PC infected, not able to run any control panel functions, most new pro, Unknown infection |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
  |
 Jul 3 2009, 10:10 PM
Post
#1
|
|
|
Member  Posts: 11 OS: Windows XP Pro  |
I am working on a PC that has Trend Micro PC-Cillin installed and kept up to date, however something has managed to slip by. I am unable to open any programs in "Control Panel" and the ones that will start will not stay open for more than a second before closing on their own.
I attempted to follow the Malware and Spyware cleaning guide, and was able to run TFC successfully, however SysRestorePoint, Erunt, and MBAM would not run. I attempted to change the file names of all three as detailed at the bottom of the MBAM instructions, but it had no effect and the programs still would not run. Here are my logs for OTL and Rooter: OTL logfile created on: 7/3/2009 8:49:48 PM - Run 1 OTL by OldTimer - Version 3.0.6.4 Folder = C:\Documents and Settings\HP_Administrator\Desktop\Taz Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.51 Gb Available Physical Memory | 75.80% Memory free 3.85 Gb Paging File | 3.51 Gb Available in Paging File | 91.33% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 270.59 Gb Total Space | 233.51 Gb Free Space | 86.30% Space Free | Partition Type: NTFS Drive D: | 279.46 Gb Total Space | 210.10 Gb Free Space | 75.18% Space Free | Partition Type: NTFS Drive E: | 8.85 Gb Total Space | 0.41 Gb Free Space | 4.58% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive L: | 7.60 Gb Total Space | 7.25 Gb Free Space | 95.33% Space Free | Partition Type: FAT32 Computer Name: MAINPC Current User Name: HP_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe (AVG) PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation) PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe (Intel Corporation) PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation) PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation) PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation) PRC - C:\WINDOWS\System32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\WINDOWS\System32\wscntfy.exe (Microsoft Corporation) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) PRC - C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation) PRC - C:\Program Files\DISC\DiscUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) PRC - C:\WINDOWS\eHome\ehmsas.exe (Microsoft Corporation) PRC - C:\Program Files\HP\HP Software Update\HPwuSchd2.exe (Hewlett-Packard Development Company, L.P.) PRC - C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.) PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Ahead\Ahead\data\Xtras\mssysmgr.exe () PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (Trend Micro Inc.) PRC - C:\WINDOWS\System32\VirtualExpander\VirtualExpander.exe (Sony Corporation) PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) PRC - C:\Program Files\DISC\DiscStreamHub.exe (Digital Interactive Systems Corporation, Inc.) PRC - c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) PRC - C:\Documents and Settings\HP_Administrator\Desktop\Taz\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (AVGIDSAgent [Auto | Stopped]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe (AVG) SRV - (AVGIDSWatcher [Auto | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe (AVG) SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ehRecvr [Auto | Running]) -- C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [Auto | Running]) -- C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation) SRV - (ELService [Auto | Running]) -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation) SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (GoogleDesktopManager-092308-165331 [On_Demand | Stopped]) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IAANTMon [Auto | Running]) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe (Intel Corporation) SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (idsvc [Unknown | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) SRV - (LightScribeService [Auto | Running]) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) SRV - (McrdSvc [Auto | Running]) -- C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation) SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) SRV - (MHN [On_Demand | Stopped]) -- C:\WINDOWS\System32\mhn.dll (Microsoft Corporation) SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (NVSvc [Auto | Running]) -- C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (Pml Driver HPZ12 [Boot | Stopped]) -- C:\WINDOWS\System32\HPZipm12.exe (HP) SRV - (SfCtlCom [Auto | Stopped]) -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe (Trend Micro Inc.) SRV - (TMBMServer [Auto | Stopped]) -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.) SRV - (TmPfw [Auto | Stopped]) -- C:\Program Files\Trend Micro\Internet Security\TmPfw.exe (Trend Micro Inc.) SRV - (TmProxy [Auto | Stopped]) -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe (Trend Micro Inc.) SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (AVGIDSDriver [On_Demand | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys (AVG Technologies ) DRV - (AVGIDSErHr [Boot | Running]) -- C:\WINDOWS\System32\Drivers\AVGIDSErHr.sys (AVG Technologies ) DRV - (AVGIDSFilter [On_Demand | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys (AVG Technologies ) DRV - (AVGIDSShim [On_Demand | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys (AVG Technologies ) DRV - (bb-run [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.) DRV - (CXFALCON [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\cxfalcon.sys (Conexant Systems, Inc.) DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation) DRV - (ELacpi [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ELacpi.sys (Intel Corporation) DRV - (ELhid [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELhid.sys (Intel Corporation) DRV - (ELkbd [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELkbd.sys (Intel Corporation) DRV - (ELmon [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELmon.sys (Intel Corporation) DRV - (ELmou [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELmou.sys (Intel Corporation) DRV - (ftsata2 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.) DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (HSXHWBS2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSXHWBS2.sys (Conexant Systems, Inc.) DRV - (HSX_DP [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSX_DP.sys (Conexant Systems, Inc.) DRV - (iaStor [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (L8042pr2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\L8042pr2.Sys (Logitech, Inc.) DRV - (LHidFlt2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\LHidFlt2.Sys (Logitech, Inc.) DRV - (LHidUsb [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\LHidUsb.Sys (Logitech, Inc.) DRV - (LMouFlt2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\LMouFlt2.Sys (Logitech, Inc.) DRV - (MASPINT [Auto | Running]) -- C:\WINDOWS\System32\drivers\MASPINT.SYS (MicroStaff Co.,Ltd.) DRV - (mdmxsdk [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant) DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (pavboot [Boot | Running]) -- C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.) DRV - (Ps2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (rtl8139 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (tmactmon [Auto | Stopped]) -- C:\WINDOWS\System32\drivers\tmactmon.sys (Trend Micro Inc.) DRV - (tmcfw [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\TM_CFW.sys (Trend Micro Inc.) DRV - (tmcomm [Auto | Running]) -- C:\WINDOWS\System32\drivers\tmcomm.sys (Trend Micro Inc.) DRV - (tmevtmgr [Auto | Stopped]) -- C:\WINDOWS\System32\drivers\tmevtmgr.sys (Trend Micro Inc.) DRV - (tmpreflt [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\tmpreflt.sys (Trend Micro Inc.) DRV - (tmtdi [System | Running]) -- C:\WINDOWS\System32\DRIVERS\tmtdi.sys (Trend Micro Inc.) DRV - (tmxpflt [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\tmxpflt.sys (Trend Micro Inc.) DRV - (usbaudio [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation) DRV - (vsapint [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\vsapint.sys (Trend Micro Inc.) DRV - (winachsx [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (WN5301 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\wn5301.sys (Liteon Technology Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: <Company name>) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll () O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation) O4 - HKLM..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation) O4 - HKLM..\Run: [Google Desktop Search] File not found O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE () O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKCU..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (Trend Micro Inc.) O4 - HKCU..\Run: [PhotoShow Deluxe Media Manager] C:\Program Files\Ahead\Ahead\data\Xtras\mssysmgr.exe () O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\VirtualExpander.lnk = C:\WINDOWS\System32\VirtualExpander\VirtualExpander.exe (Sony Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskmgr = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm File not found O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm File not found O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites) O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://active.macromedia.com/director6/cabs/sw.cab (Shockwave ActiveX Control) O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1206211275203 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\__c0042C90: DllName - - File not found O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/06/14 20:25:25 | 00,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/27 15:07:38 | 00,000,000 | -HS- | M] () - E:\AUTOEXEC.BAT -- [ FAT32 ] O32 - AutoRun File - [2004/04/30 07:01:14 | 00,000,053 | -HS- | M] () - E:\Autorun.inf -- [ FAT32 ] O33 - MountPoints2\{44deb857-f7c6-11db-a6ee-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{44deb857-f7c6-11db-a6ee-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{b63cae67-5a9b-11dd-aea1-001731c6ac80}\Shell - "" = AutoRun O33 - MountPoints2\{b63cae67-5a9b-11dd-aea1-001731c6ac80}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{b63cae67-5a9b-11dd-aea1-001731c6ac80}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -- File not found O33 - MountPoints2\{f8874d50-a978-11dd-aec4-001731c6ac80}\Shell - "" = AutoRun O33 - MountPoints2\{f8874d50-a978-11dd-aec4-001731c6ac80}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f8874d50-a978-11dd-aec4-001731c6ac80}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found ========== Files/Folders - Created Within 30 Days ========== [2009/07/03 20:42:04 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/07/03 20:40:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Desktop\Taz [2009/07/03 19:25:26 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\hidserv.dll [2009/07/03 19:25:22 | 00,014,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\kbdhid.sys [2009/05/29 01:30:51 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\yfok.sys [2009/05/17 22:12:11 | 00,000,032 | ---- | C] () -- C:\WINDOWS\thxcfg.ini [2008/06/19 21:02:21 | 00,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll [2007/11/08 09:28:11 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL [2007/05/07 12:22:13 | 00,022,376 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2007/05/05 10:41:36 | 00,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL [2007/05/05 10:41:36 | 00,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini [2007/05/02 12:58:41 | 00,000,135 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007/05/01 02:36:26 | 00,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS75.DLL [2006/06/14 20:50:43 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006/06/14 20:31:31 | 00,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys [2006/06/14 20:27:39 | 00,014,317 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2006/06/14 20:27:33 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2006/06/14 20:25:36 | 00,000,174 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI [2006/06/14 20:23:41 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006/06/14 20:14:32 | 00,000,184 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2006/06/14 20:13:56 | 00,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini [2006/06/14 20:02:26 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2006/06/14 19:59:45 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006/06/14 19:59:45 | 01,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006/06/14 19:59:45 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006/06/14 19:59:45 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006/06/14 19:58:35 | 00,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006/06/14 19:38:31 | 00,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2006/06/14 19:38:31 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2006/06/14 19:38:15 | 00,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2006/03/17 17:23:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2005/08/30 21:02:00 | 00,000,684 | ---- | C] () -- C:\WINDOWS\win.ini [2005/08/30 13:52:36 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2005/08/05 21:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2004/08/09 21:00:00 | 01,614,848 | ---- | C] () -- C:\WINDOWS\System32\sfcfiles.dll [2004/07/26 07:51:38 | 00,000,560 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/12/05 17:51:00 | 00,059,392 | R--- | C] () -- C:\WINDOWS\streamhlp.dll [2001/07/06 22:30:00 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini ========== Files - Modified Within 30 Days ========== [2009/07/03 20:36:13 | 00,000,246 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat [2009/07/03 20:34:42 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/07/03 20:34:24 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/07/03 20:34:06 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/07/03 20:34:05 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/07/03 20:33:59 | 21,458,65728 | -HS- | M] () -- C:\hiberfil.sys [2009/07/03 20:18:39 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn < End of report > Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully ... . Windows XP . (5.1.2600) Service Pack 3 [32_bits] - x86 Family 15 Model 6 Stepping 4, GenuineIntel . [wscsvc] (Security Center) RUNNING (state:4) [SharedAccess] RUNNING (state:4) Windows Firewall -> Disabled ! . Internet Explorer 6.0.2900.5512 . C:\ [Fixed-NTFS] .. ( Total:270 Go - Free:233 Go ) D:\ [Fixed-NTFS] .. ( Total:279 Go - Free:210 Go ) E:\ [Fixed-FAT32] .. ( Total:8 Go - Free:0 Go ) F:\ [CD_Rom] G:\ [CD_Rom] H:\ [Removable] I:\ [Removable] J:\ [Removable] K:\ [Removable] L:\ [Removable] . Scan : 20:41.42 Path : C:\Documents and Settings\HP_Administrator\Desktop\Taz\Rooter.exe User : HP_Administrator ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (1020) ______ \??\C:\WINDOWS\system32\csrss.exe (1068) ______ \??\C:\WINDOWS\system32\winlogon.exe (1092) ______ C:\WINDOWS\system32\services.exe (1140) ______ C:\WINDOWS\system32\lsass.exe (1152) ______ C:\WINDOWS\system32\svchost.exe (1392) ______ C:\WINDOWS\system32\svchost.exe (1488) ______ C:\WINDOWS\System32\svchost.exe (1560) ______ C:\WINDOWS\system32\svchost.exe (1676) ______ C:\WINDOWS\system32\svchost.exe (1724) ______ C:\WINDOWS\system32\spoolsv.exe (1988) ______ C:\WINDOWS\system32\svchost.exe (1512) ______ C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe (1840) ______ C:\WINDOWS\eHome\ehRecvr.exe (2032) ______ C:\WINDOWS\eHome\ehSched.exe (1288) ______ C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe (380) ______ C:\Program Files\Common Files\LightScribe\LSSrvc.exe (516) ______ C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (656) ______ C:\WINDOWS\system32\nvsvc32.exe (736) ______ C:\WINDOWS\system32\svchost.exe (944) ______ C:\WINDOWS\system32\svchost.exe (976) ______ C:\WINDOWS\ehome\mcrdsvc.exe (1904) ______ C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (2144) ______ C:\WINDOWS\system32\wbem\wmiprvse.exe (2500) ______ C:\WINDOWS\system32\dllhost.exe (2788) ______ C:\WINDOWS\System32\alg.exe (2884) ______ C:\WINDOWS\system32\wscntfy.exe (2800) ______ C:\WINDOWS\Explorer.EXE (3148) ______ C:\WINDOWS\ehome\ehtray.exe (3484) ______ C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (3556) ______ C:\Program Files\DISC\DISCover.exe (3800) ______ C:\Program Files\DISC\DiscUpdMgr.exe (2424) ______ C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (3852) ______ C:\WINDOWS\eHome\ehmsas.exe (3936) ______ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe (4016) ______ C:\WINDOWS\Logi_MwX.Exe (1948) ______ C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (2704) ______ C:\WINDOWS\system32\rundll32.exe (2756) ______ C:\WINDOWS\RTHDCPL.EXE (3376) ______ C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe (2804) ______ C:\WINDOWS\system32\ctfmon.exe (3028) ______ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3252) ______ C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (3312) ______ C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe (3540) ______ C:\WINDOWS\system32\wuauclt.exe (1040) ______ C:\HP\KBD\KBD.EXE (1648) ______ C:\Program Files\DISC\DiscStreamHub.exe (3620) ______ c:\windows\system\hpsysdrv.exe (3496) ______ C:\Program Files\iTunes\iTunesHelper.exe (3216) ______ C:\Program Files\iPod\bin\iPodService.exe (4032) ______ C:\Documents and Settings\HP_Administrator\Desktop\Taz\Rooter.exe (5040) . ----------------------\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:32256 | Length:290541533184) \Device\Harddisk0\Partition2 (Start_Offset:290549790720 | Length:9516648960) . ----------------------\\ Scheduled Tasks . C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job C:\WINDOWS\Tasks\AppleSoftwareUpdate.job C:\WINDOWS\Tasks\desktop.ini C:\WINDOWS\Tasks\Google Software Updater.job C:\WINDOWS\Tasks\SA.DAT . ----------------------\\ Registry . . ----------------------\\ Files & Folders . ----------------------\\ Scan completed at 20:42.04 . C:\Rooter$\Rooter_1.txt - (03/07/2009 | 20:42.04) OTL Extras logfile created on: 7/3/2009 8:49:48 PM - Run 1 OTL by OldTimer - Version 3.0.6.4 Folder = C:\Documents and Settings\HP_Administrator\Desktop\Taz Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.51 Gb Available Physical Memory | 75.80% Memory free 3.85 Gb Paging File | 3.51 Gb Available in Paging File | 91.33% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 270.59 Gb Total Space | 233.51 Gb Free Space | 86.30% Space Free | Partition Type: NTFS Drive D: | 279.46 Gb Total Space | 210.10 Gb Free Space | 75.18% Space Free | Partition Type: NTFS Drive E: | 8.85 Gb Total Space | 0.41 Gb Free Space | 4.58% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive L: | 7.60 Gb Total Space | 7.25 Gb Free Space | 95.33% Space Free | Partition Type: FAT32 Computer Name: MAINPC Current User Name: HP_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP (Hewlett-Packard) %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe () C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe (Hewlett-Packard) C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe ( ) C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\DISC\DISCover.exe:*:Enabled:DISCover Drop & Play System (Digital Interactive Systems Corporation) C:\Program Files\DISC\DiscStreamHub.exe:*:Enabled:DISCover Stream Hub (Digital Interactive Systems Corporation, Inc.) C:\Program Files\DISC\myFTP.exe:*:Enabled:DISCover FTP (Digital Interactive Systems Corporation, Inc.) C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP (Hewlett-Packard) C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink File not found C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation) C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.) C:\Program Files\eMule\emule.exe:*:Enabled:eMule (http://www.emule-project.net) %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) C:\Program Files\AVG\AVG8\avgam.exe:*:Enabled:avgam.exe File not found C:\Program Files\AVG\AVG8\avgdiag.exe:*:Enabled:avgdiag.exe File not found C:\Program Files\AVG\AVG8\avgdiagex.exe:*:Enabled:avgdiagex.exe File not found C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe File not found C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe File not found ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data "{08094E03-AFE4-4853-9D31-6D0743DF5328}" = QuickTime "{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow "{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan "{0BF5FBE7-3907-4A1F-9E48-8B66E52850D6}" = TrayApp "{1341D838-719C-4A05-B50F-49420CA1B4BB}" = HP Boot Optimizer "{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth "{1E1F1E70-14D8-4380-8652-BD1A895A7D65}" = Status "{20DFF861-31EE-41F6-98D5-0A992AE7D116}" = YouSendIt Plug-in for Outlook "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus "{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress "{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.3.2 "{27428D1B-8CBA-4EEA-B9C0-A23CA7B4FCC1}" = muvee autoProducer 5.0 "{27E395E5-EB04-4BFD-96C3-C9A102E97E1B}" = Intel® Viiv™ Software "{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006 "{2BA00471-0328-3743-93BD-FA813353A783}" = Microsoft .NET Framework 3.0 Service Pack 1 "{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}" = HP Deskjet Printer Preload "{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine "{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager "{31263605-FC84-4787-B847-BA445B147E24}" = ScannerCopy "{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3 "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5 "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7 "{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1 "{33D6CC28-9F75-4d1b-A11D-98895B3A3729}" = HP Photosmart 330,380,420,470,7800,8000,8200 Series "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{352F5013-07DC-446D-8DB6-38F339086C60}" = LightScribe 1.4.84.1 "{3592F5CB-B524-43AA-92F2-2377268199CC}" = iTunes "{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder "{3CF99DC3-38FD-46E6-A6B4-9C70074E020C}" = DocumentViewer "{40E12A55-C504-4223-AFAC-7672DBF1ACDE}" = Trend Micro Internet Security "{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works "{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1 "{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 2.1 "{4BE53DB2-C1F2-44D1-A9AB-1630BA7F2AF1}" = SolutionCenter "{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver "{54E3707F-808E-4fd4-95C9-15D1AB077E5D}" = NewCopy "{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.75 "{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}" = HP PSC & OfficeJet 5.3.B "{5D61626A-BD55-4e42-82EE-4AE89D8FD050}" = HP Photosmart Cameras 6.0 "{5FDD0538-C67A-4F67-B3F8-09D1AAF04D99}" = muvee autoProducer unPlugged 2.0 "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler "{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap "{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI "{6A118C80-B382-41c0-8907-CDD0BF5EFE6E}" = CameraDrivers "{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{729DF902-05F9-4C00-9E6D-411119824E5F}" = hpiCamDrvQFolder "{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme "{755EC5E3-FD51-46bd-A57F-7A2D56FBF061}" = PSTAPlugin "{7583D2F8-8E7D-40C5-9862-4D218006FB84}" = AVG Identity Protection "{769A295C-DCF4-41d6-AFBA-7D9394B23AFE}" = PSPrinters08 "{7850A6D2-CBEA-4728-9877-F1BEDEA9F619}" = AiOSoftware "{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up "{82081779-4175-4666-A457-AB711CD37EF0}" = cp_LightScribeConfig "{829DAAD6-BB11-4BB7-921B-07FFB703F944}" = CP_Package_Variety3 "{82E55892-6FFD-403F-AA97-D726846768AA}" = CP_AtenaShokunin1Config "{866A0078-DEA7-4348-9C9A-999AF2991EAA}" = SlideShowMusic "{8A534F71-3202-4464-A422-B767295E67B9}" = CP_Package_Variety2 "{8C22F265-DE76-44D1-8A79-A71D819137DA}" = Intel® Quick Resume Technology Drivers "{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager "{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003 "{93E5A317-24EC-4744-812C-16FECFE86E6A}" = CP_Package_Variety1 "{A260B422-70E1-41E2-957D-F76FA21266D5}" = Apple Software Update "{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices "{A3455242-DAE0-4523-8242-FD82706ABF4B}" = CameraDrivers "{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2 "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio "{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2 "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy "{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig "{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1 "{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour "{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config "{B9DD2DE0-27BE-4e6b-AAD8-0D960ABF87FD}" = CameraUserGuides "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation "{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update "{BF4E9ED0-EF26-4A4C-A123-6A6A1ABEE411}" = DocProc "{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery "{C3FAA091-B278-44A7-BF48-190811C5F9F7}" = cp_UpdateProjectsConfig "{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan "{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA "{C98E8D9D-21DE-4F87-A9B7-142BB89840FC}" = Toolbox "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CBB6F775-E76E-49F7-98D3-1519414B1E4B}" = YouSendIt Express "{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = Fax "{D3AA158A-9421-4883-8767-E771B0964A1D}" = ImageMixer VCD for FinePix "{DAAD5187-62C5-4AD6-A526-803C18C4944D}" = HP Web Helper "{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp "{DEBB2986-15B0-4D28-95FA-5C966A396589}" = HPProductAssistant "{E5A1DE9A-A21C-43A1-B06D-5146BAF62033}" = PanoStandAlone "{E5A8DDAB-AE80-48C6-A75B-D0FAB83B299D}" = HP PSC & OfficeJet 6.1.A "{EC2715CE-C182-483C-84CC-81D7D914CF14}" = WebReg "{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA "{F80239D8-7811-4D5E-B033-0D0BBFE32920}" = HP DigitalMedia Archive "{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations "{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA "12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic "ActiveScan 2.0" = Panda ActiveScan 2.0 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Shockwave Player" = Adobe Shockwave Player "Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2 "B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto "CANONBJ_Deinstall_CNMCP64.DLL" = Canon PIXMA iP4000 "CANONBJ_Deinstall_CNMCP75.DLL" = Canon iP1600 "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Data Fax SoftModem with SmartCP "DISCover" = DISCover "Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint "Easy-WebPrint" = Easy-WebPrint "eMule" = eMule "Google Desktop" = Google Desktop "Google Updater" = Google Updater "HP Document Viewer" = HP Document Viewer 6.1 "HP Game Console" = HP Game Console "HP Imaging Device Functions" = HP Imaging Device Functions 7.0 "HP Photo & Imaging" = HP Photosmart Premier Software 6.5 "HP Photosmart for Media Center PC" = HP Photosmart for Media Center PC "HP Rhapsody" = HP Rhapsody "HP Solution Center & Imaging Support Tools" = HP Solution Center and Imaging Support Tools 6.1 "HPOOVClient-9972322 Uninstaller" = Updates from HP (remove only) "InstallShield_{20DFF861-31EE-41F6-98D5-0A992AE7D116}" = YouSendIt Plug-in for Outlook "InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement "InstallShield_{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.3.2 "InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up "InstallShield_{CBB6F775-E76E-49F7-98D3-1519414B1E4B}" = YouSendIt Express "Intel® Quick Resume Technology" = Intel® Quick Resume Technology Drivers "Logitech Resource Center" = Logitech Resource Center "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Money2006b" = Microsoft Money 2006 "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "MSNINST" = MSN "MWASPI" = MicroStaff WINASPI "Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition "Nero PhotoShow Express" = Nero PhotoShow Express "NeroVision!UninstallKey" = NeroVision Express 2 "NMIX!UninstallKey" = NeroMIX "NVIDIA Drivers" = NVIDIA Drivers "PC-Doctor 5 for Windows" = PC-Doctor 5 for Windows "PROSet" = Intel® Network Connections Drivers "Python 2.2.3" = Python 2.2.3 "pywin32-py2.2" = Python 2.2 pywin32 extensions (build 203) "RealPlayer 6.0" = RealPlayer "WIC" = Windows Imaging Component "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "WT004613" = Tornado Jockey "WT005513" = Super Granny "WT005515" = Polar Bowler "WT005517" = Blasterball 2 Remix "WT005518" = Polar Golfer "WT005519" = Ricochet Lost Worlds "WT005520" = Blackhawk Striker 2 "WT005521" = Blasterball 2 Revolution "WT005523" = Tradewinds "WT005524" = Bounce Symphony "WT005630" = Alien Outbreak 2 "WT005631" = Fairies "WT005632" = Snowy The Bears Adventure "WT005634" = Bejeweled 2 Deluxe "WT005635" = Big Kahuna Reef "WT005636" = Bookworm Deluxe "WT005637" = Chuzzle Deluxe "WT005638" = Diner Dash "WT005639" = Family Feud "WT005640" = Flip Words "WT005641" = Insaniquarium Deluxe "WT005642" = Jewel Quest "WT005643" = Mah Jong Quest "WT005644" = Mystery Case Files "WT005645" = Poker Superstars "WT005646" = SCRABBLE "WT005647" = Slingo Deluxe "WT005648" = Tennis Titans "WT006069" = FATE "WT006072" = Ancient Sudoku "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Move Networks Player - IE" = Move Networks Media Player for Internet Explorer ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 11/1/2008 5:45:14 PM | Computer Name = MAINPC | Source = Application Hang | ID = 1002 Description = Hanging application wmplayer.exe, version 11.0.5721.5145, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 11/1/2008 5:45:32 PM | Computer Name = MAINPC | Source = Application Hang | ID = 1001 Description = Fault bucket 337816799. Error - 11/7/2008 5:09:50 PM | Computer Name = MAINPC | Source = Application Hang | ID = 1002 Description = Hanging application msimn.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 11/7/2008 5:09:52 PM | Computer Name = MAINPC | Source = Application Hang | ID = 1001 Description = Fault bucket 736169863. Error - 11/9/2008 2:36:09 PM | Computer Name = MAINPC | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x61e1ab70. Error - 11/9/2008 2:36:12 PM | Computer Name = MAINPC | Source = Application Error | ID = 1001 Description = Fault bucket 753479538. Error - 11/12/2008 3:15:48 AM | Computer Name = MAINPC | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 11/12/2008 3:15:51 AM | Computer Name = MAINPC | Source = Application Hang | ID = 1001 Description = Fault bucket 724398357. Error - 12/9/2008 5:15:49 PM | Computer Name = MAINPC | Source = Application Hang | ID = 1002 Description = Hanging application mssysmgr.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 12/13/2008 2:08:16 PM | Computer Name = MAINPC | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 6.0.2900.5512, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x00010193. [ System Events ] Error - 5/30/2009 2:39:05 AM | Computer Name = MAINPC | Source = DCOM | ID = 10010 Description = The server {98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C} did not register with DCOM within the required timeout. Error - 5/30/2009 2:39:35 AM | Computer Name = MAINPC | Source = DCOM | ID = 10010 Description = The server {98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C} did not register with DCOM within the required timeout. Error - 5/30/2009 2:48:57 AM | Computer Name = MAINPC | Source = DCOM | ID = 10010 Description = The server {601AC3DC-786A-4EB0-BF40-EE3521E70BFB} did not register with DCOM within the required timeout. Error - 5/30/2009 3:43:28 AM | Computer Name = MAINPC | Source = DCOM | ID = 10010 Description = The server {601AC3DC-786A-4EB0-BF40-EE3521E70BFB} did not register with DCOM within the required timeout. Error - 5/30/2009 3:45:25 AM | Computer Name = MAINPC | Source = DCOM | ID = 10005 Description = DCOM got error "%1053" attempting to start the service gusvc with arguments "" in order to run the server: {89DAE4CD-9F17-4980-902A-99BA84A8F5C8} Error - 5/30/2009 3:45:25 AM | Computer Name = MAINPC | Source = Service Control Manager | ID = 7009 Description = Timeout (30000 milliseconds) waiting for the Google Software Updater service to connect. Error - 6/2/2009 10:51:51 PM | Computer Name = MAINPC | Source = System Error | ID = 1003 Description = Error code 00000030, parameter1 9e641cb8, parameter2 9e641cc4, parameter3 9e641c50, parameter4 00000000. Error - 7/3/2009 10:25:26 PM | Computer Name = MAINPC | Source = Ntfs | ID = 262199 Description = The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:. Error - 7/3/2009 11:16:03 PM | Computer Name = MAINPC | Source = Disk | ID = 262155 Description = The driver detected a controller error on \Device\Harddisk2\D. Error - 7/3/2009 11:17:39 PM | Computer Name = MAINPC | Source = Disk | ID = 262155 Description = The driver detected a controller error on \Device\Harddisk2\D. < End of report > Thanks for your time |
 |
 
|
|
Jul 7 2009, 11:39 AM
Post
#2
|
|
 Trusted Helper  Posts: 1,703 From: ~/ OS: Linux all the way! |
Hello crjaramillo,
Welcome to GeeksToGo! My name is chamber and I'll be helping you today. As I am still in training all of my posts have to checked by an expert so there may be some delay between replies. Before we proceed to clean your computer from malware there are some points you should consider that will make the process go smoother.
Please read my posts completely before following the instructions. |
|
|
|
|
Jul 7 2009, 03:34 PM
Post
#3
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
Hi crjaramillo,
Lets get to work then. Are you able to access safe mode? For the purpose of this fix AVZ can be run in safe mode if necessary. 1) Multiple antivirus You appear to have a couple of different antivirus programs on your system, Trend Micro and AVG. Having more than one antivirus program, rather than make you more secure will actually lower the security as they will conflict with each other and cause nasties to slip by. You say that Trend Micro is fully up to date therefore would you be wanting to keep that? If you do choose to remove AVG then HERE is a link to the AVG Removal Tool. If you are having any problems with this then please let me know. 2) AVZ Download avz4.zip from here
Note: If you recieve an error message, chose a different source, then click Start again
When restarted
Attach both zip files to your next post To attach a file, do the following:
|
|
|
|
to insert the attachment into your post|
Jul 11 2009, 07:22 AM
Post
#4
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
Do you still require assistance?
|
|
|
|
|
Jul 11 2009, 09:40 AM
Post
#5
|
|
|
Member Posts: 11 OS: Windows XP Pro |
QUOTE (chamber @ Jul 11 2009, 06:22 AM)  Do you still require assistance? I'm sorry, yes, Ive been busy with work and haven't been home much. I'll try to follow your instructions this afternoon. Thanks for your time |
|
|
|
|
Jul 11 2009, 05:32 PM
Post
#6
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
No problem.
Post when ready. 
|
|
|
|
|
Jul 15 2009, 01:00 AM
Post
#7
|
|
|
Member Posts: 11 OS: Windows XP Pro |
I ran the AVG removal tool as per your instructions, and then ran AVZ. Both programs were run from Safemode.
Attached are the two .zip files that you requested. Thank you for your patience and time, they are much appreciated. 
virusinfo_syscheck.zip ( 18.26K )
Number of downloads: 8
virusinfo_syscure.zip ( 18.46K )
Number of downloads: 7 |
|
|
|
|
Jul 15 2009, 03:27 PM
Post
#8
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
Hi crjaramillo,
You're very welcome Can you run this in normal mode please? Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall** |
|
|
|
|
Jul 19 2009, 03:20 AM
Post
#9
|
|
|
Member Posts: 11 OS: Windows XP Pro |
Combo-Fix Log:
ComboFix 09-07-14.08 - HP_Administrator 07/19/2009 0:22.1.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1518 [GMT -7:00] Running from: c:\documents and settings\HP_Administrator\Desktop\Taz\Combo-Fix.exe AV: Trend Micro Internet Security *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5} FW: Trend Micro Personal Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6} * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll c:\windows\Installer\3235b.msi c:\windows\kb913800.exe c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\Drivers\yfok.sys c:\windows\system32\IEDFix.C.exe c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\SrchSTS.exe E:\Autorun.inf Infected copy of c:\windows\system32\sfcfiles.dll was found and disinfected Restored copy from - c:\windows\system32\mssfc.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SFC -------\Service_sfc ((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-07 09:01 . 2009-07-07 09:01 -------- d-----w- C:\VundoFix Backups 2009-07-07 07:26 . 2009-07-07 07:26 -------- d-----w- c:\program files\ERUNT 2009-07-04 03:42 . 2009-07-04 03:42 -------- d-----w- C:\Rooter$ 2009-07-04 02:25 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll 2009-07-04 02:25 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 07:06 . 2008-12-02 20:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-07 07:27 . 2009-05-29 05:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-17 18:27 . 2009-05-29 05:31 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-17 18:27 . 2009-05-29 05:31 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-05-29 07:37 . 2009-05-29 07:37 -------- d-----w- c:\program files\Panda Security 2009-05-29 05:31 . 2009-05-29 05:31 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes 2009-05-29 05:31 . 2009-05-29 05:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-05-28 19:22 . 2006-06-15 03:31 -------- d-----w- c:\program files\PC-Doctor 5 for Windows 2009-05-28 19:22 . 2008-02-07 10:51 -------- d-----w- c:\program files\Windows Media Connect 2 2009-05-28 19:22 . 2006-06-15 03:13 -------- d-----w- c:\program files\music_now 2009-05-28 19:22 . 2006-06-15 03:22 -------- d-----w- c:\program files\Microsoft Works 2009-05-28 19:22 . 2006-06-15 03:12 -------- d-----w- c:\program files\MSN Encarta Standard 2009-05-28 19:22 . 2007-05-05 17:38 -------- d-----w- c:\program files\FinePixViewer 2009-05-28 19:22 . 2006-06-15 02:40 -------- d-----w- c:\program files\GemMaster 2009-05-28 19:22 . 2006-06-15 02:40 -------- d-----w- c:\program files\EnglishOtto 2009-05-18 04:38 . 2008-06-20 03:43 89784 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-18 04:34 . 2009-05-18 04:34 152576 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-16 03:46 . 2009-05-16 03:46 1915520 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-05-11 18:37 . 2009-01-07 04:25 34062 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Move Networks\ie_bin\Uninst.exe 2009-05-07 15:32 . 2004-08-10 04:00 345600 ------w- c:\windows\system32\localspl.dll 2009-04-29 04:46 . 2004-08-10 04:00 666624 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:46 . 2004-08-10 04:00 81920 ------w- c:\windows\system32\ieencode.dll 2009-01-08 06:29 . 2009-01-08 06:29 3493888 ----a-w- c:\program files\launchpadremoval.exe 2008-12-27 01:17 . 2008-12-27 01:16 3231826 ----a-w- c:\program files\eMule0.49b-Installer1.exe 2008-12-02 20:21 . 2008-12-02 20:21 1028776 ----a-w- c:\program files\Google Updater.exe 2008-11-25 19:20 . 2008-11-25 19:20 28868320 ----a-w- c:\program files\FileFormatConverters.exe 2008-11-07 22:27 . 2008-11-07 22:26 1234120 ----a-w- c:\program files\wrar380.exe 2008-11-07 20:46 . 2008-11-07 20:46 3407848 ----a-w- c:\program files\YouSendItExpressSetup1_7_3.exe 2008-11-07 20:44 . 2008-11-07 20:43 3453896 ----a-w- c:\program files\YouSendItOutlookSetup2_5_0.exe 2007-05-16 19:55 . 2007-05-16 19:55 22 --sha-w- c:\windows\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1] @="{E4000AC4-5E5F-4956-807A-C5854405D64F}" [HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}] 2008-02-09 21:16 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PhotoShow Deluxe Media Manager"="c:\progra~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-05-12 196608] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-02 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-13 139264] "HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152] "DISCover"="c:\program files\DISC\DISCover.exe" [2006-03-16 1077248] "DiscUpdateManager"="c:\program files\DISC\DiscUpdMgr.exe" [2006-03-16 61440] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-16 49152] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-05-05 282624] "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352] "UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-01 995528] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-05-18 30192] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8466432] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-08-28 1626112] "Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2002-11-08 19968] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-10-25 16855552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264] "OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-03-14 492808] c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ VirtualExpander.lnk - c:\windows\system32\VirtualExpander\VirtualExpander.exe [2008-2-9 474808] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-1-9 200704] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-6-14 36903] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\DISC\\DISCover.exe"= "c:\\Program Files\\DISC\\DiscStreamHub.exe"= "c:\\Program Files\\DISC\\myFTP.exe"= "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\eMule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 AVGIDSErHr;AVGIDSErHr;c:\windows\system32\drivers\AVGIDSErHr.sys [2/26/2009 12:46 PM 25608] R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [5/29/2009 12:37 AM 28544] R2 AVGIDSWatcher;AVGIDSWatcher;c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe [2/26/2009 12:46 PM 563720] R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [3/3/2009 12:47 AM 50192] R2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [3/3/2009 12:47 AM 497008] R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [3/3/2009 12:55 AM 36368] R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [3/3/2009 12:47 AM 677128] R3 AVGIDSDriver;AVGIDSDriver;c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys [2/26/2009 12:46 PM 121352] R3 AVGIDSFilter;AVGIDSFilter;c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys [2/26/2009 12:46 PM 30216] R3 AVGIDSShim;AVGIDSShim;c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys [2/26/2009 12:46 PM 27232] R3 CXFALCON;Conexant Falcon II NTSC Video Capture;c:\windows\system32\drivers\cxfalcon.sys [6/14/2006 8:00 PM 82048] R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [7/29/2008 9:06 AM 335376] R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [6/14/2006 8:00 PM 468768] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe [2/26/2009 12:46 PM 5576712] S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [5/18/2009 3:05 AM 30192] . Contents of the 'Scheduled Tasks' folder 2009-05-28 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 22:42] 2009-07-19 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-02 07:27] . . ------- Supplementary Scan ------- . uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html Trusted Zone: trymedia.com . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 00:29 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(3320) c:\windows\system32\nview.dll c:\windows\system32\VirtualExpander\VEShellExt.dll c:\windows\system32\nvwddi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Trend Micro\BM\TMBMSRV.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\program files\Trend Micro\Internet Security\SfCtlCom.exe c:\program files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\rundll32.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe c:\windows\ehome\ehmsas.exe c:\program files\DISC\DiscStreamHub.exe c:\hp\KBD\kbd.exe c:\windows\system\hpsysdrv.exe c:\program files\iTunes\iTunesHelper.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Java\jre1.6.0_07\bin\jucheck.exe . ************************************************************************** . Completion time: 2009-07-19 0:40 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-19 07:39 Pre-Run: 251,834,331,136 bytes free Post-Run: 251,715,231,744 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 236 --- E O F --- 2009-07-11 04:22 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ OTL Log: OTL logfile created on: 7/19/2009 12:40:59 AM - Run 2 OTL by OldTimer - Version 3.0.6.4 Folder = C:\Documents and Settings\HP_Administrator\Desktop\Taz Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.47 Gb Available Physical Memory | 73.62% Memory free 3.85 Gb Paging File | 3.45 Gb Available in Paging File | 89.81% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 270.59 Gb Total Space | 234.45 Gb Free Space | 86.64% Space Free | Partition Type: NTFS Drive D: | 279.46 Gb Total Space | 210.10 Gb Free Space | 75.18% Space Free | Partition Type: NTFS Drive E: | 8.85 Gb Total Space | 0.41 Gb Free Space | 4.58% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive L: | 7.60 Gb Total Space | 7.22 Gb Free Space | 95.03% Space Free | Partition Type: FAT32 Computer Name: MAINPC Current User Name: HP_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.) PRC - C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe (AVG) PRC - C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation) PRC - C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe (Intel Corporation) PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation) PRC - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe (Trend Micro Inc.) PRC - C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.) PRC - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe (Trend Micro Inc.) PRC - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe (Trend Micro Inc.) PRC - C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation) PRC - C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation) PRC - C:\Program Files\DISC\DiscUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) PRC - C:\Program Files\HP\HP Software Update\HPwuSchd2.exe (Hewlett-Packard Development Company, L.P.) PRC - C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.) PRC - C:\Program Files\QuickTime\qttask.exe (Apple Inc.) PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\WINDOWS\System32\wscntfy.exe (Microsoft Corporation) PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Winamp\winampa.exe () PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) PRC - C:\WINDOWS\eHome\ehmsas.exe (Microsoft Corporation) PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) PRC - C:\Program Files\Ahead\Ahead\data\Xtras\mssysmgr.exe () PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.) PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.) PRC - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard) PRC - C:\WINDOWS\System32\VirtualExpander\VirtualExpander.exe (Sony Corporation) PRC - C:\Program Files\DISC\DiscStreamHub.exe (Digital Interactive Systems Corporation, Inc.) PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) PRC - c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) PRC - C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Documents and Settings\HP_Administrator\Desktop\Taz\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (AVGIDSAgent [Auto | Stopped]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe (AVG) SRV - (AVGIDSWatcher [Auto | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe (AVG) SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ehRecvr [Auto | Running]) -- C:\WINDOWS\eHome\ehRecvr.exe (Microsoft Corporation) SRV - (ehSched [Auto | Running]) -- C:\WINDOWS\eHome\ehSched.exe (Microsoft Corporation) SRV - (ELService [Auto | Running]) -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation) SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (GoogleDesktopManager-092308-165331 [On_Demand | Stopped]) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IAANTMon [Auto | Running]) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe (Intel Corporation) SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (idsvc [Unknown | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) SRV - (LightScribeService [Auto | Running]) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) SRV - (McrdSvc [Auto | Running]) -- C:\WINDOWS\ehome\mcrdsvc.exe (Microsoft Corporation) SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) SRV - (MHN [On_Demand | Stopped]) -- C:\WINDOWS\System32\mhn.dll (Microsoft Corporation) SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (NVSvc [Auto | Running]) -- C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (Pml Driver HPZ12 [Boot | Stopped]) -- C:\WINDOWS\System32\HPZipm12.exe (HP) SRV - (SfCtlCom [Auto | Running]) -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe (Trend Micro Inc.) SRV - (TMBMServer [Auto | Running]) -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.) SRV - (TmPfw [Auto | Running]) -- C:\Program Files\Trend Micro\Internet Security\TmPfw.exe (Trend Micro Inc.) SRV - (TmProxy [Auto | Running]) -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe (Trend Micro Inc.) SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (AVGIDSDriver [On_Demand | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys (AVG Technologies ) DRV - (AVGIDSErHr [Boot | Running]) -- C:\WINDOWS\System32\Drivers\AVGIDSErHr.sys (AVG Technologies ) DRV - (AVGIDSFilter [On_Demand | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys (AVG Technologies ) DRV - (AVGIDSShim [On_Demand | Running]) -- C:\Program Files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys (AVG Technologies ) DRV - (bb-run [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.) DRV - (catchme [On_Demand | Running]) -- File not found DRV - (CXFALCON [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\cxfalcon.sys (Conexant Systems, Inc.) DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation) DRV - (ELacpi [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ELacpi.sys (Intel Corporation) DRV - (ELhid [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELhid.sys (Intel Corporation) DRV - (ELkbd [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELkbd.sys (Intel Corporation) DRV - (ELmon [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELmon.sys (Intel Corporation) DRV - (ELmou [System | Running]) -- C:\WINDOWS\System32\DRIVERS\ELmou.sys (Intel Corporation) DRV - (ftsata2 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.) DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (HSXHWBS2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSXHWBS2.sys (Conexant Systems, Inc.) DRV - (HSX_DP [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSX_DP.sys (Conexant Systems, Inc.) DRV - (iaStor [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (L8042pr2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\L8042pr2.Sys (Logitech, Inc.) DRV - (LHidFlt2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\LHidFlt2.Sys (Logitech, Inc.) DRV - (LHidUsb [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\LHidUsb.Sys (Logitech, Inc.) DRV - (LMouFlt2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\LMouFlt2.Sys (Logitech, Inc.) DRV - (MASPINT [Auto | Running]) -- C:\WINDOWS\System32\drivers\MASPINT.SYS (MicroStaff Co.,Ltd.) DRV - (mdmxsdk [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant) DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (pavboot [Boot | Running]) -- C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.) DRV - (Ps2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (rtl8139 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (tmactmon [Auto | Running]) -- C:\WINDOWS\System32\drivers\tmactmon.sys (Trend Micro Inc.) DRV - (tmcfw [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\TM_CFW.sys (Trend Micro Inc.) DRV - (tmcomm [Auto | Running]) -- C:\WINDOWS\System32\drivers\tmcomm.sys (Trend Micro Inc.) DRV - (tmevtmgr [Auto | Running]) -- C:\WINDOWS\System32\drivers\tmevtmgr.sys (Trend Micro Inc.) DRV - (tmpreflt [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\tmpreflt.sys (Trend Micro Inc.) DRV - (tmtdi [System | Running]) -- C:\WINDOWS\System32\DRIVERS\tmtdi.sys (Trend Micro Inc.) DRV - (tmxpflt [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\tmxpflt.sys (Trend Micro Inc.) DRV - (usbaudio [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation) DRV - (vsapint [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\vsapint.sys (Trend Micro Inc.) DRV - (winachsx [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (WN5301 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\wn5301.sys (Liteon Technology Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: <Company name>) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll () O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation) O4 - HKLM..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation) O4 - HKLM..\Run: [Google Desktop Search] File not found O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\Logi_MwX.Exe (Logitech Inc.) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE () O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [UfSeAgnt.exe] C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe (Trend Micro Inc.) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKCU..\Run: [PhotoShow Deluxe Media Manager] C:\Program Files\Ahead\Ahead\data\Xtras\mssysmgr.exe () O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\VirtualExpander.lnk = C:\WINDOWS\System32\VirtualExpander\VirtualExpander.exe (Sony Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm File not found O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm File not found O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites) O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://active.macromedia.com/director6/cabs/sw.cab (Shockwave ActiveX Control) O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1206211275203 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter: - x-sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/06/14 20:25:25 | 00,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/27 15:07:38 | 00,000,000 | -HS- | M] () - E:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found ========== Files/Folders - Created Within 30 Days ========== [2009/07/19 00:40:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp [2009/07/19 00:38:51 | 02,145,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe [2009/07/19 00:38:51 | 02,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe [2009/07/19 00:38:51 | 01,614,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll [2009/07/19 00:38:51 | 01,033,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\explorer.exe [2009/07/19 00:38:51 | 00,989,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\kernel32.dll [2009/07/19 00:38:51 | 00,927,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\mfc40u.dll [2009/07/19 00:38:51 | 00,792,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\comres.dll [2009/07/19 00:38:51 | 00,666,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\wininet.dll [2009/07/19 00:38:51 | 00,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\comctl32.dll [2009/07/19 00:38:51 | 00,578,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\user32.dll [2009/07/19 00:38:51 | 00,507,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\winlogon.exe [2009/07/19 00:38:51 | 00,435,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll [2009/07/19 00:38:51 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\rpcss.dll [2009/07/19 00:38:51 | 00,361,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\tcpip.sys [2009/07/19 00:38:51 | 00,295,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\termsrv.dll [2009/07/19 00:38:51 | 00,182,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ndis.sys [2009/07/19 00:38:51 | 00,167,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\appmgmts.dll [2009/07/19 00:38:51 | 00,110,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\services.exe [2009/07/19 00:38:51 | 00,110,080 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\imm32.dll [2009/07/19 00:38:51 | 00,088,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\rasauto.dll [2009/07/19 00:38:51 | 00,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ws2_32.dll [2009/07/19 00:38:51 | 00,057,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\spoolsv.exe [2009/07/19 00:38:51 | 00,051,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\wuauclt.exe [2009/07/19 00:38:51 | 00,036,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ip6fw.sys [2009/07/19 00:38:51 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\msgsvc.dll [2009/07/19 00:38:51 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\userinit.exe [2009/07/19 00:38:51 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\kbdclass.sys [2009/07/19 00:38:51 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\lpk.dll [2009/07/19 00:38:51 | 00,017,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\powrprof.dll [2009/07/19 00:38:51 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\ctfmon.exe [2009/07/19 00:38:51 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\svchost.exe [2009/07/19 00:38:51 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\lsass.exe [2009/07/19 00:38:51 | 00,011,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\acpiec.sys [2009/07/19 00:38:51 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\sfc.dll [2009/07/19 00:38:51 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\beep.sys [2009/07/19 00:38:51 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cache\null.sys [2009/07/19 00:38:51 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\dllcache\cache [2009/07/19 00:20:26 | 00,000,000 | RHSD | C] -- C:\cmdcons [2009/07/19 00:18:40 | 00,219,648 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009/07/19 00:18:40 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009/07/19 00:18:40 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009/07/19 00:18:40 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009/07/19 00:18:40 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2009/07/19 00:18:40 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2009/07/19 00:18:40 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2009/07/19 00:18:40 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/07/19 00:05:55 | 21,458,65728 | -HS- | C] () -- C:\hiberfil.sys [2009/07/19 00:03:21 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/07/07 02:01:37 | 00,000,000 | ---D | C] -- C:\VundoFix Backups [2009/07/07 00:26:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2009/07/07 00:26:14 | 00,000,622 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\NTREGOPT.lnk [2009/07/07 00:26:14 | 00,000,603 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\ERUNT.lnk [2009/07/07 00:26:14 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/07/03 20:42:04 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/07/03 20:40:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Desktop\Taz [2009/07/03 19:25:26 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\hidserv.dll [2009/07/03 19:25:22 | 00,014,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\kbdhid.sys [2009/05/17 22:12:11 | 00,000,032 | ---- | C] () -- C:\WINDOWS\thxcfg.ini [2008/06/19 21:02:21 | 00,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll [2007/11/08 09:28:11 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL [2007/05/07 12:22:13 | 00,022,376 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2007/05/05 10:41:36 | 00,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL [2007/05/05 10:41:36 | 00,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini [2007/05/02 12:58:41 | 00,000,135 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007/05/01 02:36:26 | 00,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS75.DLL [2006/06/14 20:50:43 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006/06/14 20:31:31 | 00,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys [2006/06/14 20:27:39 | 00,014,317 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2006/06/14 20:27:33 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2006/06/14 20:25:36 | 00,000,174 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI [2006/06/14 20:23:41 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006/06/14 20:14:32 | 00,000,184 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2006/06/14 20:13:56 | 00,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini [2006/06/14 20:02:26 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2006/06/14 19:59:45 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006/06/14 19:59:45 | 01,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006/06/14 19:59:45 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006/06/14 19:59:45 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006/06/14 19:58:35 | 00,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006/06/14 19:38:31 | 00,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2006/06/14 19:38:31 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2006/06/14 19:38:15 | 00,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2006/03/17 17:23:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2005/08/30 21:02:00 | 00,000,684 | ---- | C] () -- C:\WINDOWS\win.ini [2005/08/30 13:52:36 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2005/08/05 21:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2004/07/26 07:51:38 | 00,000,560 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/12/05 17:51:00 | 00,059,392 | R--- | C] () -- C:\WINDOWS\streamhlp.dll [2001/07/06 22:30:00 | 00,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini ========== Files - Modified Within 30 Days ========== [2009/07/19 00:31:37 | 00,000,246 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat [2009/07/19 00:30:51 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009/07/19 00:30:09 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/07/19 00:29:10 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/07/19 00:28:55 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009/07/19 00:28:41 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/07/19 00:28:40 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/07/19 00:28:34 | 21,458,65728 | -HS- | M] () -- C:\hiberfil.sys [2009/07/19 00:20:33 | 00,000,279 | RHS- | M] () -- C:\boot.ini [2009/07/14 23:09:06 | 00,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2009/07/13 05:48:54 | 00,219,648 | ---- | M] () -- C:\WINDOWS\PEV.exe [2009/07/11 10:47:54 | 00,002,497 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\Word.lnk [2009/07/10 21:28:34 | 00,317,952 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/07/10 21:21:50 | 00,000,684 | ---- | M] () -- C:\WINDOWS\win.ini [2009/07/10 21:20:38 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/07/07 00:26:14 | 00,000,622 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\NTREGOPT.lnk [2009/07/07 00:26:14 | 00,000,603 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\ERUNT.lnk < End of report > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks for your time, Chamber. |
|
|
|
|
Jul 19 2009, 11:37 AM
Post
#10
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
Hi crjaramillo,
Would you be able to run the AVG removal tool again, this time in normal mode? 1) CFScript 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE File:: c:\windows\system32\drivers\AVGIDSErHr.sys c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe Folder:: Registry:: Driver:: AVGIDSErHr AVGIDSWatcher AVGIDSDriver AVGIDSFilter AVGIDSShim AVGIDSAgent Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. 2) OTL Run OTL
3) Malwarebytes  Please download Malwarebytes' Anti-Malware from Here.Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. In your reply I would like to see copied and pasted, 1) CFScript 2) Malwarebytes log 3) How is your computer running? |
|
|
|
|
Jul 22 2009, 04:32 PM
Post
#11
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
Hi,
Do you still need help? 
|
|
|
|
|
Jul 23 2009, 02:04 PM
Post
#12
|
|
 GeekU Moderator  Posts: 18,766 From: Darkest Cornwall OS: Vista Ultimate & Windows 7 |
Due to lack of feedback, this topic has been closed.
If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic. |
|
|
|
|
Jul 30 2009, 10:49 PM
Post
#13
|
|
|
Member Posts: 11 OS: Windows XP Pro |
CFScript:
File:: c:\windows\system32\drivers\AVGIDSErHr.sys c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe Folder:: Registry:: Driver:: AVGIDSErHr AVGIDSWatcher AVGIDSDriver AVGIDSFilter AVGIDSShim AVGIDSAgent ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ MalwareBytes Log: Malwarebytes' Anti-Malware 1.39 Database version: 2502 Windows 5.1.2600 Service Pack 3 7/30/2009 9:41:27 PM mbam-log-2009-07-30 (21-41-27).txt Scan type: Quick Scan Objects scanned: 108607 Time elapsed: 3 minute(s), 33 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I posted the contents of "CFScript", did you mean for me to post the CF log? PC is still slow to respond and everything is slow to open, although Control Panel items open and function. Internet Explorer takes forever to open and load a page, and takes between 60-100% CPU usage for the length of time that it takes to do so. I did notice that, after running the fix in CF, IE seemed to function normally, however after the OTL reboot, it was back to creeping along. |
|
|
|
|
Jul 31 2009, 12:35 AM
Post
#14
|
|
|
Trusted Helper Posts: 1,703 From: ~/ OS: Linux all the way! |
Hi,
IF you could post the ComboFix log that woul be great. |
|
|
|
|
Jul 31 2009, 12:39 AM
Post
#15
|
|
|
Member Posts: 11 OS: Windows XP Pro |
CF Log:
ComboFix 09-07-29.04 - HP_Administrator 07/30/2009 16:38.3.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1461 [GMT -7:00] Running from: c:\documents and settings\HP_Administrator\Desktop\Taz\Combo-Fix.exe Command switches used :: c:\documents and settings\HP_Administrator\Desktop\Taz\CFScript.txt AV: Trend Micro Internet Security *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5} FW: Trend Micro Personal Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6} FILE :: "c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSAgent.exe" "c:\program files\AVG\AVG8\IdentityProtection\agent\Bin\AVGIDSWatcher.exe" "c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSDriver.sys" "c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSFilter.sys" "c:\program files\AVG\AVG8\IdentityProtection\agent\driver\platform_XP\AVGIDSShim.sys" "c:\windows\system32\drivers\AVGIDSErHr.sys" . ((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-30 ))))))))))))))))))))))))))))))) . 2009-07-25 22:41 . 2009-07-25 22:41 -------- d-----w- C:\_OTL 2009-07-07 09:01 . 2009-07-07 09:01 -------- d-----w- C:\VundoFix Backups 2009-07-07 07:26 . 2009-07-07 07:26 -------- d-----w- c:\program files\ERUNT 2009-07-04 03:42 . 2009-07-04 03:42 -------- d-----w- C:\Rooter$ 2009-07-04 02:25 . 2008-04-14 00:11 21504 ----a-w- c:\windows\system32\hidserv.dll 2009-07-04 02:25 . 2008-04-13 18:39 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-30 18:17 . 2008-12-02 20:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-26 01:35 . 2009-05-29 05:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-25 22:38 . 2007-05-05 08:46 -------- d-----w- c:\program files\Apple Software Update 2009-07-13 20:36 . 2009-05-29 05:31 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-13 20:36 . 2009-05-29 05:31 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-06-26 16:50 . 2004-08-10 04:00 666624 ----a-w- c:\windows\system32\wininet.dll 2009-06-26 16:50 . 2004-08-10 04:00 81920 ------w- c:\windows\system32\ieencode.dll 2009-06-16 14:36 . 2004-08-10 04:00 81920 ------w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2004-08-10 04:00 119808 ------w- c:\windows\system32\t2embed.dll 2009-06-03 19:09 . 2004-08-10 04:00 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-22 08:02 . 2009-03-03 07:55 225296 ----a-w- c:\windows\system32\drivers\tmxpflt.sys 2009-05-22 08:00 . 2009-03-03 07:55 36368 ----a-w- c:\windows\system32\drivers\tmpreflt.sys 2009-05-22 07:45 . 2009-03-03 07:55 1220120 ----a-w- c:\windows\system32\drivers\vsapint.sys 2009-05-18 04:38 . 2008-06-20 03:43 89784 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-05-18 04:34 . 2009-05-18 04:34 152576 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-16 03:46 . 2009-05-16 03:46 1915520 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe 2009-05-11 18:37 . 2009-01-07 04:25 34062 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Move Networks\ie_bin\Uninst.exe 2009-05-07 15:32 . 2004-08-10 04:00 345600 ------w- c:\windows\system32\localspl.dll 2009-01-08 06:29 . 2009-01-08 06:29 3493888 ----a-w- c:\program files\launchpadremoval.exe 2008-12-27 01:17 . 2008-12-27 01:16 3231826 ----a-w- c:\program files\eMule0.49b-Installer1.exe 2008-12-02 20:21 . 2008-12-02 20:21 1028776 ----a-w- c:\program files\Google Updater.exe 2008-11-25 19:20 . 2008-11-25 19:20 28868320 ----a-w- c:\program files\FileFormatConverters.exe 2008-11-07 22:27 . 2008-11-07 22:26 1234120 ----a-w- c:\program files\wrar380.exe 2008-11-07 20:46 . 2008-11-07 20:46 3407848 ----a-w- c:\program files\YouSendItExpressSetup1_7_3.exe 2008-11-07 20:44 . 2008-11-07 20:43 3453896 ----a-w- c:\program files\YouSendItOutlookSetup2_5_0.exe 2007-05-16 19:55 . 2007-05-16 19:55 22 --sha-w- c:\windows\SMINST\HPCD.sys . ((((((((((((((((((((((((((((( SnapShot@2009-07-19_07.30.49 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-12 02:41 . 2009-07-12 02:41 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll + 2008-02-07 10:51 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll - 2008-02-07 10:51 . 2008-07-09 07:38 17272 c:\windows\system32\spmsg.dll + 2004-08-10 04:00 . 2009-06-26 16:50 81920 c:\windows\system32\dllcache\ieencode.dll - 2004-08-10 04:00 . 2009-04-29 04:46 81920 c:\windows\system32\dllcache\ieencode.dll + 2004-08-10 04:00 . 2009-06-16 14:36 81920 c:\windows\system32\dllcache\fontsub.dll - 2007-05-16 18:29 . 2009-07-11 04:21 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2007-05-16 18:29 . 2009-07-19 09:24 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2007-05-16 18:29 . 2009-07-11 04:21 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2007-05-16 18:29 . 2009-07-19 09:24 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2007-05-16 18:29 . 2009-07-11 04:21 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2007-05-16 18:29 . 2009-07-19 09:24 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2007-05-16 18:29 . 2009-07-19 09:24 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2007-05-16 18:29 . 2009-07-11 04:21 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2007-05-16 18:29 . 2009-07-11 04:21 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2007-05-16 18:29 . 2009-07-19 09:24 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2007-05-16 18:29 . 2009-07-19 09:24 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2007-05-16 18:29 . 2009-07-11 04:21 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2004-08-10 04:00 . 2009-04-29 04:46 620032 c:\windows\system32\urlmon.dll + 2004-08-10 04:00 . 2009-06-26 16:50 620032 c:\windows\system32\urlmon.dll - 2004-08-10 04:00 . 2009-04-29 04:46 666624 c:\windows\system32\dllcache\wininet.dll + 2004-08-10 04:00 . 2009-06-26 16:50 666624 c:\windows\system32\dllcache\wininet.dll - 2004-08-10 04:00 . 2009-04-29 04:46 620032 c:\windows\system32\dllcache\urlmon.dll + 2004-08-10 04:00 . 2009-06-26 16:50 620032 c:\windows\system32\dllcache\urlmon.dll + 2004-08-10 04:00 . 2009-06-16 14:36 119808 c:\windows\system32\dllcache\t2embed.dll + 2009-07-29 07:00 . 2009-07-29 07:00 248832 c:\windows\Installer\108d2ec6.msi - 2007-05-16 18:29 . 2009-07-11 04:21 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2007-05-16 18:29 . 2009-07-19 09:24 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2007-05-16 18:29 . 2009-07-19 09:24 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2007-05-16 18:29 . 2009-07-11 04:21 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2007-05-16 18:29 . 2009-07-19 09:24 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2007-05-16 18:29 . 2009-07-11 04:21 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2007-05-16 18:29 . 2009-07-19 09:24 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2007-05-16 18:29 . 2009-07-11 04:21 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2007-05-16 18:29 . 2009-07-19 09:24 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe - 2007-05-16 18:29 . 2009-07-11 04:21 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe + 2004-08-10 04:00 . 2009-07-18 16:05 1509888 c:\windows\system32\shdocvw.dll + 2004-08-10 04:00 . 2009-07-18 16:05 3069440 c:\windows\system32\mshtml.dll + 2004-08-10 04:00 . 2009-07-18 16:05 1509888 c:\windows\system32\dllcache\shdocvw.dll + 2004-08-10 04:00 . 2009-06-03 19:09 1291264 c:\windows\system32\dllcache\quartz.dll + 2004-08-10 04:00 . 2009-07-18 16:05 3069440 c:\windows\system32\dllcache\mshtml.dll + 2009-06-30 18:30 . 2009-06-30 18:30 5520384 c:\windows\Installer\69fec7.msp + 2007-05-01 18:50 . 2009-07-07 15:10 24539592 c:\windows\system32\MRT.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1] @="{E4000AC4-5E5F-4956-807A-C5854405D64F}" [HKEY_CLASSES_ROOT\CLSID\{E4000AC4-5E5F-4956-807A-C5854405D64F}] 2008-02-09 21:16 73728 ----a-w- c:\windows\system32\VirtualExpander\VEShellExt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PhotoShow Deluxe Media Manager"="c:\progra~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-05-12 196608] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-02 39408] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-13 139264] "HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152] "DISCover"="c:\program files\DISC\DISCover.exe" [2006-03-16 1077248] "DiscUpdateManager"="c:\program files\DISC\DiscUpdMgr.exe" [2006-03-16 61440] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-16 49152] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-05-05 282624] "REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352] "UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-01 995528] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-05-18 30192] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-28 8466432] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-08-28 1626112] "Logitech Utility"="Logi_MwX.Exe" - c:\windows\LOGI_MWX.EXE [2002-11-08 19968] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-10-25 16855552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264] "OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-03-14 492808] c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ VirtualExpander.lnk - c:\windows\system32\VirtualExpander\VirtualExpander.exe [2008-2-9 474808] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-1-9 200704] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624] Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-6-14 36903] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\DISC\\DISCover.exe"= "c:\\Program Files\\DISC\\DiscStreamHub.exe"= "c:\\Program Files\\DISC\\myFTP.exe"= "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\eMule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [5/29/2009 12:37 AM 28544] R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [3/3/2009 12:55 AM 36368] R3 CXFALCON;Conexant Falcon II NTSC Video Capture;c:\windows\system32\drivers\cxfalcon.sys [6/14/2006 8:00 PM 82048] R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [7/29/2008 9:06 AM 335376] R3 WN5301;LIteon Wireless PCI Network Adapter Service;c:\windows\system32\drivers\wn5301.sys [6/14/2006 8:00 PM 468768] S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [3/3/2009 12:47 AM 50192] S2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [3/3/2009 12:47 AM 497008] S2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [3/3/2009 12:47 AM 677128] S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [5/18/2009 3:05 AM 30192] . Contents of the 'Scheduled Tasks' folder 2009-07-30 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 22:42] 2009-07-30 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-05-02 07:27] . . ------- Supplementary Scan ------- . uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-30 16:42 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2432) c:\windows\system32\nview.dll c:\windows\system32\VirtualExpander\VEShellExt.dll c:\windows\system32\nvwddi.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-07-30 16:45 ComboFix-quarantined-files.txt 2009-07-30 23:44 ComboFix2.txt 2009-07-19 22:28 ComboFix3.txt 2009-07-19 07:40 Pre-Run: 251,993,645,056 bytes free Post-Run: 251,998,801,920 bytes free 228 --- E O F --- 2009-07-29 07:00 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Also, even after running the AVG removal tool again the last time, I'm still showing files in C:\Program Files\AVG\AVG8\Identity Protection\agent Thanks for your time |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
2 / 422 | 1st July 2007 - 04:50 AM sg2papa started - last by Essexboy |
|||||
 |
 |
16 / 164 | 13th August 2009 - 05:12 PM neuralimplosions started - last by emeraldnzl |
||||
|
2 / 90 | 9th September 2009 - 04:48 PM JakeMettle started - last by BHowett |
|||||
|
0 / 61 | 6th October 2009 - 12:27 PM bigdogalex started - last by bigdogalex |
|||||
|
Time is now: 8th November 2009 - 01:04 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising