] R2 InoTask;eTrust ITM Job Service; C:\Program Files\CA\eTrustITM\InoTask.exe [2008-02-08 386888] R2 ITMRTSVC;CA Pest Patrol Realtime Protection Service; C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe [2007-09-05 283912] R2 slimsvc;SlimServer; C:\Program Files\SlimServer\server\slim.exe [2006-09-20 6352963] R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056] R2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2004-08-02 1267024] R3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\SHARED\HPQWMI.exe [2004-11-18 98304] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-10 532264] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 138168] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2004-08-02 173392] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336] -----------------EOF----------------- |
|
|
|
|
Feb 10 2009, 11:27 PM
Post
#4
|
|
|
Trusted Helper Posts: 9,275 OS: Windows XP |
QUOTE i am unable to run the GMER application. every time i hit "Scan", it automatically reboots my computer and i can't save any logs. That doesn't sounds good.. Lets do this.... Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix.. Please visit HERE if you don't know how.. Please re-enable them back after performing all steps given.. Please download ComboFix by sUBs from HERE or HERE or HERE and save it to your Desktop. During the download, rename Combofix to Combo-Fix as follows:   It is important you rename Combofix during the download, but not after. **NOTE: If you are using Firefox, make sure that your download settings are as follows:
After that, double-click and run Combo-Fix. Let it finish its job and post the log here If ComboFix asked you to install Recovery Console, please do so.. It will be your best interest.. Note: DON'T do anything with your computer while ComboFix is running.. Let ComboFix finishes its job.. |
|
|
|
|
Feb 11 2009, 12:36 AM
Post
#5
|
|
|
Member Posts: 22 OS: XP |
OK, here is my Combo-Fix log:
ComboFix 09-02-10.02 - Ronaldo Garces 2009-02-11 1:01:20.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.138 [GMT -5:00] Running from: c:\documents and settings\Ronaldo Garces\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Ronaldo Garces\Desktop\Combo-Fix.exe AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Ronaldo Garces\Local Settings\Temporary Internet Files\CPV.stt c:\documents and settings\Ronaldo Garces\Local Settings\Temporary Internet Files\fbk.sts c:\windows\system32\bkwoui.dll c:\windows\system32\buguretu.dll c:\windows\system32\bupozeje.dll c:\windows\system32\dafanose.dll c:\windows\system32\digeste.dll c:\windows\system32\ewujopum.ini c:\windows\system32\eyidawel.ini c:\windows\system32\funesabo.dll c:\windows\system32\futukaku.dll c:\windows\system32\gurohodo.dll c:\windows\system32\guyubaha.dll c:\windows\system32\hapojute.dll c:\windows\system32\jedemeja.dll c:\windows\system32\jekizaha.dll c:\windows\system32\jisagade.dll c:\windows\system32\juyadewi.dll c:\windows\system32\lilofati.dll c:\windows\system32\mupojuwe.dll c:\windows\system32\muturebe.dll c:\windows\system32\paradise.dll c:\windows\system32\pvjsej.dll c:\windows\system32\rowewaya.dll c:\windows\system32\sefilowi.dll c:\windows\system32\sikasiso.dll c:\windows\system32\sikefilo.dll c:\windows\system32\tiyezuwo.dll c:\windows\system32\tuhemoye.dll c:\windows\system32\tuyodoha.dll c:\windows\system32\vupivino.dll c:\windows\system32\wenevowe.dll c:\windows\system32\wuganabu.dll c:\windows\system32\xqfzxs.dll c:\windows\system32\yatiroku.dll c:\windows\system32\yezamase.dll c:\windows\system32\zavuvuhi.dll c:\windows\system32\zediteda.dll c:\windows\system32\zelayira.dll c:\windows\system32\zjpubs.dll c:\windows\Tasks\fogpsgnl.job c:\windows\wiaserviv.log . ((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 ))))))))))))))))))))))))))))))) . 2009-02-10 23:38 . 2009-02-11 00:12 250 --a------ c:\windows\gmer.ini 2009-02-10 23:33 . 2009-02-10 23:34 <DIR> d-------- C:\rsit 2009-02-10 19:41 . 2009-02-10 19:41 2,713 ---hs---- c:\windows\system32\pinoteye.dll 2009-02-07 15:47 . 2009-02-07 15:47 <DIR> d-------- c:\program files\ERUNT 2009-02-07 14:29 . 2009-02-07 14:29 2,713 ---hs---- c:\windows\system32\yubihimo.dll 2009-02-05 23:31 . 2009-02-05 23:31 <DIR> d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-11 06:12 --------- d-----w c:\program files\Symantec AntiVirus 2008-12-28 23:54 2,713 --sh--w c:\windows\system32\kekiyala.exe 2008-12-13 20:44 --------- d-----w c:\program files\CA 2008-12-13 06:40 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll 2008-12-12 04:15 --------- d-----w c:\program files\Java 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys 2006-02-25 05:33 57,304 -c--a-w c:\documents and settings\Ronaldo Garces\Application Data\GDIPFONTCACHEV1.DAT 2008-11-09 22:57 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-11-09 22:57 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-11-09 22:57 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-11-09 22:57 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-11-09 22:57 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2008-09-09 02:15 88,576 --sha-w c:\windows\system32\gepuyedu.dll 2008-09-24 04:34 11,264 --sha-w c:\windows\system32\jogejase.dll 2008-08-20 23:01 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082020080821\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 4662776] "OfotoNow USB Detection"="c:\progra~1\Ofoto\OfotoNow\OFUSBS.DLL" [2002-11-05 77824] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816] "hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-08-02 124232] "AV-Update-9"="c:\program files\Symantec AntiVirus\vpdn_lu.exe" [2004-08-02 79176] "LiveUpdate Runner"="c:\program files\LiveUpdate Runner\GSB_NAV_LU.exe" [2004-10-14 290816] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "SunServer"="c:\program files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe" [2005-11-11 290816] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064] "AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 c:\windows\AGRSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968] c:\documents and settings\Ronaldo Garces\Start Menu\Programs\Startup\ Shortcut to wofi.exe.lnk - c:\program files\WoFi\wofi.exe [2004-11-08 1515585] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2004-06-09 471040] LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-03-01 57344] SlimServer Tray Tool.lnk - c:\program files\SlimServer\SlimTray.exe [2006-04-25 1183813] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrust PestPatrol Active Protection] none [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2005-05-29 13:01 118784 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Symantec\\LiveUpdate\\LuComServer.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\CA\\eTrustITM\\InoRpc.exe"= "c:\\Program Files\\CA\\eTrustITM\\Realmon.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9000:TCP"= 9000:TCP:SlimServer 9000 tcp "3483:UDP"= 3483:UDP:SlimServer 3483 udp "3483:TCP"= 3483:TCP:SlimServer 3483 tcp "67:UDP"= 67:UDP:0.0.0.0/255.255.255.255:Enabled:DHCP Discovery Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) --- Other Services/Drivers In Memory --- *Deregistered* - Netman *Deregistered* - Nla *Deregistered* - PolicyAgent *Deregistered* - ProtectedStorage *Deregistered* - RasMan *Deregistered* - RemoteRegistry *Deregistered* - RpcSs *Deregistered* - SamSs *Deregistered* - Schedule *Deregistered* - seclogon *Deregistered* - SENS *Deregistered* - SharedAccess *Deregistered* - ShellHWDetection *Deregistered* - slimsvc *Deregistered* - SoundMAX Agent Service (default) *Deregistered* - Spooler *Deregistered* - srservice *Deregistered* - SSDPSRV *Deregistered* - Symantec AntiVirus *Deregistered* - TapiSrv *Deregistered* - TermService *Deregistered* - Themes *Deregistered* - TrkWks *Deregistered* - W32Time *Deregistered* - WebClient *Deregistered* - winmgmt *Deregistered* - wscsvc *Deregistered* - wuauserv *Deregistered* - WZCSVC [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5997b78a-fa0d-11dc-b18f-0012f05e1fbf}] \Shell\AutoRun\command - wdsync.