Okay, done finally. I think I made a mistake during the Avast boot-time scan, rather than saying move to box I think I accidentally told Avast to delete it. I'm not sure whether that is a bad thing or not.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
HJT Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:51:28 PM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://ie.redirect.h...a...n&pf=laptopR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Mega Sound Recorder] C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
http://pcpitstop.com...p/PCPitStop.CABO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.mi...b?1199080336812O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 10601 bytes
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Avast Log
CmdLine - quick
aswBoot.exe /A:"*" /L:"English" /archives /KBD:3
CmdLine end
CreateKbThread
new CKbBuffer
CKbBuffer::Init
CKbBuffer::Init end
NtCreateEvent(g_hStopEvent)
NtAllocateVirtualMemory - stack
NtGetContextThread - NtCurrentThread
NtCreateThread - KbThread
CreateKbThread end
NtInitializeRegistry
KbThread start
ReadRegistry
DATA=C:\Program Files\Alwil Software\Avast4\DATA
PROG=C:\Program Files\Alwil Software\Avast4
BUILD=1098
Microsoft Windows XP Service Pack 2
SystemRoot=C:\WINDOWS
TEMP=C:\WINDOWS\TEMP
TMP=C:\WINDOWS\TEMP
ReadRegistry end
CreateTemp
CreateTemp end
cmnbInit
SetFolders
SetFolders end
aswEnginDllMain(DLL_PROCESS_ATTACH)
InitLog
InitLog end
CmdLine - full
aswBoot.exe /A:"*" /L:"English" /archives /KBD:3
CmdLine end
Unschedule
61,00,75,00,74,00,6F,00,63,00,68,00,65,00,63,00,
6B,00,20,00,61,00,75,00,74,00,6F,00,63,00,68,00,
6B,00,20,00,2A,00,00,00,61,00,73,00,77,00,42,00,
6F,00,6F,00,74,00,2E,00,65,00,78,00,65,00,20,00,
2F,00,41,00,3A,00,22,00,2A,00,22,00,20,00,2F,00,
4C,00,3A,00,22,00,45,00,6E,00,67,00,6C,00,69,00,
73,00,68,00,22,00,20,00,2F,00,61,00,72,00,63,00,
68,00,69,00,76,00,65,00,73,00,20,00,2F,00,4B,00,
42,00,44,00,3A,00,33,00,00,00,00,00,
Unschedule end
LoadResources
LoadResources end
InitReport
InitReport end
NtSetEvent(g_hInitEvent) - 1
InitKeyboard
FreeMemory: 840552448
aswintegInitialize
g_dwKbdNum: 3
s_dwKbdClassCnt: 3
InitKeyboard end
NtSetEvent(g_hInitEvent) - 2
GetKey
avworkInitialize
FreeMemory: 806322176
CKbBuffer::Wait
CKbBuffer::Get
CKbBuffer::Get end
CKbBuffer::Wait end
ProcessArea
avfilesScanReal(MBR0)
avfilesScanReal C:\
CKbBuffer::Get
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
CKbBuffer::Get end
MarkFileRemoval
0, 80, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
MarkFileRemoval end
0, 80, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 72, 3, 0, 0
0, 80, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 80, 3, 0, 0
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 2, 0, 0
GetKey end
CKbBuffer::Put
CKbBuffer::Put end
GetKey
0, 72, 3, 0, 0
CKbBuffer::Get
CKbBuffer::Get end
avfilesScanReal D:\
avworkClose
aswintegClose
TerminateKbThread
GetKey end
CloseKeyboard
CloseKeyboard end
KbThread stop
CKbBuffer::~CKbBuffer
CKbBuffer::~CKbBuffer end
aswEnginDllMain(DLL_PROCESS_DETACH)
cmnbFree
FreeResources
CloseReport
CloseLog
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ComboFix Log
ComboFix 08-02.05.3 - Ian 2008-02-09 15:35:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.419 [GMT -8:00]
Running from: C:\Documents and Settings\Ian\Temporary Internet Files\Content.IE5\JT16O7DR\ComboFix[2].exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\itbvrmsw.ini
C:\WINDOWS\system32\jmllm.ini
C:\WINDOWS\system32\jmllm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mrhwwjti.ini
C:\WINDOWS\system32\nggttdgf.ini
C:\WINDOWS\system32\pvnqklrs.ini
C:\WINDOWS\system32\wycdd.ini2
C:\WINDOWS\system32\yxcpsngf.ini
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-01-09 to 2008-02-09 )))))))))))))))))))))))))))))))
.
2008-02-09 15:32 . 2008-02-09 15:32 <DIR> d-------- C:\_OTMoveIt
2008-02-09 12:18 . 2008-02-09 12:18 <DIR> d-------- C:\Program Files\Alwil Software
2008-02-09 12:18 . 2007-12-04 05:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-09 12:18 . 2004-01-09 01:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-09 12:18 . 2007-12-04 04:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-09 12:18 . 2007-12-04 06:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-09 12:18 . 2007-12-04 06:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-09 12:18 . 2007-12-04 06:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-09 12:18 . 2007-12-04 06:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-09 12:18 . 2007-12-04 06:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-08 20:34 . 2008-02-08 20:34 <DIR> d-------- C:\Documents and Settings\jan\Application Data\Grisoft
2008-02-08 17:11 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\Grisoft
2008-02-08 17:11 . 2008-02-08 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-08 17:11 . 2007-05-30 04:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-07 19:23 . 2008-02-07 19:23 <DIR> d-------- C:\Program Files\PCPitstop
2008-02-07 15:33 . 2008-02-07 15:33 <DIR> d-------- C:\Documents and Settings\jan\Application Data\Apple Computer
2008-02-06 17:44 . 2008-02-09 14:59 <DIR> d-------- C:\VundoFix Backups
2008-02-04 22:42 . 2008-02-04 22:44 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\MSNInstaller
2008-02-02 19:47 . 2008-02-02 19:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-02-02 00:12 . 2008-02-02 00:12 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-01 22:47 . 2008-02-01 22:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-01 22:38 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-01 22:15 . 2008-02-06 17:41 <DIR> d--hs---- C:\Documents and Settings\NetworkService\Temporary Internet Files
2008-02-01 22:15 . 2008-02-01 22:15 <DIR> d--hs---- C:\Documents and Settings\NetworkService\History
2008-02-01 17:15 . 2008-02-01 17:15 0 --a------ C:\Documents and Settings\Ian\mspformat.exe
2008-02-01 16:52 . 2008-02-01 16:52 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-02-01 16:06 . 2008-02-01 16:06 <DIR> d-------- C:\WINDOWS\WinAVI Video Converter 9.0
2008-02-01 16:06 . 2008-02-01 16:06 <DIR> d-------- C:\Program Files\WinAVI Video Converter 9.0
2008-02-01 15:29 . 2004-03-08 23:00 662,288 --a------ C:\WINDOWS\system32\MSComCt2.ocx
2008-02-01 15:29 . 2001-03-13 12:50 525,352 --a------ C:\WINDOWS\system32\dbgrid32.ocx
2008-02-01 15:29 . 2001-08-17 12:18 508,928 --a------ C:\WINDOWS\system32\msde.dll
2008-02-01 15:29 . 2004-03-08 23:00 131,856 --a------ C:\WINDOWS\system32\msadodc.ocx
2008-02-01 15:29 . 2001-03-13 12:53 77,824 --a------ C:\WINDOWS\system32\msbind.dll
2008-02-01 15:29 . 2005-01-16 10:58 45,056 --a------ C:\WINDOWS\system32\FxProgressBar.ocx
2008-02-01 15:29 . 2003-03-06 10:43 36,864 --a------ C:\WINDOWS\system32\FxPanel.ocx
2008-02-01 15:29 . 2003-01-22 18:37 29,696 --a------ C:\WINDOWS\system32\SSubTmr.dll
2008-02-01 15:28 . 1999-02-16 20:49 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2008-02-01 15:28 . 2004-07-14 15:26 152,848 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-02-01 15:11 . 2008-02-01 15:11 1,184,494 --ahs---- C:\WINDOWS\system32\xnodktsv.tmp
2008-01-31 18:23 . 2008-02-06 17:41 <DIR> d--hs---- C:\Documents and Settings\LocalService\Temporary Internet Files
2008-01-31 18:23 . 2008-01-31 18:23 <DIR> d--hs---- C:\Documents and Settings\LocalService\History
2008-01-31 17:16 . 2008-01-31 18:23 26,808 --a------ C:\WINDOWS\system32\ikhcore.cfg
2008-01-31 17:04 . 2008-01-31 18:26 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-30 23:11 . 2008-01-30 23:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2008-01-30 21:18 . 2008-01-30 21:18 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\Publish Providers
2008-01-30 21:07 . 2008-01-30 21:07 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\Sony
2008-01-30 18:52 . 2008-01-30 18:52 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\Acoustica
2008-01-30 18:52 . 2007-08-07 11:32 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll
2008-01-29 22:16 . 2008-01-29 22:38 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\LimeWire
2008-01-29 16:31 . 2008-01-29 16:31 <DIR> d-------- C:\Documents and Settings\jan\Application Data\IEPro
2008-01-28 12:50 . 2008-01-28 12:50 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-01-28 12:02 . 2008-01-28 12:02 <DIR> d-------- C:\WINDOWS\Performance
2008-01-28 12:02 . 2008-01-28 12:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Corporation
2008-01-28 12:00 . 2008-01-28 12:02 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\MiniDm
2008-01-28 11:50 . 2008-01-28 12:04 1,905 --a------ C:\WINDOWS\diagwrn.xml
2008-01-28 11:50 . 2008-01-28 12:04 1,905 --a------ C:\WINDOWS\diagerr.xml
2008-01-27 22:18 . 2008-01-27 22:18 <DIR> d-------- C:\Program Files\Restoration
2008-01-27 22:12 . 2008-01-27 22:12 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\IEPro
2008-01-27 22:11 . 2008-01-27 22:12 <DIR> d-------- C:\Program Files\IEPro
2008-01-27 22:10 . 2008-01-27 22:11 <DIR> d-------- C:\Program Files\IE7Pro
2008-01-27 22:10 . 2008-01-27 22:11 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\IE7Pro
2008-01-26 22:09 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-01-26 22:09 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\dllcache\mouhid.sys
2008-01-26 21:12 . 2008-01-26 21:12 <DIR> d-------- C:\Documents and Settings\jan\Application Data\MailFrontier
2008-01-26 19:42 . 2008-01-26 19:42 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-01-24 16:58 . 2008-01-24 16:58 74,703 --a------ C:\WINDOWS\system32\mfc45.dll
2008-01-24 16:53 . 2008-01-24 16:53 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\iolo
2008-01-24 16:53 . 2008-01-24 16:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\iolo
2008-01-24 15:52 . 2008-01-25 15:14 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\MailFrontier
2008-01-24 15:44 . 2008-02-09 15:42 7,811,360 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-24 15:44 . 2008-02-09 15:40 107,756 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-24 15:41 . 2007-11-14 16:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
2008-01-24 15:40 . 2008-01-24 15:40 <DIR> d-------- C:\Program Files\Zone Labs
2008-01-24 15:25 . 2008-01-24 15:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-24 00:22 . 2008-02-09 15:32 1,128 --a------ C:\rollback.ini
2008-01-21 22:42 . 2007-03-07 15:51 129,784 --a------ C:\WINDOWS\system32\pxafs.dll
2008-01-21 22:42 . 2007-03-07 15:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-01-21 22:42 . 2007-03-07 15:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-01-19 10:57 . 2008-01-19 10:57 <DIR> d-------- C:\Documents and Settings\Ian\Application Data\Media Player Classic
2008-01-18 23:35 . 2008-01-18 23:36 <DIR> d-------- C:\Program Files\iTunes
2008-01-18 23:35 . 2008-01-18 23:35 <DIR> d-------- C:\Program Files\iPod
2008-01-18 23:34 . 2008-01-22 17:44 <DIR> d-------- C:\Program Files\Bonjour
2008-01-17 21:56 . 2008-01-26 12:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-01-17 21:55 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-01-17 21:55 . 2008-02-06 15:19 4,212 --ah----- C:\WINDOWS\system32\zllictbl.dat
2008-01-17 21:54 . 2008-02-07 21:33 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2008-01-17 21:53 . 2008-02-09 15:32 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-01-17 21:11 . 2008-01-17 21:11 <DIR> d-------- C:\Program Files\MSBuild
2008-01-17 21:08 . 2008-01-28 12:55 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-01-17 21:07 . 2008-01-17 21:07 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-01-17 21:06 . 2008-01-17 21:06 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-01-17 21:06 . 2008-01-17 21:06 <DIR> d-------- C:\edd0bb392d5d6186878d4d488dde
2008-01-17 21:06 . 2006-06-29 13:07 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll
2008-01-17 20:56 . 2006-11-12 22:02 288,768 --a------ C:\WINDOWS\system32\rhttpaa.dll
2008-01-17 20:56 . 2006-11-12 22:02 116,736 --a------ C:\WINDOWS\system32\aaclient.dll
2008-01-17 20:56 . 2006-11-12 22:02 36,352 --a------ C:\WINDOWS\system32\tsgqec.dll
2008-01-12 21:41 . 2008-01-12 21:42 <DIR> d-------- C:\Documents and Settings\Ronnie\Application Data\Yahoo!
2008-01-11 20:19 . 2008-01-11 20:19 <DIR> d-------- C:\Documents and Settings\jan\Application Data\Yahoo!
2008-01-11 20:17 . 2008-01-11 20:17 <DIR> d-------- C:\Microsoft
2008-01-11 20:17 . 2007-12-28 22:22 <DIR> d-------- C:\Documents and Settings\jan\Application Data\Intuit
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-09 23:42 --------- d-----w C:\Program Files\MegaSoundRecorder
2008-02-09 10:49 --------- d-----w C:\Documents and Settings\Ian\Application Data\Azureus
2008-02-06 23:33 --------- d-----w C:\Documents and Settings\Ian\Application Data\U3
2008-02-05 06:49 --------- d-----w C:\Program Files\RGB
2008-02-05 06:46 --------- d-----w C:\Program Files\Hewlett-Packard
2008-02-05 06:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-05 06:38 --------- d-----w C:\Documents and Settings\Ian\Application Data\Yahoo!
2008-02-05 06:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-02-05 06:25 --------- d-----w C:\Program Files\Real
2008-02-02 06:38 --------- d-----w C:\Program Files\Java
2008-02-02 00:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-26 06:53 --------- d-----w C:\Documents and Settings\Ian\Application Data\Apple Computer
2008-01-19 07:34 --------- d-----w C:\Program Files\QuickTime
2008-01-10 03:14 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-10 03:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-10 00:15 --------- d-----w C:\Program Files\Microsoft Works
2008-01-09 03:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-01-07 22:41 --------- d-----w C:\Program Files\[bleep] NFO Viewer
2008-01-06 04:44 --------- d-----w C:\Program Files\CONEXANT
2008-01-06 04:23 --------- d-----w C:\Program Files\HP
2008-01-05 06:30 --------- d-----w C:\Documents and Settings\Ian\Application Data\HP
2008-01-05 06:30 --------- d-----w C:\Documents and Settings\Ian\Application Data\CyberLink
2008-01-04 21:35 --------- d-----w C:\Program Files\Combined Community Codec Pack
2008-01-04 21:07 --------- d-----w C:\Program Files\Azureus
2008-01-04 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-31 07:02 --------- d-----w C:\Program Files\MSXML 4.0
2007-12-30 06:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-30 06:45 --------- d-----w C:\Program Files\Audacity
2007-12-30 06:39 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-12-30 06:39 --------- d-----w C:\Program Files\FLV Player
2007-12-30 06:26 --------- d-----w C:\Program Files\Yahoo!
2007-12-30 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-30 06:21 --------- d-----w C:\Program Files\Common Files\Apple
2007-12-30 06:21 --------- d-----w C:\Program Files\Apple Software Update
2007-12-30 06:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-30 06:20 --------- d-----w C:\Program Files\Common Files\xing shared
2007-12-30 06:20 --------- d-----w C:\Program Files\Common Files\Real
2007-12-30 06:19 --------- d-----w C:\Program Files\IZArc
2007-12-30 06:17 --------- d-----w C:\Program Files\Vernier Software
2007-12-30 06:17 --------- d-----w C:\Program Files\Common Files\Vernier Software
2007-12-30 06:17 --------- d-----w C:\Program Files\Common Files\TI Shared
2007-12-30 06:16 --------- d-----w C:\Documents and Settings\Ian\Application Data\InstallShield
2007-12-30 06:14 --------- d-----w C:\Program Files\Windows Installer Clean Up
2007-12-30 06:14 --------- d-----w C:\Program Files\MSECACHE
2007-12-30 06:08 --------- d-----w C:\Program Files\CCleaner
2007-12-30 06:00 --------- d-----w C:\Program Files\Google
2007-12-29 19:29 --------- d-----w C:\Program Files\Common Files\SWF Studio
2007-12-29 07:10 1,718 --sha-r C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Pavilion dv6000 (RG272UA#ABA)_YN_0Pavi_QCNF6443VJC_E432250002_46_I30B7_SQuanta_V65.28_BF.3A_T070
719_WXP2_L409_M959_J80_7AMD_8Turion 64 X2 Technology TL-50_91.61_#060919_N_(RG272UA#ABA)_XMOBILE_CN10.MRK
2007-12-29 07:05 --------- d-----w C:\Program Files\HPQ
2007-12-29 06:39 --------- d-----w C:\Program Files\Windows Plus
2007-12-29 06:36 --------- d-----w C:\Program Files\Synaptics
2007-12-29 06:36 --------- d-----w C:\Program Files\Sonic
2007-12-29 06:35 --------- d-----w C:\Program Files\Quickensetup
2007-12-29 06:35 --------- d-----w C:\Program Files\Quicken
2007-12-29 06:33 --------- d-----w C:\Program Files\muvee Technologies
2007-12-29 06:33 --------- d-----w C:\Program Files\Microsoft Office Trial Wizard
2007-12-29 06:32 --------- d-----w C:\Program Files\Microsoft Money 2006
2007-12-29 06:32 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-29 06:30 --------- d-----w C:\Program Files\DivX
2007-12-29 06:30 --------- d-----w C:\Program Files\Common Files\TiVo Shared
2007-12-29 06:30 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2007-12-29 06:30 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-12-29 06:30 --------- d-----w C:\Program Files\Common Files\Palo Alto Software
2007-12-29 06:30 --------- d-----w C:\Program Files\Common Files\muvee Technologies
2007-12-29 06:29 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-12-29 06:29 --------- d-----w C:\Program Files\Common Files\Java
2007-12-29 06:29 --------- d-----w C:\Program Files\Common Files\Intuit
2007-12-29 06:29 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-12-29 06:29 --------- d-----w C:\Program Files\Common Files\HP
2007-12-29 06:22 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec
2007-12-29 06:22 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\Intuit
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\Ronnie\Application Data\Intuit
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\Ian\Application Data\Intuit
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sonic
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Intuit
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2007-12-29 06:22 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Intuit
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 20:00 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"Mega Sound Recorder"="C:\Program Files\MegaSoundRecorder\Mega Sound Recorder.exe" [2007-08-06 11:34 270336]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 20:56 64512]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-03 21:58 458752]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-09-27 17:10 7585792]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-09-27 17:10 86016]
"nwiz"="nwiz.exe" [2006-09-27 17:10 1617920 C:\WINDOWS\system32\nwiz.exe]
"MsmqIntCert"="regsvr32 /s mqrt.dll" []
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 22:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-09-15 02:27 1015808]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-11 20:55 102400]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 10:33 163840]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 15:02 40960]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 09:23 1187840]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-03-15 12:00 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2006-03-15 12:00 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-03-15 12:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-03-15 12:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-03-15 12:00 455168]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 02:29 102400]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-29 22:20 185896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30 249856]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 22:11 49152]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 05:00 79224]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 08:39:30 73728]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)
R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-05 15:49]
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;C:\WINDOWS\system32\Drivers\5U870CAP.sys [2006-06-06 12:39]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-02-09 15:42:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe????????????<?@? ???@Z??????Y?@?????<?@
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
.
**************************************************************************
.
Completion time: 2008-02-09 15:46:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-09 23:45:54
.
2008-01-28 21:20:10 --- E O F ---
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
OTMoveit Log
File/Folder C:\WINDOWS\system32\ikspahrn.dll not found.
File/Folder C:\WINDOWS\system32\mllmj.dll not found.
File/Folder C:\WINDOWS\system32\huqgmhhc.dll not found.
OTMoveIt2 v1.0.19 log created on 02092008_153231
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------