host of malware/trojans associated with "antivirus 2009" woe, can't seem to shake these malicious files from my system... |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.
  |
 Dec 2 2008, 07:50 PM
Post
#1
|
|
|
Member  Posts: 45 From: Toronto OS: xp sp3  |
My system's been infected with the "antivirus 2009" trojan. Windows keep opening in Explorer or Firefox and taking me to sites that want us to purchase stuff. I'm using Sophos AV (version 7.6.2) and Malawarebytes (version 1.30, with a database version 1450). I used both of these in "safe mode" and not, to help clean the system. Well, it appears that there are a host of files these two programs or software are catching, but aren't successfully removing. When run, they detect, quarantine, tell me where they are located, then get deleted indicating a successful action. But today (02.12.08), Sophos AV couldn't delete this: File "C:\WINDOWS\system32\sikasiso.dll" belongs to virus/spyware Troj/Vurtum-Gen. Interesting thing just happened before opening this post while reading the info you guys have listed on this site. Another window opened in Explorer, and Sophos AV caught something that says: Blocked request: location contains malicious content Threat: Mal/FakeAvJs-A Threat source : http://computerquickscanner.com/2009/1/en/...n.php?nu=880807 The requested location contained malicious content and was blocked from downloading. Anyway, I followed the steps to remove this thing(s) before posting an HJT log. Thanks in advance  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:43:40, on 02/12/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe C:\Program Files\Sophos\AutoUpdate\ALsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\devldr32.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre6\bin\jusched.exe M:\Programs\TrueImageMonitor.exe M:\Programs\TimounterMonitor.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Sophos\Sophos Anti-Virus\SavProgress.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll O2 - BHO: (no name) - {5BFFA693-5861-414E-81A9-75F17BDDC075} - C:\WINDOWS\system32\iifedaAr.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {ba680ec7-48e6-443d-8826-c9cf213c1f87} - C:\WINDOWS\system32\sotugulu.dll (file missing) O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Mirar - {DBB6E498-5192-44A9-BC01-B43C8105CA7E} - C:\WINDOWS\system32\winbh77.dll (file missing) O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TrueImageMonitor.exe] M:\Programs\TrueImageMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] M:\Programs\TimounterMonitor.exe O4 - HKLM\..\Run: [waruyarovo] Rundll32.exe "C:\WINDOWS\system32\gatinuro.dll",s O4 - HKLM\..\Run: [CPM435a062d] Rundll32.exe "c:\windows\system32\gubebusi.dll",a O4 - HKLM\..\Run: [406935b1] rundll32.exe "C:\WINDOWS\system32\lijohoyo.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" O4 - HKUS\S-1-5-19\..\Run: [waruyarovo] Rundll32.exe "C:\WINDOWS\system32\gatinuro.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [waruyarovo] Rundll32.exe "C:\WINDOWS\system32\gatinuro.dll",s (User 'NETWORK SERVICE') O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O15 - Trusted Zone: *.amaena.com O15 - Trusted Zone: *.antimalwareguard.com O15 - Trusted Zone: *.antispyexpert.com O15 - Trusted Zone: *.avsystemcare.com O15 - Trusted Zone: *.gomyhit.com O15 - Trusted Zone: *.imageservr.com O15 - Trusted Zone: *.imagesrvr.com O15 - Trusted Zone: *.onerateld.com O15 - Trusted Zone: *.safetydownload.com O15 - Trusted Zone: *.spyguardpro.com O15 - Trusted Zone: *.storageguardsoft.com O15 - Trusted Zone: *.trustedantivirus.com O15 - Trusted Zone: *.virusremover2008.com O15 - Trusted Zone: *.virusschlacht.com O15 - Trusted Zone: *.amaena.com (HKLM) O15 - Trusted Zone: *.antimalwareguard.com (HKLM) O15 - Trusted Zone: *.antispyexpert.com (HKLM) O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.spyguardpro.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusremover2008.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL C:\WINDOWS\system32\sikasiso.dll c:\windows\system32\gubebusi.dll O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\gubebusi.dll O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\gubebusi.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Cleanup Service (SAVCleanupService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVCleanupService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe -- End of file - 10524 bytes |
 |
 
|
|
Dec 2 2008, 09:23 PM
Post
#2
|
|
 Trusted Helper  Posts: 5,221 OS: Windows XP |
Hello, my name is fenzodahl512 and welcome to Geekstogo.. Please do the following...
Please re-open HijackThis and click on Do a system scan only. Check the boxes next to all the entries listed below. O15 - Trusted Zone: *.amaena.com O15 - Trusted Zone: *.antimalwareguard.com O15 - Trusted Zone: *.antispyexpert.com O15 - Trusted Zone: *.avsystemcare.com O15 - Trusted Zone: *.gomyhit.com O15 - Trusted Zone: *.imageservr.com O15 - Trusted Zone: *.imagesrvr.com O15 - Trusted Zone: *.onerateld.com O15 - Trusted Zone: *.safetydownload.com O15 - Trusted Zone: *.spyguardpro.com O15 - Trusted Zone: *.storageguardsoft.com O15 - Trusted Zone: *.trustedantivirus.com O15 - Trusted Zone: *.virusremover2008.com O15 - Trusted Zone: *.virusschlacht.com O15 - Trusted Zone: *.amaena.com (HKLM) O15 - Trusted Zone: *.antimalwareguard.com (HKLM) O15 - Trusted Zone: *.antispyexpert.com (HKLM) O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.spyguardpro.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusremover2008.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) Now close all windows other than HijackThis, then click Fix checked. Close HijackThis. ----------------------- Please download Malwarebytes' Anti-Malware from HERE or HERE Note: If you already have Malwarebytes' Anti-Malware, just run and update it.. Then do a "Perform Full Scan" Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. --------------------- Please download RSIT by random/random and save it to your Desktop.
Post me these logs in your next reply.. Post each log in separate post... 1. Malwarebytes' 2. RSIT log.txt 3. RSIT info.txt |
|
|
|
|
Dec 3 2008, 12:12 AM
Post
#3
|
|
|
Member Posts: 45 From: Toronto OS: xp sp3 |
Hello fenzodahl512, thanks for the reply. I just wanted to add that when the system rebooted after the malwarebytes' scan, three types of errors occured:
1. error loading C:\WINDOWS\system32\gatrino.dll 2. error loading C:\WINDOWS\system32\gubebusi.dll 3. computer must be restarted inorder for update to be complete (i think this is from a failed java update, but not 100%) Alright sir, here's the first of three logs you requested: Malwarebytes' Anti-Malware 1.30 Database version: 1452 Windows 5.1.2600 Service Pack 3 03/12/2008 00:40:32 mbam-log-2008-12-03 (00-40-32).txt Scan type: Full Scan (C:\|D:\|E:\|M:\|P:\|Z:\|) Objects scanned: 114972 Time elapsed: 1 hour(s), 18 minute(s), 27 second(s) Memory Processes Infected: 0 Memory Modules Infected: 2 Registry Keys Infected: 3 Registry Values Infected: 5 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\lijohoyo.dll (Trojan.Vundo) -> Delete on reboot. c:\WINDOWS\system32\gubebusi.dll (Trojan.Vundo) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\406935b1 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm435a062d (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waruyarovo (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\gubebusi.dll -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\gubebusi.dll -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\lijohoyo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\oyohojil.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. c:\WINDOWS\system32\gubebusi.dll (Trojan.Vundo) -> Delete on reboot. C:\System Volume Information\_restore{1A4D5BB4-BCBB-4617-A6AB-05204CD5C55E}\RP2\A0003917.dll (Trojan.Vundo) -> Quarantined and deleted successfully. |
|
|
|
|
Dec 3 2008, 12:14 AM
Post
#4
|
|
|
Member Posts: 45 From: Toronto OS: xp sp3 |
the second:
Logfile of random's system information tool 1.04 (written by random/random) Run by Lucky Tohan at 2008-12-03 00:59:37 Microsoft Windows XP Professional Service Pack 3 System drive C: has 8 GB (42%) free of 20 GB Total RAM: 640 MB (58% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:59:43, on 03/12/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Sophos\AutoUpdate\ALsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\carpserv.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Java\jre6\bin\jusched.exe M:\Programs\TrueImageMonitor.exe M:\Programs\TimounterMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Lucky Tohan\Desktop\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Lucky Tohan.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll O2 - BHO: (no name) - {5BFFA693-5861-414E-81A9-75F17BDDC075} - C:\WINDOWS\system32\iifedaAr.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: (no name) - {ba680ec7-48e6-443d-8826-c9cf213c1f87} - C:\WINDOWS\system32\sotugulu.dll (file missing) O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Mirar - {DBB6E498-5192-44A9-BC01-B43C8105CA7E} - C:\WINDOWS\system32\winbh77.dll (file missing) O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TrueImageMonitor.exe] M:\Programs\TrueImageMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] M:\Programs\TimounterMonitor.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" O4 - HKUS\S-1-5-19\..\Run: [waruyarovo] Rundll32.exe "C:\WINDOWS\system32\gatinuro.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [waruyarovo] Rundll32.exe "C:\WINDOWS\system32\gatinuro.dll",s (User 'NETWORK SERVICE') O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL C:\WINDOWS\system32\sikasiso.dll O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe -- End of file - 8515 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\xylgglft.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39EA7695-B3F2-4C44-A4BC-297ADA8FD235}] Sophos Web Content Scanner - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll [2008-11-19 240696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BFFA693-5861-414E-81A9-75F17BDDC075}] C:\WINDOWS\system32\iifedaAr.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-23 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}] Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10 321120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba680ec7-48e6-443d-8826-c9cf213c1f87}] C:\WINDOWS\system32\sotugulu.dll [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-23 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-23 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2007-05-10 321120] {DBB6E498-5192-44A9-BC01-B43C8105CA7E} - Mirar - C:\WINDOWS\system32\winbh77.dll [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "WINDVDPatch"=C:\WINDOWS\system32\CTHELPER.EXE [2002-02-07 40960] "CARPService"=C:\WINDOWS\system32\carpserv.exe [2003-01-08 4608] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648] ""= [] "KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k [] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-23 136600] "TrueImageMonitor.exe"=M:\Programs\TrueImageMonitor.exe [2008-04-09 2595792] "AcronisTimounterMonitor"=M:\Programs\TimounterMonitor.exe [2008-04-09 909208] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360] "AdobeUpdater"=C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [2008-11-12 2356088] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [2008-10-14 623992] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2008-04-09 136472] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe [2001-05-10 102400] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA] C:\WINDOWS\system32\atiptaxx.exe [2001-09-26 245760] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] C:\Program Files\DNA\btdna.exe [2008-11-12 342336] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CmSkype] C:\Program Files\Topcom Webtalker 100\CmSkype.exe [2005-08-03 421888] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe [2001-10-04 28672] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe [2004-07-26 1867776] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Lucky Tohan^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] C:\PROGRA~1\MICROS~2\Office12\ONENOTEM.EXE [2007-12-07 101440] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "LmHosts"=3 "Irmon"=3 "Bonjour Service"=2 "Fax"=2 C:\Documents and Settings\All Users\Start Menu\Programs\Startup AutoUpdate Monitor.lnk - C:\Program Files\Sophos\AutoUpdate\ALMon.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL C:\WINDOWS\system32\sikasiso.dll " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "authentication packages"=msv1_0 relog_ap C:\WINDOWS\system32\iifedaAr "notification packages"=scecli C:\WINDOWS\system32\sikasiso.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SAVService] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SYMTDI] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "DisableTaskMgr"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=5F000000 ""= [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] ""= "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\WINDOWS\system32\P2P Networking\P2P Networking.exe"="C:\WINDOWS\system32\P2P Networking\P2P Networking.exe:*:Enabled:P2P Networking" "C:\Program Files\ASUS\AsusUpdate\Update.exe"="C:\Program Files\ASUS\AsusUpdate\Update.exe:*:Enabled:ASUS Update" "C:\Documents and Settings\Lucky Tohan\My Documents\My Music\WinMX.exe"="C:\Documents and Settings\Lucky Tohan\My Documents\My Music\WinMX.exe:*:Enabled:WinMX Application" "C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:wmplayer" "C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent" "C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\WINDOWS\system32\fxsclnt.exe"="C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" "C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer" "C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui" "C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] shell\AutoRun\command - F:\LaunchU3.exe -a ======File associations====== .reg - open - regedit.exe "%1" %* ======List of files/folders created in the last 3 months====== 2008-12-03 00:49:09 ----DC---- C:\rsit 2008-12-02 20:43:17 ----D---- C:\Program Files\Trend Micro 2008-12-02 15:44:42 ----DC---- C:\VundoFix Backups 2008-12-02 15:44:42 ----AC---- C:\VundoFix.txt 2008-11-27 00:54:10 ----A---- C:\WINDOWS\ntbtlog.txt 2008-11-27 00:51:59 ----A---- C:\WINDOWS\system32\4b4af1cf-.txt 2008-11-26 23:43:07 ----ASH---- C:\WINDOWS\system32\rAadefii.ini2 2008-11-26 23:22:45 ----D---- C:\WINDOWS\system32\dPI19 2008-11-23 22:26:47 ----A---- C:\WINDOWS\system32\javaws.exe 2008-11-23 22:26:47 ----A---- C:\WINDOWS\system32\javaw.exe 2008-11-23 22:26:47 ----A---- C:\WINDOWS\system32\java.exe 2008-11-23 22:26:47 ----A---- C:\WINDOWS\system32\deploytk.dll 2008-11-17 12:16:51 ----D---- C:\Program Files\Topcom Webtalker 100 2008-11-17 12:16:12 ----A---- C:\WINDOWS\CD_Start.INI 2008-11-13 20:46:22 ----D---- C:\Program Files\DivX 2008-11-13 02:17:30 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$ 2008-11-13 02:17:10 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$ 2008-11-13 02:16:44 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$ 2008-11-13 02:13:11 ----D---- C:\WINDOWS\system32\CatRoot2 2008-11-12 02:17:30 ----HD---- C:\WINDOWS\PIF 2008-11-11 16:37:16 ----DC---- C:\Documents and Settings\All Users\Application Data\Acronis 2008-11-11 16:35:23 ----D---- C:\Program Files\Common Files\Acronis 2008-11-10 18:50:45 ----D---- C:\Program Files\XviD 2008-11-10 18:50:16 ----DC---- C:\sav_install 2008-11-10 18:49:32 ----DC---- C:\My Downloads 2008-11-10 18:49:31 ----DC---- C:\epson 2008-11-10 18:49:29 ----D---- C:\Program Files\ActiveX Control Pad 2008-11-10 18:48:32 ----D---- C:\Program Files\Ahead 2008-11-10 18:48:31 ----D---- C:\Program Files\Common Files\xing shared 2008-11-10 18:48:31 ----D---- C:\Program Files\BitTorrent 2008-11-10 18:48:30 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2008-11-10 18:47:58 ----D---- C:\Program Files\Cucusoft 2008-11-10 18:47:58 ----D---- C:\Program Files\Creative 2008-11-10 18:47:56 ----D---- C:\Program Files\CyberLink 2008-11-10 18:47:55 ----D---- C:\Program Files\DFX 2008-11-10 18:47:54 ----D---- C:\Program Files\Google 2008-11-10 18:47:54 ----D---- C:\Program Files\FaxTalk NetOnHold 2008-11-10 18:47:54 ----D---- C:\Program Files\FaxTalk Communicator 2008-11-10 18:47:54 ----D---- C:\Program Files\EuroTool 2008-11-10 18:47:54 ----D---- C:\Program Files\EPSON 2008-11-10 18:47:07 ----D---- C:\Program Files\MSN 2008-11-10 18:46:40 ----D---- C:\Program Files\Skype 2008-11-10 18:46:36 ----D---- C:\Program Files\Windows Media Connect 2 2008-11-10 18:46:36 ----D---- C:\Program Files\Windows Journal Viewer 2008-11-10 18:45:21 ----D---- C:\Program Files\Microsoft Picture It! 9 2008-11-10 18:45:19 ----D---- C:\Program Files\Microsoft Works 2008-11-10 18:45:09 ----D---- C:\Program Files\Mozilla Firefox 2008-10-31 17:33:51 ----D---- C:\WINDOWS\system32\Adobe 2008-10-30 01:14:59 ----D---- C:\WINDOWS\system32\FxsTmp 2008-10-30 01:14:53 ----A---- C:\WINDOWS\ModemLog_PCI SoftV92 Speakerphone Modem.txt 2008-10-29 23:27:22 ----A---- C:\WINDOWS\system32\fxssend.exe 2008-10-29 23:24:55 ----A---- C:\WINDOWS\system32\fxsroute.dll 2008-10-29 23:22:58 ----A---- C:\WINDOWS\system32\fxsperf.ini 2008-10-29 22:34:35 ----A---- C:\WINDOWS\system32\fxsclntR.dll 2008-10-29 22:22:18 ----A---- C:\WINDOWS\system32\fxscfgwz.dll 2008-10-29 16:18:28 ----A---- C:\WINDOWS\ntsautodial.ini 2008-10-29 16:00:55 ----A---- C:\WINDOWS\_MSRSTRT.EXE 2008-10-27 14:24:28 ----D---- C:\WINDOWS\system32\NtmsData 2008-10-24 16:01:38 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-10-19 19:59:24 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\U3 2008-10-16 22:23:44 ----D---- C:\Program Files\Microsoft Silverlight 2008-10-16 22:22:05 ----D---- C:\WINDOWS\system32\GroupPolicy 2008-10-16 22:22:05 ----D---- C:\Program Files\Windows Desktop Search 2008-10-16 22:21:20 ----HDC---- C:\WINDOWS\$NtUninstallKB915800-v4$ 2008-10-16 16:11:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-10-16 16:11:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-10-16 16:11:00 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-10-16 16:09:33 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-10-16 16:09:01 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-10-04 16:53:57 ----A---- C:\WINDOWS\system32\sdccoinstaller.dll 2008-09-30 16:43:34 ----A---- C:\WINDOWS\system32\msxml4.dll 2008-09-19 16:55:58 ----A---- C:\WINDOWS\system32\ssldivx.dll 2008-09-19 16:55:58 ----A---- C:\WINDOWS\system32\libdivx.dll 2008-09-10 10:18:27 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2008-09-10 10:16:24 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$ ======List of files/folders modified in the last 3 months====== 2008-12-03 00:49:28 ----D---- C:\WINDOWS\Prefetch 2008-12-03 00:44:04 ----D---- C:\WINDOWS\temp 2008-12-03 00:42:01 ----AD---- C:\WINDOWS\system32 2008-12-03 00:41:55 ----D---- C:\WINDOWS\system32\drivers 2008-12-03 00:41:55 ----AD---- C:\Program Files 2008-12-03 00:41:15 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-02 11:32:33 ----SHD---- C:\WINDOWS\Installer 2008-12-02 11:32:00 ----DC---- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-11-30 14:05:35 ----SHD---- C:\System Volume Information 2008-11-30 14:05:35 ----D---- C:\WINDOWS\system32\Restore 2008-11-30 10:52:03 ----D---- C:\WINDOWS 2008-11-28 21:24:59 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\Skype 2008-11-28 21:12:55 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\skypePM 2008-11-27 10:11:14 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-11-26 23:38:03 ----SDC---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-11-26 23:38:02 ----SD---- C:\WINDOWS\Tasks 2008-11-26 23:22:45 ----D---- C:\Temp 2008-11-26 18:03:28 ----AC---- C:\WINDOWS\NeroDigital.ini 2008-11-26 16:20:04 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2008-11-26 14:57:05 ----N---- C:\WINDOWS\win.ini 2008-11-26 14:57:05 ----N---- C:\WINDOWS\system.ini 2008-11-26 14:57:05 ----ASHC---- C:\boot.ini 2008-11-26 09:49:22 ----HD---- C:\WINDOWS\inf 2008-11-26 09:49:22 ----D---- C:\WINDOWS\Help 2008-11-23 22:26:01 ----D---- C:\Program Files\Java 2008-11-22 00:39:37 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\BitTorrent 2008-11-22 00:39:26 ----AD---- C:\Program Files\WinRAR 2008-11-20 18:28:22 ----SD---- C:\Documents and Settings\Lucky Tohan\Application Data\Microsoft 2008-11-17 12:16:50 ----HD---- C:\Program Files\InstallShield Installation Information 2008-11-14 12:52:30 ----D---- C:\WINDOWS\network diagnostic 2008-11-14 00:21:24 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\DNA 2008-11-13 20:47:18 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-11-13 18:42:34 ----D---- C:\WINDOWS\SoftwareDistribution 2008-11-13 18:42:24 ----D---- C:\WINDOWS\system32\catroot2old 2008-11-13 18:42:24 ----D---- C:\WINDOWS\security 2008-11-13 18:42:24 ----D---- C:\WINDOWS\Minidump 2008-11-13 16:11:37 ----D---- C:\WINDOWS\pss 2008-11-13 11:11:36 ----D---- C:\Program Files\DNA 2008-11-13 03:25:23 ----D---- C:\WINDOWS\system32\MsDtc 2008-11-13 02:14:49 ----D---- C:\WINDOWS\system32\CatRoot 2008-11-12 21:14:37 ----RSD---- C:\WINDOWS\assembly 2008-11-12 21:12:40 ----D---- C:\WINDOWS\Microsoft.NET 2008-11-12 20:38:14 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-11-12 20:37:54 ----D---- C:\WINDOWS\WinSxS 2008-11-12 20:36:15 ----D---- C:\Program Files\Internet Explorer 2008-11-12 03:53:26 ----D---- C:\WINDOWS\Debug 2008-11-12 03:51:50 ----HD---- C:\WINDOWS\$hf_mig$ 2008-11-12 01:25:55 ----D---- C:\WINDOWS\repair 2008-11-12 00:35:43 ----D---- C:\WINDOWS\Downloaded Installations 2008-11-12 00:28:01 ----D---- C:\WINDOWS\Cache 2008-11-12 00:22:15 ----D---- C:\WINDOWS\addins 2008-11-11 20:51:43 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\AdobeAUM 2008-11-11 20:49:29 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$ 2008-11-11 20:48:37 ----D---- C:\WINDOWS\Windows Update Setup Files 2008-11-11 20:47:33 ----D---- C:\WINDOWS\java 2008-11-11 20:47:22 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$ 2008-11-11 20:46:58 ----D---- C:\Program Files\Outlook Express 2008-11-11 20:43:36 ----D---- C:\WINDOWS\system32\config 2008-11-11 20:02:11 ----DC---- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-11-11 19:53:09 ----D---- C:\Program Files\OfficeUpdate 2008-11-11 16:35:23 ----AD---- C:\Program Files\Common Files 2008-11-10 20:12:05 ----A---- C:\WINDOWS\system32\SophosBootTasks.exe 2008-11-10 19:10:26 ----D---- C:\Program Files\Sophos 2008-11-10 19:01:38 ----D---- C:\WINDOWS\system32\wbem 2008-11-10 19:01:37 ----D---- C:\WINDOWS\Registration 2008-11-10 18:49:29 ----D---- C:\Program Files\Adobe 2008-11-10 18:48:30 ----D---- C:\Program Files\Common Files\System 2008-11-10 18:47:36 ----D---- C:\Program Files\Movie Maker 2008-11-10 18:47:06 ----D---- C:\Program Files\MSN Messenger 2008-11-10 18:46:36 ----D---- C:\Program Files\Windows Media Player 2008-11-10 18:46:24 ----D---- C:\Program Files\Windows NT 2008-11-03 12:09:04 ----D---- C:\WINDOWS\Media 2008-10-30 01:40:31 ----DC---- C:\Backup 2008-10-29 23:27:40 ----D---- C:\WINDOWS\ServicePackFiles 2008-10-29 22:23:34 ----D---- C:\WINDOWS\system32\inetsrv 2008-10-29 16:00:44 ----D---- C:\WINDOWS\system32\Macromed 2008-10-27 00:10:53 ----D---- C:\WINDOWS\system32\en-US 2008-10-16 22:02:23 ----D---- C:\WINDOWS\system32\ReinstallBackups 2008-10-16 22:01:32 ----D---- C:\Program Files\CONEXANT 2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuweb.dll 2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuaueng.dll 2008-10-16 14:12:22 ----A---- C:\WINDOWS\system32\wucltui.dll 2008-10-16 14:12:20 ----A---- C:\WINDOWS\system32\wuapi.dll 2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wups2.dll 2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wuauclt.exe 2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\cdm.dll 2008-10-16 14:09:40 ----A---- C:\WINDOWS\system32\wucltui.dll.mui 2008-10-16 14:08:58 ----A---- C:\WINDOWS\system32\wups.dll 2008-10-16 14:07:44 ----A---- C:\WINDOWS\system32\wuapi.dll.mui 2008-10-16 14:07:14 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui 2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\muweb.dll 2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll.mui 2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll 2008-10-15 19:47:14 ----DC---- C:\WINDOWS\system32\DRVSTORE 2008-10-15 11:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll 2008-10-13 23:51:44 ----AC---- C:\WINDOWS\plugSpk.INI 2008-10-13 14:09:30 ----RHD---- C:\Documents and Settings\All Users\Application Data\yahoo! 2008-10-13 14:04:26 ----D---- C:\Program Files\Microsoft Office 2008-10-13 14:04:21 ----D---- C:\Program Files\Common Files\Microsoft Shared 2008-10-13 14:03:30 ----D---- C:\WINDOWS\ShellNew 2008-10-13 12:43:49 ----D---- C:\Program Files\Bonjour 2008-10-03 12:41:15 ----A---- C:\WINDOWS\system32\ieframe.dll 2008-09-09 20:14:56 ----A---- C:\WINDOWS\system32\msxml6.dll 2008-09-08 01:17:32 ----D---- C:\Documents and Settings\Lucky Tohan\Application Data\Mozilla 2008-09-05 22:30:42 ----A---- C:\WINDOWS\system32\WgaLogon.dll 2008-09-05 22:30:06 ----A---- C:\WINDOWS\system32\LegitCheckControl.dll 2008-09-05 22:29:58 -------- C:\WINDOWS\system32\WgaTray.exe 2008-09-04 12:15:04 ----A---- C:\WINDOWS\system32\msxml3.dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 P3;Intel PentiumIII Processor Driver; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-13 42752] R1 SAVOnAccessControl;SAVOnAccessControl; C:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys [2008-07-18 104704] R1 SAVOnAccessFilter;SAVOnAccessFilter; C:\WINDOWS\system32\DRIVERS\savonaccessfilter.sys [2008-07-18 35584] R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032] R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1997-12-22 23936] R2 irda;IrDA Protocol; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2006-06-19 12672] R2 PfModNT;PfModNT; \??\C:\WINDOWS\System32\PfModNT.sys [] R2 StreamDispatcher;StreamDispatcher; C:\WINDOWS\System32\DRIVERS\strmdisp.sys [2003-01-08 22144] R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2008-11-11 44384] R3 ati2mtaa;ati2mtaa; C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys [2001-09-26 285088] R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2002-06-12 284288] R3 emu10k1;Creative Interface Manager Driver (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2002-06-12 7424] R3 FETNDISB;D-Link PCI Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\dlkfet5b.sys [2007-05-16 43008] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-04-26 988032] R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys [2007-04-26 267520] R3 irsir;Microsoft Serial Infrared Driver; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688] R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128] R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 sfman;Creative SoundFont Manager Driver (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2002-06-12 36992] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2007-04-26 731136] S3 Amps2prt;A4Tech PS/2 Port Mouse Driver; C:\WINDOWS\System32\DRIVERS\Amps2prt.sys [] S3 ASUSHWIO;ASUSHWIO; \??\C:\WINDOWS\System32\drivers\ASUSHWIO.sys [] S3 ati2mpaa;ati2mpaa; C:\WINDOWS\System32\DRIVERS\ati2mpaa.sys [2001-08-17 281856] S3 basic2;basic2; C:\WINDOWS\System32\DRIVERS\HSF_BSC2.sys [2001-08-17 67167] S3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\System32\drivers\ctac32k.sys [2002-03-22 114944] S3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2002-03-22 835636] S3 ctljystk;Creative SBLive! Gameport; C:\WINDOWS\System32\DRIVERS\ctljystk.sys [2001-08-17 3712] S3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\System32\drivers\ctprxy2k.sys [2002-03-22 11068] S3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\drivers\ctsfm2k.sys [2002-03-22 211724] S3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\System32\drivers\emupia2k.sys [2002-03-22 156604] S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165] S3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\WINDOWS\system32\drivers\ha10kx2k.sys [2002-03-22 991656] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 HSF_DP;HSF_DP; C:\WINDOWS\System32\DRIVERS\HSF_DP.sys [2003-01-08 1068032] S3 hsf_msft;hsf_msft; C:\WINDOWS\System32\DRIVERS\HSF_MSFT.sys [2001-08-17 542879] S3 mohfilt;mohfilt; C:\WINDOWS\system32\drivers\mohfilt.sys [] S3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2002-03-22 195432] S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-08-26 47360] S3 Rksample;Rksample; C:\WINDOWS\System32\DRIVERS\HSF_SAMP.sys [2001-08-17 57471] S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-23 5888] S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [] S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] S4 SophosBootDriver;SophosBootDriver; C:\WINDOWS\system32\DRIVERS\SophosBootDriver.sys [2008-05-23 14976] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 EPSONStatusAgent2;EPSON Printer Status Agent2; C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe [2001-08-09 90112] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-23 152984] R2 SAVAdminService;Sophos Anti-Virus status reporter; C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2008-10-23 69632] R2 SAVService;Sophos Anti-Virus; C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe [2008-10-04 98304] R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service; C:\Program Files\Sophos\AutoUpdate\ALsvc.exe [2008-10-04 172032] R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\System32\MsPMSPSv.exe [2000-06-26 53520] R3 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2008-04-09 431384] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-08-22 654848] S3 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-02-17 73728] S3 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2003-06-19 322120] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 TryAndDecideService;Acronis Try And Decide Service; C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [2008-04-09 492896] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336] S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2000-11-30 57344] S4 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376] S4 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776] S4 Irmon;Infrared Monitor; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336] S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [] S4 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136] -----------------EOF----------------- |
|
|
|
|
Dec 3 2008, 12:16 AM
Post
#5
|
|
|
Member Posts: 45 From: Toronto OS: xp sp3 |
and the third log you requested: info.txt logfile of random's system information tool 1.04 2008-12-03 00:49:38 ======Uninstall list====== -->"C:\Program Files\Creative\SBLive\Program\Ctzapxx.EXE" /X /U /S /R -->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 -->C:\Program Files\Creative\SBLive\Program\Upddrv2k.EXE -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\News\CTNews.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\AudioHQ.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Diagnose.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Restore.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\SoundFont.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\SurMixer.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\WaveStudio\Wstudio.isu" -->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Uninstall\Installer.isu" -->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {926CC8AE-8414-43DF-8EB4-CF26D9C3C663} -->RunDll32 C:\WINDOWS\System32\cd_clint.dll,ServiceRunDll u_291 "{FA89A7AC-EABF-4D73-B19F-0C3D858D24EF}" -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} Acronis True Image Home-->MsiExec.exe /X{633A06C3-B709-479A-AAB3-5EE94AD9EE4B} Adobe Acrobat 8.1.3 Professional-->msiexec /I {AC76BA86-1033-F400-7760-000000000003} Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7} Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log ATI Display Driver-->rundll32 C:\WIND |