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1c05e84-93e4-11db-b0b8-0012f05e1fbf}] \Shell\AutoRun\command - E:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . - - - - ORPHANS REMOVED - - - - BHO-{4B0D0D0F-C0FE-48E4-938D-5E7A809E20A4} - c:\windows\system32\nnnLedBs.dll BHO-{6FE62B86-B62C-4C06-8BEB-5BA86510B9C2} - c:\windows\system32\jkKeDsPI.dll BHO-{f020802e-bf6a-49dd-9648-7748a44a46b7} - c:\windows\system32\mohohimu.dll HKLM-Run-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe HKLM-Run-wipinebiju - c:\windows\system32\kefuguhi.dll MSConfigStartUp-MimBoot - c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm FF - ProfilePath - c:\documents and settings\Ronaldo Garces\Application Data\Mozilla\Firefox\Profiles\tygqru1x.a\ FF - prefs.js: keyword.URL - about:neterror?e=query&u= FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-11 01:11:06 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{11B5C8DC-3FEA-1682-D4F0355518481497}\{414E0745-768E-27E6-1A22BEEA50FFC306}\{0F77990A-A8C5-E83C-A2DEB9098A2A23DE}*] "YKBG4FY6MRBLZHWNMN5KORGMPA1"=hex:01,00,01,00,00,00,00,00,da,37,90,89,91,09,97, 9b,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(768) c:\program files\CA\SharedComponents\PPRealtime\bin\CACheck.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CAHook.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CAServer.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\program files\CA\SharedComponents\iTechnology\igateway.exe c:\program files\CA\eTrustITM\InoRpc.exe c:\program files\CA\eTrustITM\InoTask.exe c:\windows\system32\rundll32.exe c:\program files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe c:\program files\SlimServer\server\slim.exe c:\program files\Apoint2K\ApntEx.exe c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Symantec AntiVirus\Rtvscan.exe c:\program files\CA\eTrustITM\Ppcl.exe c:\program files\CA\eTrustITM\Ppcl.exe c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe c:\progra~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe c:\program files\iPod\bin\iPodService.exe c:\program files\HPQ\Shared\hpqwmi.exe c:\windows\system32\wscntfy.exe c:\windows\SoftwareDistribution\Download\Install\windows-kb890830-v2.6.exe c:\6f4591199d2e3d23f6a8f497d397e76e\mrtstub.exe c:\windows\system32\MRT.exe . ************************************************************************** . Completion time: 2009-02-11 1:28:09 - machine was rebooted [Ronaldo Garces] ComboFix-quarantined-files.txt 2009-02-11 06:27:38 Pre-Run: 13,353,582,592 bytes free Post-Run: 13,734,400,000 bytes free 275 --- E O F --- 2008-11-14 05:14:52 |
|
|
|
|
Feb 11 2009, 01:25 AM
Post
#6
|
|
|
Trusted Helper Posts: 9,275 OS: Windows XP |
1. Please open Notepad
2. Now copy/paste the entire content of the codebox below into the Notepad window: CODE KillAll:: File:: c:\windows\system32\pinoteye.dll c:\windows\system32\yubihimo.dll c:\windows\system32\kekiyala.exe c:\windows\system32\gepuyedu.dll c:\windows\system32\jogejase.dll RegNull:: [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{11B5C8DC-3FEA-1682-D4F0355518481497}\{414E0745-768E-27E6-1A22BEEA50FFC306}\{0F77990A-A8C5-E83C-A2DEB9098A2A23DE}*] RegLock:: [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{11B5C8DC-3FEA-1682-D4F0355518481497}\{414E0745-768E-27E6-1A22BEEA50FFC306}\{0F77990A-A8C5-E83C-A2DEB9098A2A23DE}*] Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5997b78a-fa0d-11dc-b18f-0012f05e1fbf}] 3. Save the above as CFScript.txt 4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.  5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
|
|
|
|
|
Feb 11 2009, 09:04 PM
Post
#7
|
|
|
Member Posts: 22 OS: XP |
Here is the latest Combo-Fix log after following your instructions....
ComboFix 09-02-11.02 - Ronaldo Garces 2009-02-11 21:20:39.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.126 [GMT -5:00] Running from: c:\documents and settings\Ronaldo Garces\Desktop\Combo-Fix.exe Command switches used :: c:\documents and settings\Ronaldo Garces\Desktop\CFScript.txt AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) * Created a new restore point FILE :: c:\windows\system32\gepuyedu.dll c:\windows\system32\jogejase.dll c:\windows\system32\kekiyala.exe c:\windows\system32\pinoteye.dll c:\windows\system32\yubihimo.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\gepuyedu.dll c:\windows\system32\jogejase.dll c:\windows\system32\kekiyala.exe c:\windows\system32\pinoteye.dll c:\windows\system32\yubihimo.dll . ((((((((((((((((((((((((( Files Created from 2009-01-12 to 2009-02-12 ))))))))))))))))))))))))))))))) . 2009-02-10 23:38 . 2009-02-11 00:12 250 --a------ c:\windows\gmer.ini 2009-02-10 23:33 . 2009-02-10 23:34 <DIR> d-------- C:\rsit 2009-02-07 15:47 . 2009-02-07 15:47 <DIR> d-------- c:\program files\ERUNT 2009-02-05 23:31 . 2009-02-05 23:31 <DIR> d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-12 02:30 --------- d-----w c:\program files\Symantec AntiVirus 2008-12-13 20:44 --------- d-----w c:\program files\CA 2008-12-12 04:15 --------- d-----w c:\program files\Java 2006-02-25 05:33 57,304 -c--a-w c:\documents and settings\Ronaldo Garces\Application Data\GDIPFONTCACHEV1.DAT 2008-11-09 22:57 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-11-09 22:57 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-11-09 22:57 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-11-09 22:57 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-11-09 22:57 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2008-08-20 23:01 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082020080821\index.dat . ((((((((((((((((((((((((((((( SnapShot@2009-02-11_ 1.23.55.10 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-16 20:38:34 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll + 2008-10-16 20:38:34 347,136 -c----w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll + 2008-10-16 20:38:34 214,528 -c----w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll + 2008-10-16 20:38:35 133,120 -c----w c:\windows\ie7updates\KB961260-IE7\extmgr.dll + 2008-10-16 20:38:35 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll + 2008-10-16 13:11:09 70,656 -c----w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe + 2008-10-16 20:38:35 153,088 -c----w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll + 2008-10-16 20:38:35 230,400 -c----w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll + 2008-10-15 07:04:53 161,792 -c----w c:\windows\ie7updates\KB961260-IE7\ieakui.dll + 2008-10-16 20:38:35 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll + 2008-10-16 20:38:35 384,512 -c----w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll + 2008-10-16 20:38:37 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll + 2008-10-16 20:38:37 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\iernonce.dll + 2008-10-16 20:38:37 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll + 2008-10-16 13:11:09 13,824 -c----w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe + 2008-10-15 07:06:26 633,632 -c----w c:\windows\ie7updates\KB961260-IE7\iexplore.exe + 2008-10-16 20:38:37 27,648 -c----w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll + 2008-10-16 20:38:37 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll + 2008-10-16 20:38:37 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll + 2008-12-13 06:40:02 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll + 2008-10-16 20:38:38 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll + 2008-10-16 20:38:38 193,024 -c----w c:\windows\ie7updates\KB961260-IE7\msrating.dll + 2008-10-16 20:38:39 671,232 -c----w c:\windows\ie7updates\KB961260-IE7\mstime.dll + 2008-10-16 20:38:39 102,912 -c----w c:\windows\ie7updates\KB961260-IE7\occache.dll + 2008-10-16 20:38:39 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll + 2007-03-06 01:22:41 213,216 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll + 2008-10-16 20:38:39 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll + 2008-10-16 20:38:39 1,160,192 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll + 2008-10-16 20:38:39 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll + 2008-10-16 20:38:40 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll - 2009-02-07 21:16:59 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2009-02-11 06:58:51 593,920 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2009-02-07 21:16:59 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2009-02-11 06:58:51 12,288 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2009-02-07 21:17:00 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2009-02-11 06:58:51 86,016 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2009-02-07 21:16:58 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe + 2009-02-11 06:58:51 135,168 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe - 2009-02-07 21:17:00 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2009-02-11 06:58:51 11,264 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2009-02-07 21:17:00 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2009-02-11 06:58:51 27,136 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2009-02-07 21:17:00 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2009-02-11 06:58:51 4,096 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2009-02-07 21:17:00 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2009-02-11 06:58:51 794,624 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2009-02-07 21:16:59 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2009-02-11 06:58:51 249,856 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2009-02-07 21:16:59 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2009-02-11 06:58:51 61,440 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2009-02-07 21:17:00 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2009-02-11 06:58:51 23,040 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2009-02-07 21:16:58 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2009-02-11 06:58:50 286,720 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2009-02-07 21:16:57 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2009-02-11 06:58:50 409,600 ----a-r c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe - 2008-10-16 20:38:34 124,928 ----a-w c:\windows\system32\advpack.dll + 2008-12-20 23:15:11 124,928 ----a-w c:\windows\system32\advpack.dll - 2008-10-16 20:38:34 124,928 ------w c:\windows\system32\dllcache\advpack.dll + 2008-12-20 23:15:11 124,928 ------w c:\windows\system32\dllcache\advpack.dll - 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll + 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll - 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll + 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll - 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll + 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll - 2008-10-16 20:38:35 63,488 ------w c:\windows\system32\dllcache\icardie.dll + 2008-12-20 23:15:13 63,488 ------w c:\windows\system32\dllcache\icardie.dll - 2008-10-16 13:11:09 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe + 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe - 2008-10-16 20:38:35 153,088 ----a-w c:\windows\system32\dllcache\ieakeng.dll + 2008-12-20 23:15:14 153,088 ----a-w c:\windows\system32\dllcache\ieakeng.dll - 2008-10-16 20:38:35 230,400 ----a-w c:\windows\system32\dllcache\ieaksie.dll + 2008-12-20 23:15:14 230,400 ----a-w c:\windows\system32\dllcache\ieaksie.dll - 2008-10-15 07:04:53 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll + 2008-12-19 05:23:56 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll - 2008-10-16 20:38:35 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll + 2008-12-20 23:15:15 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll - 2008-10-16 20:38:35 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll + 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll - 2008-10-16 20:38:37 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll + 2008-12-20 23:15:21 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll - 2008-10-16 20:38:37 44,544 ----a-w c:\windows\system32\dllcache\iernonce.dll + 2008-12-20 23:15:21 44,544 ----a-w c:\windows\system32\dllcache\iernonce.dll - 2008-10-16 20:38:37 267,776 ------w c:\windows\system32\dllcache\iertutil.dll + 2008-12-20 23:15:22 267,776 ------w c:\windows\system32\dllcache\iertutil.dll - 2008-10-16 13:11:09 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe + 2008-12-19 09:10:15 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe - 2008-10-15 07:06:26 633,632 ------w c:\windows\system32\dllcache\iexplore.exe + 2008-12-19 05:25:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe - 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\dllcache\jsproxy.dll + 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\dllcache\jsproxy.dll - 2008-10-16 20:38:37 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll + 2008-12-20 23:15:23 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll - 2008-10-16 20:38:37 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll + 2008-12-20 23:15:24 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll - 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll + 2009-01-17 02:35:14 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll - 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll + 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll - 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll + 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll - 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll + 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll - 2008-10-16 20:38:39 102,912 ------w c:\windows\system32\dllcache\occache.dll + 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\dllcache\occache.dll - 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll + 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll - 2008-10-16 20:38:39 105,984 ------w c:\windows\system32\dllcache\url.dll + 2008-12-20 23:15:39 105,984 ------w c:\windows\system32\dllcache\url.dll - 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll + 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll - 2008-10-16 20:38:39 233,472 ------w c:\windows\system32\dllcache\webcheck.dll + 2008-12-20 23:15:40 233,472 ------w c:\windows\system32\dllcache\webcheck.dll - 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll + 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll - 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dxtmsft.dll + 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dxtmsft.dll - 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dxtrans.dll + 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dxtrans.dll - 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\extmgr.dll + 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\extmgr.dll - 2008-10-16 20:38:35 63,488 ----a-w c:\windows\system32\icardie.dll + 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll - 2008-10-16 13:11:09 70,656 ----a-w c:\windows\system32\ie4uinit.exe + 2008-12-19 09:10:15 70,656 ----a-w c:\windows\system32\ie4uinit.exe - 2008-10-16 20:38:35 153,088 ----a-w c:\windows\system32\ieakeng.dll + 2008-12-20 23:15:14 153,088 ----a-w c:\windows\system32\ieakeng.dll - 2008-10-16 20:38:35 230,400 ----a-w c:\windows\system32\ieaksie.dll + 2008-12-20 23:15:14 230,400 ----a-w c:\windows\system32\ieaksie.dll - 2008-10-15 07:04:53 161,792 ----a-w c:\windows\system32\ieakui.dll + 2008-12-19 05:23:56 161,792 ----a-w c:\windows\system32\ieakui.dll - 2008-10-16 20:38:35 383,488 ----a-w c:\windows\system32\ieapfltr.dll + 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll - 2008-10-16 20:38:35 384,512 ----a-w c:\windows\system32\iedkcs32.dll + 2008-12-20 23:15:16 384,512 ----a-w c:\windows\system32\iedkcs32.dll - 2008-10-16 20:38:37 6,066,176 ----a-w c:\windows\system32\ieframe.dll + 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll - 2008-10-16 20:38:37 44,544 ----a-w c:\windows\system32\iernonce.dll + 2008-12-20 23:15:21 44,544 ----a-w c:\windows\system32\iernonce.dll - 2008-10-16 20:38:37 267,776 ----a-w c:\windows\system32\iertutil.dll + 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll - 2008-10-16 13:11:09 13,824 ----a-w c:\windows\system32\ieudinit.exe + 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe - 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\jsproxy.dll + 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\jsproxy.dll + 2009-02-03 23:21:12 21,244,864 ----a-w c:\windows\system32\MRT.exe - 2008-10-16 20:38:37 459,264 ----a-w c:\windows\system32\msfeeds.dll + 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll - 2008-10-16 20:38:37 52,224 ----a-w c:\windows\system32\msfeedsbs.dll + 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll - 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll + 2009-01-17 02:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll - 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\mshtmled.dll + 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\mshtmled.dll - 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\msrating.dll + 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\msrating.dll - 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\mstime.dll + 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\mstime.dll - 2008-10-16 20:38:39 102,912 ----a-w c:\windows\system32\occache.dll + 2008-12-20 23:15:38 102,912 ----a-w c:\windows\system32\occache.dll - 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\pngfilt.dll + 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll - 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll + 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll - 2008-10-16 20:38:39 105,984 ----a-w c:\windows\system32\url.dll + 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll - 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\urlmon.dll + 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll - 2008-10-16 20:38:39 233,472 ----a-w c:\windows\system32\webcheck.dll + 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll - 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\wininet.dll + 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\wininet.dll - 2006-06-03 00:51:22 20,585 ----a-w c:\windows\Temp\pdk-SYSTEM\0a6b9f23e356336cc61530f586d0c66a.dll + 2009-02-12 02:27:42 20,585 ----a-w c:\windows\temp\pdk-SYSTEM\0a6b9f23e356336cc61530f586d0c66a.dll - 2006-11-28 05:27:21 36,947 ----a-w c:\windows\Temp\pdk-SYSTEM\12913763d8b9f06d2ca82771fcb306f1.dll + 2009-02-12 02:27:18 36,947 ----a-w c:\windows\temp\pdk-SYSTEM\12913763d8b9f06d2ca82771fcb306f1.dll - 2006-06-03 00:51:20 135,270 ----a-w c:\windows\Temp\pdk-SYSTEM\14f8cfecb15e1c87916789ed739489ff.dll + 2009-02-12 02:27:16 135,270 ----a-w c:\windows\temp\pdk-SYSTEM\14f8cfecb15e1c87916789ed739489ff.dll - 2006-06-03 00:51:11 815,185 ----a-w c:\windows\Temp\pdk-SYSTEM\153a64f0fbf1d066acccc90bb95e9471\perl58.dll + 2009-02-12 02:27:02 815,185 ----a-w c:\windows\temp\pdk-SYSTEM\153a64f0fbf1d066acccc90bb95e9471\perl58.dll - 2006-06-03 00:51:24 28,787 ----a-w c:\windows\Temp\pdk-SYSTEM\1ff4eae997b1753d848dbbc61d1b4345.dll + 2009-02-12 02:27:44 28,787 ----a-w c:\windows\temp\pdk-SYSTEM\1ff4eae997b1753d848dbbc61d1b4345.dll - 2006-06-03 00:51:22 28,789 ----a-w c:\windows\Temp\pdk-SYSTEM\2758cf0ee5bce4a7e7d6d67fdef35a5c.dll + 2009-02-12 02:27:44 28,789 ----a-w c:\windows\temp\pdk-SYSTEM\2758cf0ee5bce4a7e7d6d67fdef35a5c.dll - 2006-06-03 00:51:26 24,674 ----a-w c:\windows\Temp\pdk-SYSTEM\28346940eba36fc46322570b50d2b195.dll + 2009-02-12 02:27:42 24,674 ----a-w c:\windows\temp\pdk-SYSTEM\28346940eba36fc46322570b50d2b195.dll - 2006-06-03 00:51:32 36,981 ----a-w c:\windows\Temp\pdk-SYSTEM\31aa023220b46a62dd91739a3bf1cad4.dll + 2009-02-12 02:27:46 36,981 ----a-w c:\windows\temp\pdk-SYSTEM\31aa023220b46a62dd91739a3bf1cad4.dll - 2006-06-03 00:51:18 24,676 ----a-w c:\windows\Temp\pdk-SYSTEM\3e6257c5b8794b602831302202435191.dll + 2009-02-12 02:27:05 24,676 ----a-w c:\windows\temp\pdk-SYSTEM\3e6257c5b8794b602831302202435191.dll - 2006-06-03 00:51:15 20,571 ----a-w c:\windows\Temp\pdk-SYSTEM\42db37dadb779dbfc5da8bdd7ec61c52.dll + 2009-02-12 02:27:04 20,571 ----a-w c:\windows\temp\pdk-SYSTEM\42db37dadb779dbfc5da8bdd7ec61c52.dll - 2006-06-03 00:51:16 24,671 ----a-w c:\windows\Temp\pdk-SYSTEM\44abde5de65f3f034faac2c132713018.dll + 2009-02-12 02:27:25 24,671 ----a-w c:\windows\temp\pdk-SYSTEM\44abde5de65f3f034faac2c132713018.dll - 2006-11-28 05:27:22 28,753 ----a-w c:\windows\Temp\pdk-SYSTEM\514f58c7649fa1fe7afd0239e90bf91d.dll + 2009-02-12 02:27:21 28,753 ----a-w c:\windows\temp\pdk-SYSTEM\514f58c7649fa1fe7afd0239e90bf91d.dll - 2006-11-28 05:27:24 41,057 ----a-w c:\windows\Temp\pdk-SYSTEM\563d7ead40b59c49009856a0b10f2014.dll + 2009-02-12 02:27:47 41,057 ----a-w c:\windows\temp\pdk-SYSTEM\563d7ead40b59c49009856a0b10f2014.dll - 2006-06-03 00:51:30 24,678 ----a-w c:\windows\Temp\pdk-SYSTEM\65ee15dd41d41d736095c39cfb2dabf4.dll + 2009-02-12 02:27:47 24,678 ----a-w c:\windows\temp\pdk-SYSTEM\65ee15dd41d41d736095c39cfb2dabf4.dll - 2006-11-28 05:27:24 24,675 ----a-w c:\windows\Temp\pdk-SYSTEM\68db54950c135a8a2cde3d852ea088a7.dll + 2009-02-12 02:27:47 24,675 ----a-w c:\windows\temp\pdk-SYSTEM\68db54950c135a8a2cde3d852ea088a7.dll - 2006-11-28 05:27:21 90,197 ----a-w c:\windows\Temp\pdk-SYSTEM\6ecc81286663495601d2499da7def595.dll + 2009-02-12 02:27:20 90,197 ----a-w c:\windows\temp\pdk-SYSTEM\6ecc81286663495601d2499da7def595.dll - 2006-11-28 05:27:24 28,789 ----a-w c:\windows\Temp\pdk-SYSTEM\6ff5ba62c2c8ffbb41cd01ca7bd320b9.dll + 2009-02-12 02:27:48 28,789 ----a-w c:\windows\temp\pdk-SYSTEM\6ff5ba62c2c8ffbb41cd01ca7bd320b9.dll - 2006-06-03 00:51:22 28,770 ----a-w c:\windows\Temp\pdk-SYSTEM\74e6ec5afd643b837bcbd5fe1b782d14.dll + 2009-02-12 02:27:07 28,770 ----a-w c:\windows\temp\pdk-SYSTEM\74e6ec5afd643b837bcbd5fe1b782d14.dll - 2006-11-28 05:27:22 819,261 ----a-w c:\windows\Temp\pdk-SYSTEM\7718c08cc46695fc3fef36d1131eac8d.dll + 2009-02-12 02:27:28 819,261 ----a-w c:\windows\temp\pdk-SYSTEM\7718c08cc46695fc3fef36d1131eac8d.dll - 2006-06-03 00:51:31 77,941 ----a-w c:\windows\Temp\pdk-SYSTEM\7aace6f21e4c397996b145b7fd777643.dll + 2009-02-12 02:27:46 77,941 ----a-w c:\windows\temp\pdk-SYSTEM\7aace6f21e4c397996b145b7fd777643.dll - 2006-11-28 05:27:20 94,273 ----a-w c:\windows\Temp\pdk-SYSTEM\83825bab2f1245392ffe1ddd2c76e79a.dll + 2009-02-12 02:27:06 94,273 ----a-w c:\windows\temp\pdk-SYSTEM\83825bab2f1245392ffe1ddd2c76e79a.dll - 2006-06-03 00:51:15 24,665 ----a-w c:\windows\Temp\pdk-SYSTEM\89f4ac43ba2b792785d9d472365e562b.dll + 2009-02-12 02:27:19 24,665 ----a-w c:\windows\temp\pdk-SYSTEM\89f4ac43ba2b792785d9d472365e562b.dll - 2006-06-03 00:51:23 90,219 ----a-w c:\windows\Temp\pdk-SYSTEM\8bdc4ac58d38d74758621bae60c442dd.dll + 2009-02-12 02:27:36 90,219 ----a-w c:\windows\temp\pdk-SYSTEM\8bdc4ac58d38d74758621bae60c442dd.dll - 2006-11-28 05:27:21 1,040,497 ----a-w c:\windows\Temp\pdk-SYSTEM\a507fccf2be25b878761a66bf411c201.dll + 2009-02-12 02:27:10 1,040,497 ----a-w c:\windows\temp\pdk-SYSTEM\a507fccf2be25b878761a66bf411c201.dll - 2006-06-03 00:51:27 61,541 ----a-w c:\windows\Temp\pdk-SYSTEM\a82e393a53225f1b0dc6684e29bca26e.dll + 2009-02-12 02:27:45 61,541 ----a-w c:\windows\temp\pdk-SYSTEM\a82e393a53225f1b0dc6684e29bca26e.dll - 2006-06-03 00:51:17 77,919 ----a-w c:\windows\Temp\pdk-SYSTEM\a9c7de63b69d830a701d23bbc35654dd.dll + 2009-02-12 02:27:04 77,919 ----a-w c:\windows\temp\pdk-SYSTEM\a9c7de63b69d830a701d23bbc35654dd.dll - 2006-06-03 00:51:23 32,879 ----a-w c:\windows\Temp\pdk-SYSTEM\ad76515ff4d1de346e3888790190a3c0.dll + 2009-02-12 02:27:43 32,879 ----a-w c:\windows\temp\pdk-SYSTEM\ad76515ff4d1de346e3888790190a3c0.dll - 2006-06-03 00:51:24 28,767 ----a-w c:\windows\Temp\pdk-SYSTEM\b2774d247dfbf0abe8539e577ee59b4c.dll + 2009-02-12 02:27:05 28,767 ----a-w c:\windows\temp\pdk-SYSTEM\b2774d247dfbf0abe8539e577ee59b4c.dll - 2006-11-28 05:27:22 94,295 ----a-w c:\windows\Temp\pdk-SYSTEM\c0c390c1bbdeadf59743dcdb575dca53.dll + 2009-02-12 02:27:24 94,295 ----a-w c:\windows\temp\pdk-SYSTEM\c0c390c1bbdeadf59743dcdb575dca53.dll - 2006-06-03 00:51:31 110,692 ----a-w c:\windows\Temp\pdk-SYSTEM\c81819cb5f049996acebd0d8a2373cbd.dll + 2009-02-12 02:27:41 110,692 ----a-w c:\windows\temp\pdk-SYSTEM\c81819cb5f049996acebd0d8a2373cbd.dll - 2006-11-28 05:27:22 131,149 ----a-w c:\windows\Temp\pdk-SYSTEM\c92f1c7d4396f53f4c5d352e2bd8c9a9.dll + 2009-02-12 02:27:23 131,149 ----a-w c:\windows\temp\pdk-SYSTEM\c92f1c7d4396f53f4c5d352e2bd8c9a9.dll - 2006-06-03 00:51:25 24,682 ----a-w c:\windows\Temp\pdk-SYSTEM\ca6e90333b4a1d9ff7897185a9c2159a.dll + 2009-02-12 02:27:35 24,682 ----a-w c:\windows\temp\pdk-SYSTEM\ca6e90333b4a1d9ff7897185a9c2159a.dll - 2006-06-03 00:51:25 32,865 ----a-w c:\windows\Temp\pdk-SYSTEM\ce0c35d75c9f9a78bae922a7136085a3.dll + 2009-02-12 02:27:35 32,865 ----a-w c:\windows\temp\pdk-SYSTEM\ce0c35d75c9f9a78bae922a7136085a3.dll - 2006-06-03 00:51:17 28,769 ----a-w c:\windows\Temp\pdk-SYSTEM\d0cf1a27febe069dbf6359c284848111.dll + 2009-02-12 02:27:33 28,769 ----a-w c:\windows\temp\pdk-SYSTEM\d0cf1a27febe069dbf6359c284848111.dll - 2006-11-28 05:27:23 20,589 ----a-w c:\windows\Temp\pdk-SYSTEM\ddcaac9d951e32b0a08117ff42c97079.dll + 2009-02-12 02:27:43 20,589 ----a-w c:\windows\temp\pdk-SYSTEM\ddcaac9d951e32b0a08117ff42c97079.dll - 2006-11-28 05:27:52 28,762 ----a-w c:\windows\Temp\pdk-SYSTEM\f664af759eb93584084bc5e436e46e61.dll + 2009-02-12 02:28:07 28,762 ----a-w c:\windows\temp\pdk-SYSTEM\f664af759eb93584084bc5e436e46e61.dll - 2006-11-28 05:27:22 20,567 ----a-w c:\windows\Temp\pdk-SYSTEM\fa142febd5dc53f93f911452e1a99387.dll + 2009-02-12 02:27:32 20,567 ----a-w c:\windows\temp\pdk-SYSTEM\fa142febd5dc53f93f911452e1a99387.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 4662776] "OfotoNow USB Detection"="c:\progra~1\Ofoto\OfotoNow\OFUSBS.DLL" [2002-11-05 77824] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-07-27 1388544] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-11-23 163840] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-11-01 290816] "hpWirelessAssistant"="c:\program files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 790528] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-08-02 124232] "AV-Update-9"="c:\program files\Symantec AntiVirus\vpdn_lu.exe" [2004-08-02 79176] "LiveUpdate Runner"="c:\program files\LiveUpdate Runner\GSB_NAV_LU.exe" [2004-10-14 290816] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152] "SunServer"="c:\program files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe" [2005-11-11 290816] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064] "AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 c:\windows\AGRSMMSG.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968] c:\documents and settings\Ronaldo Garces\Start Menu\Programs\Startup\ Shortcut to wofi.exe.lnk - c:\program files\WoFi\wofi.exe [2004-11-08 1515585] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] HotSync Manager.lnk - c:\program files\Palm\Hotsync.exe [2004-06-09 471040] LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-03-01 57344] SlimServer Tray Tool.lnk - c:\program files\SlimServer\SlimTray.exe [2006-04-25 1183813] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrust PestPatrol Active Protection] none [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2005-05-29 13:01 118784 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Symantec\\LiveUpdate\\LuComServer.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\CA\\eTrustITM\\InoRpc.exe"= "c:\\Program Files\\CA\\eTrustITM\\Realmon.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9000:TCP"= 9000:TCP:SlimServer 9000 tcp "3483:UDP"= 3483:UDP:SlimServer 3483 udp "3483:TCP"= 3483:TCP:SlimServer 3483 tcp "67:UDP"= 67:UDP:0.0.0.0/255.255.255.255:Enabled:DHCP Discovery Service [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) --- Other Services/Drivers In Memory --- *Deregistered* - Netman *Deregistered* - Nla *Deregistered* - PolicyAgent *Deregistered* - ProtectedStorage *Deregistered* - RasMan *Deregistered* - RemoteRegistry *Deregistered* - RpcSs *Deregistered* - SamSs *Deregistered* - Schedule *Deregistered* - seclogon *Deregistered* - SENS *Deregistered* - SharedAccess *Deregistered* - ShellHWDetection *Deregistered* - slimsvc *Deregistered* - SoundMAX Agent Service (default) *Deregistered* - Spooler *Deregistered* - srservice *Deregistered* - SSDPSRV *Deregistered* - Symantec AntiVirus *Deregistered* - TapiSrv *Deregistered* - TermService *Deregistered* - Themes *Deregistered* - TrkWks *Deregistered* - W32Time *Deregistered* - WebClient *Deregistered* - winmgmt *Deregistered* - wscsvc *Deregistered* - wuauserv *Deregistered* - WZCSVC [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1c05e84-93e4-11db-b0b8-0012f05e1fbf}] \Shell\AutoRun\command - E:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder 2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie mStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm FF - ProfilePath - c:\documents and settings\Ronaldo Garces\Application Data\Mozilla\Firefox\Profiles\tygqru1x.a\ FF - prefs.js: keyword.URL - about:neterror?e=query&u= FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-11 21:28:35 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(804) c:\program files\CA\SharedComponents\PPRealtime\bin\CACheck.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CAHook.dll c:\program files\CA\SharedComponents\PPRealtime\bin\CAServer.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\program files\CA\SharedComponents\iTechnology\igateway.exe c:\program files\CA\eTrustITM\InoRpc.exe c:\program files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe c:\program files\SlimServer\server\slim.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Symantec AntiVirus\Rtvscan.exe c:\windows\system32\rundll32.exe c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE c:\program files\Apoint2K\ApntEx.exe c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe c:\progra~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe c:\program files\iPod\bin\iPodService.exe c:\program files\HPQ\Shared\hpqwmi.exe . ************************************************************************** . Completion time: 2009-02-11 21:38:03 - machine was rebooted ComboFix-quarantined-files.txt 2009-02-12 02:37:57 ComboFix2.txt 2009-02-11 06:28:12 Pre-Run: 13,545,963,520 bytes free Post-Run: 13,545,836,544 bytes free 467 --- E O F --- 2009-02-11 07:01:06 |
|
|
|
|
Feb 11 2009, 09:06 PM
Post
#8
|
|
|
Member Posts: 22 OS: XP |
and here is my latest HijackThis log...
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:05:23 PM, on 2/11/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\SlimServer\server\slim.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\Program Files\SlimServer\SlimTray.exe C:\Program Files\WoFi\wofi.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [AV-Update-9] "C:\Program Files\Symantec AntiVirus\vpdn_lu.exe" /s O4 - HKLM\..\Run: [LiveUpdate Runner] "C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: Shortcut to wofi.exe.lnk = C:\Program Files\WoFi\wofi.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: SlimServer Tray Tool.lnk = C:\Program Files\SlimServer\SlimTray.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134596730281 O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SlimServer (slimsvc) - Unknown owner - C:\Program Files\SlimServer\server\slim.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 11169 bytes |
|
|
|
|
Feb 11 2009, 10:08 PM
Post
#9
|
|
|
Trusted Helper Posts: 9,275 OS: Windows XP |
Looks a lot better.. Lets do this....
Please download CleanUp! by stevengould.org and save it to your Desktop.
Please run a free online scan with the ESET Online Scanner Note: You will need to use Internet Explorer for this scan.
How's the computer now? 
|
|
|
|
|
Feb 12 2009, 09:59 PM
Post
#10
|
|
|
Member Posts: 22 OS: XP |
Are we getting close? Here is the ESET log...
# version=4 # OnlineScanner.ocx=1.0.0.635 # OnlineScannerDLLA.dll=1, 0, 0, 79 # OnlineScannerDLLW.dll=1, 0, 0, 78 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3846 (20090211) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=6ef303251ac6ff4dbd8c0373d410aaab # end=finished # remove_checked=true # unwanted_checked=true # utc_time=2009-02-12 05:49:06 # local_time=2009-02-12 12:49:06 (-0500, Eastern Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=313254 # found=8 # scan_time=5316 C:\Qoobox\Quarantine\C\WINDOWS\system32\buguretu.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\digeste.dll.vir a variant of Win32/Kryptik.DE trojan (unable to clean - deleted) 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\jisagade.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\rowewaya.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\sefilowi.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\sikefilo.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\vupivino.dll.vir Win32/Adware.Virtumonde application (unable to clean - deleted) 00000000000000000000000000000000 C:\WINDOWS\system32\mst122.dll Win32/TrojanDownloader.Small.ODO trojan (unable to clean - deleted) 00000000000000000000000000000000 |
|
|
|
|
Feb 12 2009, 11:03 PM
Post
#11
|
|
|
Trusted Helper Posts: 9,275 OS: Windows XP |
Looks good to me.. Lets do some cleanup...
Please download OTCleanIt and save it to Desktop.
Please read these excellent articles by miekiemoes : Help! My computer is slow! How to prevent Malware Please reply to this thread once more and tell us about the computer behaviour before we can close this thread Have a safe and happy computing day! Regards fenzodahl512 |
|
|
|
|
Feb 13 2009, 12:22 PM
Post
#12
|
|
|
Member Posts: 22 OS: XP |
Before I ran OTCleanit, this weird pop-up appeared and something called Microsoft Anti-Spamware started scanning my computer. I could not close out of it, so I brought up the Task Manager and ended the process. Then my computer randomly rebooted. After windows restarted, there was an error dialogue box that said: "msas2009.exe had trouble starting" or something like that. Is this another malware virus?
Thanks for your all your help. |
|
|
|
|
Feb 13 2009, 01:08 PM
Post
#13
|
|
|
Trusted Helper Posts: 9,275 OS: Windows XP |
That's malware.. Could be new infection.. Please run RSIT again and post the log here
|
|
|
|
|
Feb 16 2009, 07:37 AM
Post
#14
|
|
|
Member Posts: 22 OS: XP |
what's weird now is that the wireless connectivity on the computer is really slow and even weirder is that I cannot access Geekstogo.com on the browser. When I click on our forum link, it gives me an error message saying that the link is broken. So I have to use a different machine to post this message. What happened???
Here is the RSIT log: Logfile of random's system information tool 1.05 (written by random/random) Run by Ronaldo Garces at 2009-02-16 08:20:00 Microsoft Windows XP Professional Service Pack 3 System drive C: has 11 GB (15%) free of 76 GB Total RAM: 502 MB (44% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:20:15 AM, on 2/16/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Apoint2K\Apntex.exe C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Palm\Hotsync.exe C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe C:\Program Files\SlimServer\SlimTray.exe C:\Program Files\WoFi\wofi.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\SlimServer\server\slim.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\nuhle6.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Ronaldo Garces\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Ronaldo Garces.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: C:\WINDOWS\system32\hsfd83jfdg.dll - {C5BF49A2-94F3-42BD-F434-3604812C8955} - C:\WINDOWS\system32\hsfd83jfdg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start O4 - HKLM\..\Run: [hpWirelessAssistant] "%ProgramFiles%\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [AV-Update-9] "C:\Program Files\Symantec AntiVirus\vpdn_lu.exe" /s O4 - HKLM\..\Run: [LiveUpdate Runner] "C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\winlognn.exe O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\winlognn.exe O4 - HKCU\..\Run: [tezrtsjhfr84iusjfo84f] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\csrssc.exe O4 - HKCU\..\Run: [ze6x9bx05f2td1idatugbmubjm62pss8vz7wv8tj] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\nyjl8r51uwl4.exe O4 - HKCU\..\Run: [ilbbjmrkajvq34zwlwm8gwuitopvcexd9] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\o3ug0ccsyxnu.exe O4 - HKCU\..\Run: [vy2e8ecasrez92cxy3w3y5k23cxdjwt] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\eopnx3.exe O4 - HKCU\..\Run: [d46c9ow1vylr6mj7q5yiifkpno1vy5058] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\lns378mp1lo.exe O4 - HKCU\..\Run: [pdsjtggfybj6ldpqs3lgv5lk1baec6] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\nuhle6.exe O4 - HKCU\..\Run: [e2g001zta1] C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\x2j1x7tc5r9.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Startup: Shortcut to wofi.exe.lnk = C:\Program Files\WoFi\wofi.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: SlimServer Tray Tool.lnk = C:\Program Files\SlimServer\SlimTray.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper200711281.dll O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1134596730281 O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - C:\WINDOWS\system32\hsfd83jfdg.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: SlimServer (slimsvc) - Unknown owner - C:\Program Files\SlimServer\server\slim.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 11815 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5BF49A2-94F3-42BD-F434-3604812C8955}] C:\WINDOWS\system32\hsfd83jfdg.dll - C:\WINDOWS\system32\hsfd83jfdg.dll [2009-02-12 15000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2004-11-02 155648] "HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2004-11-02 126976] "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-08-24 88363] "SoundMAXPnP"=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544] "Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2004-11-23 163840] "UpdateManager"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-08-19 110592] "eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe [2004-11-01 290816] "hpWirelessAssistant"=C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant.exe [2004-12-08 790528] "vptray"=C:\PROGRA~1\SYMANT~1\VPTray.exe [2004-08-02 124232] "AV-Update-9"=C:\Program Files\Symantec AntiVirus\vpdn_lu.exe [2004-08-02 79176] "LiveUpdate Runner"=C:\Program Files\LiveUpdate Runner\GSB_NAV_LU.exe [2004-10-14 290816] "HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [2005-02-16 49152] "SunServer"=C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [2005-11-11 290816] "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [2004-03-04 172032] "HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-12-22 241664] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-01-15 37376] "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040] "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-10 289064] "jsf8uiw3jnjgffght"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\winlognn.exe [2009-02-12 15000] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2006-11-30 4662776] "OfotoNow USB Detection"=C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL [2002-11-05 77824] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-14 68856] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472] "jsf8uiw3jnjgffght"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\winlognn.exe [2009-02-12 15000] "tezrtsjhfr84iusjfo84f"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\csrssc.exe [2009-02-13 23041] "ze6x9bx05f2td1idatugbmubjm62pss8vz7wv8tj"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\nyjl8r51uwl4.exe [] "ilbbjmrkajvq34zwlwm8gwuitopvcexd9"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\o3ug0ccsyxnu.exe [] "vy2e8ecasrez92cxy3w3y5k23cxdjwt"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\eopnx3.exe [2009-02-15 22017] "d46c9ow1vylr6mj7q5yiifkpno1vy5058"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\lns378mp1lo.exe [] "pdsjtggfybj6ldpqs3lgv5lk1baec6"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\nuhle6.exe [2009-02-16 22017] "e2g001zta1"=C:\DOCUME~1\RONALD~1\LOCALS~1\Temp\x2j1x7tc5r9.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrust PestPatrol Active Protection] none [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2005-05-29 118784] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE [2005-09-23 29696] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe HotSync Manager.lnk - C:\Program Files\Palm\Hotsync.exe LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe SlimServer Tray Tool.lnk - C:\Program Files\SlimServer\SlimTray.exe C:\Documents and Settings\Ronaldo Garces\Start Menu\Programs\Startup Shortcut to wofi.exe.lnk - C:\Program Files\WoFi\wofi.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxsrvc.dll [2004-11-02 348160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon] C:\WINDOWS\system32\NavLogon.dll [2004-08-02 83272] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler] jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - C:\WINDOWS\system32\hsfd83jfdg.dll [2009-02-12 15000] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "DisableCAD"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoDriveAutoRun"=67108863 "NoDrives"=0 "NoFolderOptions"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer" "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger" "C:\Program Files\Symantec\LiveUpdate\LuComServer.EXE"="C:\Program Files\Symantec\LiveUpdate\LuComServer.EXE:*:Enabled:LiveUpdate Engine COM Module" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\CA\eTrustITM\InoRpc.exe"="C:\Program Files\CA\eTrustITM\InoRpc.exe:*:Enabled:eTrust ITM - RPC Service" "C:\Program Files\CA\eTrustITM\Realmon.exe"="C:\Program Files\CA\eTrustITM\Realmon.exe:*:Enabled:eTrust ITM - Realtime monitor" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b1c05e84-93e4-11db-b0b8-0012f05e1fbf}] shell\AutoRun\command - E:\LaunchU3.exe -a ======List of files/folders created in the last 3 months====== 2009-02-16 08:20:00 ----D---- C:\rsit 2009-02-12 23:38:33 ----A---- C:\WINDOWS\system32\hsfd83jfdg.dll 2009-02-12 23:38:09 ----A---- C:\WINDOWS\system32.exe 2009-02-12 23:38:07 ----A---- C:\WINDOWS\kernel32.exe 2009-02-12 23:37:49 ----D---- C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd 2009-02-11 23:17:54 ----D---- C:\Program Files\EsetOnlineScanner 2009-02-11 23:12:34 ----SHD---- C:\RECYCLER 2009-02-11 23:10:23 ----D---- C:\Program Files\CleanUp! 2009-02-11 21:24:32 ----D---- C:\WINDOWS\temp 2009-02-11 01:57:57 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$ 2009-02-11 01:16:19 ----A---- C:\WINDOWS\system32\MRT.exe 2009-02-11 00:49:48 ----A---- C:\Boot.bak 2009-02-11 00:49:26 ----D---- C:\cmdcons 2009-02-10 23:43:50 ----D---- C:\WINDOWS\Minidump 2009-02-07 16:17:45 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$ 2009-02-07 16:17:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$ 2009-02-07 16:15:38 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2009-02-07 16:13:41 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2009-02-07 16:13:17 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2009-02-07 15:47:38 ----D---- C:\WINDOWS\ERDNT 2009-02-07 15:47:02 ----D---- C:\Program Files\ERUNT 2009-02-05 23:31:12 ----D---- C:\Program Files\Trend Micro 2008-12-19 13:13:27 ----A---- C:\WINDOWS\system32\dhhzxn.txt 2008-12-11 23:04:59 ----SHD---- C:\Config.Msi 2008-12-07 21:34:10 ----SHD---- C:\WINDOWS\Um9uYWxkbyBHYXJjZXM 2008-12-07 21:23:51 ----D---- C:\Documents and Settings\Ronaldo Garces\Application Data\Twain ======List of files/folders modified in the last 3 months====== 2009-02-16 08:11:35 ----D---- C:\Program Files\Mozilla Firefox 2009-02-16 07:59:06 ----D---- C:\Program Files\Symantec AntiVirus 2009-02-16 07:59:03 ----D---- C:\WINDOWS\system32 2009-02-16 07:58:24 ----D---- C:\WINDOWS\system32\drivers 2009-02-16 00:04:54 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-02-16 00:00:29 ----D---- C:\Program Files\Yahoo! 2009-02-15 23:38:38 ----D---- C:\WINDOWS\Prefetch 2009-02-13 01:26:11 ----A---- C:\WINDOWS\hpbafd.ini 2009-02-13 00:07:47 ----D---- C:\WINDOWS 2009-02-11 23:17:54 ----RD---- C:\Program Files 2009-02-11 23:17:47 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-02-11 21:36:09 ----D---- C:\WINDOWS\system32\CatRoot2 2009-02-11 21:28:58 ----A---- C:\WINDOWS\system.ini 2009-02-11 21:23:09 ----D---- C:\WINDOWS\AppPatch 2009-02-11 21:22:51 ----D---- C:\Program Files\Common Files 2009-02-11 01:58:56 ----SHD---- C:\WINDOWS\Installer 2009-02-11 01:58:02 ----HD---- C:\WINDOWS\inf 2009-02-11 01:57:56 ----HD---- C:\WINDOWS\$hf_mig$ 2009-02-11 01:57:53 ----A---- C:\WINDOWS\imsins.BAK 2009-02-11 01:57:35 ----RSHD---- C:\WINDOWS\system32\dllcache 2009-02-11 01:57:30 ----D---- C:\Program Files\Internet Explorer 2009-02-11 01:06:48 ----D---- C:\WINDOWS\system32\config 2009-02-11 01:03:17 ----SD---- C:\WINDOWS\Tasks 2009-02-11 00:49:52 ----RASH---- C:\boot.ini 2009-02-07 16:15:49 ----D---- C:\WINDOWS\ie7updates 2009-02-07 16:10:12 ----A---- C:\WINDOWS\win.ini 2009-01-16 21:35:14 ----A---- C:\WINDOWS\system32\mshtml.dll 2008-12-20 18:15:41 ----A---- C:\WINDOWS\system32\wininet.dll 2008-12-20 18:15:40 ----A---- C:\WINDOWS\system32\webcheck.dll 2008-12-20 18:15:40 ----A---- C:\WINDOWS\system32\urlmon.dll 2008-12-20 18:15:39 ----A---- C:\WINDOWS\system32\url.dll 2008-12-20 18:15:38 ----A---- C:\WINDOWS\system32\pngfilt.dll 2008-12-20 18:15:38 ----A---- C:\WINDOWS\system32\occache.dll 2008-12-20 18:15:32 ----A---- C:\WINDOWS\system32\mstime.dll 2008-12-20 18:15:31 ----A---- C:\WINDOWS\system32\msrating.dll 2008-12-20 18:15:30 ----A---- C:\WINDOWS\system32\mshtmled.dll 2008-12-20 18:15:24 ----A---- C:\WINDOWS\system32\msfeedsbs.dll 2008-12-20 18:15:23 ----A---- C:\WINDOWS\system32\msfeeds.dll 2008-12-20 18:15:23 ----A---- C:\WINDOWS\system32\jsproxy.dll 2008-12-20 18:15:22 ----A---- C:\WINDOWS\system32\iertutil.dll 2008-12-20 18:15:21 ----A---- C:\WINDOWS\system32\iernonce.dll 2008-12-20 18:15:21 ----A---- C:\WINDOWS\system32\ieframe.dll 2008-12-20 18:15:16 ----A---- C:\WINDOWS\system32\iedkcs32.dll 2008-12-20 18:15:15 ----A---- C:\WINDOWS\system32\ieapfltr.dll 2008-12-20 18:15:14 ----A---- C:\WINDOWS\system32\ieaksie.dll 2008-12-20 18:15:14 ----A---- C:\WINDOWS\system32\ieakeng.dll 2008-12-20 18:15:13 ----A---- C:\WINDOWS\system32\icardie.dll 2008-12-20 18:15:13 ----A---- C:\WINDOWS\system32\extmgr.dll 2008-12-20 18:15:13 ----A---- C:\WINDOWS\system32\dxtrans.dll 2008-12-20 18:15:12 ----A---- C:\WINDOWS\system32\dxtmsft.dll 2008-12-20 18:15:11 ----A---- C:\WINDOWS\system32\advpack.dll 2008-12-19 04:10:15 ----A---- C:\WINDOWS\system32\ieudinit.exe 2008-12-19 04:10:15 ----A---- C:\WINDOWS\system32\ie4uinit.exe 2008-12-19 00:23:56 ----A---- C:\WINDOWS\system32\ieakui.dll 2008-12-13 15:44:52 ----D---- C:\Program Files\CA 2008-12-11 23:15:17 ----D---- C:\Program Files\Java 2008-12-11 22:33:05 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-07 21:20:15 ----A---- C:\WINDOWS\system32\435da3fe-.txt ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 cdrbsdrv;cdrbsdrv; C:\WINDOWS\system32\drivers\cdrbsdrv.sys [2004-03-08 13567] R1 eabfiltr;EABFiltr; \??\C:\WINDOWS\system32\drivers\EABFiltr.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352] R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys [] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832] R2 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys [] R2 SbcpHid;SbcpHid; \??\C:\WINDOWS\system32\Drivers\SbcpHid.sys [] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-10-06 129280] R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-08-24 1268204] R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-11-10 105831] R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952] R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-01-29 16168] R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-11-02 773565] R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\naveng.sys [] R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\navex15.sys [] R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-06-28 69760] R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232] R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648] R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS [] R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2004-11-17 147840] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2004-09-20 3210496] S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2004-12-16 55320] S3 eabusb;eabusb; \??\C:\WINDOWS\system32\drivers\eabusb.sys [] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100] S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2005-12-23 16694] S3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584] S3 SMCIRDA;SMC IrCC Miniport Device Driver; C:\WINDOWS\system32\DRIVERS\smcirda.sys [2001-08-17 35913] S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-10 32000] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-10 116040] R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376] R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2004-08-02 30024] R2 iGateway;iTechnology iGateway 4.2; C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe [2007-02-05 106496] R2 InoRPC;eTrust ITM RPC Service; C:\Program Files\CA\eTrustITM\InoRpc.exe [2008-02-08 198472] R2 InoTask;eTrust ITM Job Service; C:\Program Files\CA\eTrustITM\InoTask.exe [2008-02-08 386888] R2 ITMRTSVC;CA Pest Patrol Realtime Protection Service; C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe [2007-09-05 283912] R2 slimsvc;SlimServer; C:\Program Files\SlimServer\server\slim.exe [2006-09-20 6352963] R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056] R2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2004-08-02 1267024] R3 hpqwmi;HP WMI Interface; C:\Program Files\HPQ\SHARED\HPQWMI.exe [2004-11-18 98304] R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-10 532264] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 138168] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2004-08-02 173392] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336] -----------------EOF----------------- |
|
|
|
|
Feb 16 2009, 07:38 AM
Post
#15
|
|
|
Member Posts: 22 OS: XP |
And the RSIT info.txt:
info.txt logfile of random's system information tool 1.05 2009-02-16 08:20:24 ======Uninstall list====== -->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 -->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu -->C:\WINDOWS\system32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19} -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Photoshop Album 2.0 Starter Edition-->MsiExec.exe /I{11B569C2-4BF6-4ED0-9D17-A4273943CB24} Adobe Reader 7.0.9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002} Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Agere Systems AC'97 Modem-->agrsmdel ALPS Touch Pad Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}\setup.exe" UNINSTALL AOL Instant Messenger-->C:\Program Files\AIM\uninstll.exe -LOG= C:\Program Files\AIM\install.log -OEM= Apple Mobile Device Support-->MsiExec.exe /I{35B91753-5789-4517-9CF1-2CCE3A8CF4F1} Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3} BUM-->MsiExec.exe /I{55937F00-A69B-4049-8D3A-1C7729742B6F} CA eTrust PestPatrol-->"C:\Program Files\CA\eTrust PestPatrol\ppv5instutil.exe" /shutdownapps /uninstall CA eTrustITM Agent-->MsiExec.exe /X{85F88F9C-6EB2-426B-88AB-28DA4A3526B9} CA iTechnology iGateway-->MsiExec.exe /X{847501DF-07C0-4691-B04A-893929F108AE} Citrix ICA Web Client-->C:\WINDOWS\system32\ctxsetup.exe /uninst C:\PROGRA~1\Citrix\icaweb32\uninst.inf CleanUp!-->C:\Program Files\CleanUp!\uninstall.exe Compaq Presario V4000 User Guides-->C:\WINDOWS\pchealth\helpctr\SYSTEM~1\USERGU~1\UNWISE.EXE C:\WINDOWS\pchealth\helpctr\SYSTEM~1\USERGU~1\INSTALL.LOG Crystal Ball-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Crystal Ball\Uninst.isu" DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe" ESET Online Scanner-->C:\WINDOWS\system32\OnlineScannerUninstaller.exe Google Desktop Search-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSearchSetup.exe -uninstall Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar4.dll" GSB Printers-->C:\WINDOWS\unvise32.exe C:\Program Files\GSB Printers\uninstal.log HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe" Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe" Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" Hoyle Casino 2006 (remove only)-->"C:\Program Files\Encore\Hoyle Casino 2006\uninstall.exe" HP Deskjet 3840-->msiexec /x{B1591C79-1C35-4E09-AA15-F7D6923AFB96} HP Software Update-->MsiExec.exe /X{15EE79F4-4ED1-4267-9B0F-351009325D7D} HP Wireless Assistant-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}\setup.exe" -l0x9 Intel® Graphics Media Accelerator Driver for Mobile-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2792 PCI\VEN_8086&DEV_2592 InterActual Player-->C:\Program Files\InterActual\InterActual Player\inuninst.exe InterVideo WinDVD-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL iTunes-->MsiExec.exe /I{EF6C4600-306D-4F6A-A119-C2A877D25B4A} LiveUpdate 2.0 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U LUMIX Simple Viewer-->C:\Program Files\InstallShield Installation Information\{2CDCCE7E-55D5-40CC-AEA0-ABA54713501F}\setup.exe -runfromtemp -l0x0009 -removeonly Mah Jong Tiles Deluxe-->C:\PROGRA~1\ZONE~1.COM\Mahjong\UNWISE.EXE /U C:\PROGRA~1\ZONE~1.COM\Mahjong\INSTALL.LOG Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp" Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe" Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe" Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9} Microsoft Office XP Media Content-->MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9} Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Mozilla Firefox (2.0.0.17)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSN Music Assistant-->rundll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msninst.inf,Uninstall MSXML 4.0 SP2 (KB925672)-->MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63} MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} muvee autoProducer 3.5 - SE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{37E31FCE-A048-4D8C-B167-31891BCF6585}\setup.exe" -l0x9 Netflix Movie Viewer-->MsiExec.exe /X{BCE72AED-3332-4863-9567-C5DCB9052CA2} OfotoNow-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2875A5F5-E613-4F99-9B47-8882C9DD24A5}\Setup.exe" -l0x9 anything palmOne-->MsiExec.exe /X{FF24F097-D090-41D2-8E9C-BAFEBBFD938C} PalmSource Package Installer 1.5-->C:\Program Files\Palm\PackageInstaller\PackageInstallerUninstall.exe PDFCreator 0.8.0-->C:\Program Files\PDFCreator\unins000.exe PharmaSim #version#-->"C:\Program Files\Interpretive Simulations\PharmaSim\uninstall.exe" PHOTOfunSTUDIO -viewer--->C:\Program Files\InstallShield Installation Information\{9A9DBEBC-C800-4776-A970-D76D6AA405B1}\Setup.exe -runfromtemp -l0x0009Package -removeonly Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe" Quick Launch Buttons 5.00 D5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CEB326EC-8F40-47B2-BA22-BB092565D66F}\setup.exe" -l0x9 -uninst QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175} RAW FILE CONVERTER LE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D680C913-5955-469D-9D88-C1940F7506D6}\SETUP.EXE" -l0x9 RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe" Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe" Security Update for Windows Media Player 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe" Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe" Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe" Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe" Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe" Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe" Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe" Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe" Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe" Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe" Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe" Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe" Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe" SlimServer 6.5.0-->"C:\Program Files\SlimServer\unins000.exe" Sonic RecordNow!-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19} Sonic Update Manager-->MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3} SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe" -l0x9 -removeonly StatPro and SolverTable for Excel-->C:\WINDOWS\system32\unwise32.EXE C:\PROGRA~1\MICROS~4\Office10\Library\StatPro\Install.log StatPro and SolverTable for Excel Sudoku Pack for Palm-->"C:\WINDOWS\epsuninst.exe" "C:\Program Files\Filao\Sudoku Pack for Palm\uninst.dat" Sunbelt CounterSpy-->MsiExec.exe /I{0AD5AD99-6172-4385-8765-385FBE3A1013} SureThing CD Labeler Deluxe 3.0-->C:\WINDOWS\mvuninst\App1\unwise.exe C:\WINDOWS\MVUNINST\APP1\INSTALL.LOG "SureThing CD Labeler Deluxe 3.0 Uninstall" Symantec AntiVirus-->MsiExec.exe /I{848AC794-8B81-440A-81AE-6474337DB527} Texas Instruments PCIxx21/x515 drivers.-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{D71AC256-FA83-45EA-9F14-1B20BB5105C9} /l1033 TextPad 4.7-->MsiExec.exe /X{B510A987-487E-4C66-9F4F-D386AC275715} Time Zone Data Update Tool for Microsoft Office Outlook-->MsiExec.exe /X{95120000-0038-0409-0000-0000000FF1CE} Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe" Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe" UserGuides-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{02E22217-0E96-4C3F-B831-83AA942B7715}\setup.exe" -l0x9 Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Media Player\mtsAxInstaller.exe /u Winamp-->"C:\Program Files\Winamp\UninstWA.exe" Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91} Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 10 Hotfix - KB895316-->"C:\WINDOWS\$NtUninstallKB895316$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe WoFi Tray Application 0.93-->C:\WINDOWS\unvise32.exe C:\Program Files\WoFi\uninstal.log Yahoo! Browser Services-->C:\PROGRA~1\Yahoo!\Common\unyext.exe Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~2.DLL Yahoo! Internet Mail-->C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\ymmapi.dll Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG ZAGAT TO GO for Palm OS-->C:\WINDOWS\unvise32.exe C:\Program Files\Handmark\ZAGAT TO GO for Palm OS\uninstal.log ======Security center information====== AV: Symantec AntiVirus Corporate Edition System event log Computer Name: RGARCES Event Code: 4201 Message: The system detected that network adapter \DEVICE\TCPIP_{1A2F1BCE-839F-4DF2-BCCB-CA309E4EB4C5} was connected to the network, and has initiated normal operation over the network adapter. Record Number: 97570 Source Name: Tcpip Time Written: 20081215022937.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 4201 Message: The system detected that network adapter \DEVICE\TCPIP_{1A2F1BCE-839F-4DF2-BCCB-CA309E4EB4C5} was connected to the network, and has initiated normal operation over the network adapter. Record Number: 97569 Source Name: Tcpip Time Written: 20081215022932.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 4201 Message: The system detected that network adapter \DEVICE\TCPIP_{1A2F1BCE-839F-4DF2-BCCB-CA309E4EB4C5} was connected to the network, and has initiated normal operation over the network adapter. Record Number: 97568 Source Name: Tcpip Time Written: 20081215022928.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 8033 Message: The browser has forced an election on network \Device\NetBT_Tcpip_{1A2F1BCE-839F-4DF2-BCCB-CA309E4EB4C5} because a master browser was stopped. Record Number: 97567 Source Name: BROWSER Time Written: 20081215022925.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 4201 Message: The system detected that network adapter \DEVICE\TCPIP_{1A2F1BCE-839F-4DF2-BCCB-CA309E4EB4C5} was connected to the network, and has initiated normal operation over the network adapter. Record Number: 97566 Source Name: Tcpip Time Written: 20081215022912.000000-300 Event Type: information User: Application event log Computer Name: RGARCES Event Code: 14 Message: Symantec AntiVirus services startup was successful. Record Number: 1076 Source Name: Symantec AntiVirus Time Written: 20071217215905.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 0 Message: Record Number: 1075 Source Name: iPod Service Time Written: 20071217215854.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 100 Message: C:\PROGRA~1\SLIMSE~1\server\Bin\MSWIN3~1\mysqld.exe: ready for connections. Version: '5.0.22-community-nt' socket: '' port: 9092 MySQL Community Edition (GPL) For more information, see Help and Support Center at http://www.mysql.com. Record Number: 1074 Source Name: MySQL Time Written: 20071217215735.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 1800 Message: The Windows Security Center Service has started. Record Number: 1073 Source Name: SecurityCenter Time Written: 20071217215708.000000-300 Event Type: information User: Computer Name: RGARCES Event Code: 0 Message: Record Number: 1072 Source Name: iPod Service Time Written: 20071216195405.000000-300 Event Type: information User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\QuickTime\QTSystem;C:\Program Files\CA\SharedComponents\ScanEngine;C:\Program Files\CA\SharedComponents\CAUpdate;C:\Program Files\CA\SharedComponents\ThirdParty;C:\Program Files\CA\SharedComponents\SubscriptionLicense;C:\Program Files\CA\eTrustITM "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel "PROCESSOR_REVISION"=0d08 "NUMBER_OF_PROCESSORS"=1 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip "CASHCOMP"=C:\Program Files\CA\SharedComponents\ "IGW_LOC"=C:\Program Files\CA\SharedComponents\iTechnology\ "ITMTHIRDPARTY"=C:\Program Files\CA\SharedComponents\ThirdParty\ "ITMLICENSE"=C:\Program Files\CA\SharedComponents\SubscriptionLicense\ "INOCULAN"=C:\Program Files\CA\eTrustITM -----------------EOF----------------- |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
11 / 698 | 22nd December 2008 - 02:14 PM Bob IX started - last by fenzodahl512 |
|||||
 |
62 / 2,682 | 31st January 2009 - 05:00 PM pp111 started - last by JSntgRvr |
|||||
|
11 / 776 | 14th March 2009 - 03:50 AM wishmeluck28d started - last by heir |
|||||
|
30 / 1,082 | 11th July 2009 - 05:15 AM gmanfan started - last by Essexboy |
|||||
|
15 / 336 | 31st July 2009 - 10:15 AM maverixfan started - last by Rorschach112 |
|||||
|
Time is now: 21st November 2009 - 06:07 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising