Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

HJT Logs Plz help Not Sure Whats goin on... [CLOSED]

Started by technolackey , Jul 13 2008 05:43 PM

This topic is locked

#1
technolackey

Posted 13 July 2008 - 05:43 PM

Member

Member
12 posts

Comp was getting poor load times, wasnt opening things i clicked on, wouldnt shutdown (stall in shutdown window)
Have AVG, ADAWARE, PCBUgdoctor, USE FSECURE and TrendMicro Online AV scans...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:38:35 PM, on 7/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
F3 - REG:win.ini: run=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C5E019769AA475760EA83FA5EF80752B9499803B2A2303766A - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {B4D3606E-E871-4A32-AF2E-3143541B0AC2} - (no file)
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100005000004} - https://secure.wideb...b685ebe1_35.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: awtst - C:\WINDOWS\system32\awtst.dll (file missing)
O20 - Winlogon Notify: rqrqoom - rqrqoom.dll (file missing)
O20 - Winlogon Notify: winktu32 - winktu32.dll (file missing)
O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 7519 bytes

#2
fenzodahl512

Posted 14 July 2008 - 09:15 AM

Malware Removal
9,863 posts

Hello, my name is fenzodahl512 and welcome to Geekstogo.. Please do the following....

Please download Deckard's System Scanner (DSS) from HERE or HERE and save it to your Desktop.

Close all other windows before proceeding.
Double-click on dss.exe and follow the prompts.
Please let your firewall allow the scanning/downloading process.
When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Regards
fenzodahl512

#3
technolackey

Posted 14 July 2008 - 03:33 PM

Member

Topic Starter
Member
12 posts

Main.txt
~~~~~~~~~~~~~
Deckard's System Scanner v20071014.68
Run by Tech1 on 2008-07-14 15:25:26
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.

-- Last 1 Restore Point(s) --
1: 2008-07-14 21:25:31 UTC - RP1 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

-- HijackThis (run as Tech1.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:27:13 PM, on 7/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Azureus\Azureus.exe
C:\Documents and Settings\Tech1\Local Settings\Temporary Internet Files\Content.IE5\W3MZUJEX\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Tech1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
F3 - REG:win.ini: run=
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Seekmo /fleok=1D8A83A5C5E019769AA475760EA83FA5EF80752B9499803B2A2303766A - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {57E218E6-5A80-4f0c-AB25-83598F25D7E9} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: (no name) - {B4D3606E-E871-4A32-AF2E-3143541B0AC2} - (no file)
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100005000004} - https://secure.wideb...b685ebe1_35.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: awtst - C:\WINDOWS\system32\awtst.dll (file missing)
O20 - Winlogon Notify: rqrqoom - rqrqoom.dll (file missing)
O20 - Winlogon Notify: winktu32 - winktu32.dll (file missing)
O22 - SharedTaskScheduler: enlodgement - {aa6d4f53-4c8d-4549-84d2-02d584acc4e9} - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 7627 bytes

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 Teefer (Teefer for NT) - c:\windows\system32\drivers\teefer.sys <Not Verified; Sygate Technologies, Inc.; Sygate Teefer Driver>
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt>
R3 cmigameport - c:\windows\system32\drivers\cmigameport.sys
R3 cmpci (C-Media PCI Audio Driver (WDM)) - c:\windows\system32\drivers\cmaudio.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>

S1 SysTool (SysTool Overclocking Utility) - c:\windows\system32\drivers\systool.sys <Not Verified; ; Low-Level Driver>
S2 ASInsHelp - c:\windows\system32\drivers\asinshelp32.sys (file missing)
S3 Afc (PPdus ASPI Shell) - c:\windows\system32\drivers\afc.sys <Not Verified; Arcsoft, Inc.; Arcsoft® ASPI Shell>
S3 AmdTools (AMD Special Tools Driver) - c:\windows\system32\drivers\amdtools.sys (file missing)
S3 dtscsi - c:\windows\system32\drivers\dtscsi.sys (file missing)
S3 GDMSRV0 - c:\windows\system32\gdmsrv.sys
S3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\program files\wireless-n pci adapter\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
S3 mcdbus (Driver for MagicISO SCSI Host Controller) - c:\windows\system32\drivers\mcdbus.sys (file missing)
S3 ndiscm (Motorola SURFboard USB Cable Modem Windows Driver) - c:\windows\system32\drivers\netmotcm.sys (file missing)
S3 SQ931 (Zoom 2.0 Webcam) - c:\windows\system32\drivers\capt931a.sys
S3 SQTECH930B (USB 2.0 Webcam) - c:\windows\system32\drivers\capt930b.sys

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S2 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)
S2 COM+ Messages - "c:\windows\system32\svchosts.exe" -e mc-110-12-0000272 (file missing)
S2 LiveUpdate Notice Ex (LiveUpdate Notice Service Ex) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {85B5DDD0-E090-4B15-BDF2-A443A3CA0B66}
Description: ATITool Driver
Device ID: ROOT\*ATITOOLDEVICE\0000
Manufacturer: W1zzard
Name: ATITool Driver
PNP Device ID: ROOT\*ATITOOLDEVICE\0000
Service: ATITool

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: Realtek AC'97 Audio
Device ID: PCI\VEN_10DE&DEV_0059&SUBSYS_81AE1043&REV_A2\3&2411E6FE&0&20
Manufacturer: Realtek
Name: Realtek AC'97 Audio
PNP Device ID: PCI\VEN_10DE&DEV_0059&SUBSYS_81AE1043&REV_A2\3&2411E6FE&0&20
Service: ALCXWDM

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: NVIDIA nForce Networking Controller
Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&1F09082D&0&01
Manufacturer: NVIDIA
Name: NVIDIA nForce Networking Controller
PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&1F09082D&0&01
Service: NVENETFD

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: MPU-401 Compatible MIDI Device
Device ID: ACPI\PNPB006\3&2411E6FE&0
Manufacturer: Microsoft
Name: MPU-401 Compatible MIDI Device
PNP Device ID: ACPI\PNPB006\3&2411E6FE&0
Service: ms_mpu401

-- Scheduled Tasks -------------------------------------------------------------

2008-07-09 23:38:02 284 --a----c- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-07-04 17:15:00 390 --a----c- C:\WINDOWS\Tasks\1-Click Maintenance.job

-- Files created between 2008-06-14 and 2008-07-14 -----------------------------

2008-07-11 00:04:44 0 d-------- C:\Program Files\EA GAMES
2008-07-09 13:20:46 0 d-------- C:\Program Files\PixiePack Codec Pack
2008-07-09 13:20:07 0 d-------- C:\Documents and Settings\Tech1\Application Data\Tunebite
2008-07-09 13:18:29 0 d-------- C:\Program Files\RapidSolution
2008-07-09 13:18:29 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\RapidSolution
2008-07-09 13:07:16 0 d-------- C:\Program Files\Trend Micro
2008-07-09 11:31:52 0 d-------- C:\Documents and Settings\Tech1\DoctorWeb
2008-07-06 12:07:36 3712 --a------ C:\WINDOWS\system32\drivers\cmigameport.sys
2008-07-06 12:07:36 373952 --a------ C:\WINDOWS\system32\drivers\cmaudio.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
2008-07-06 12:07:36 32768 --a------ C:\WINDOWS\system32\cmnprop.dll <Not Verified; C-Media Corporation; CMI8738/CMI9738 Audio Device>
2008-07-06 12:07:36 712704 --a------ C:\WINDOWS\system32\Audio3D.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-07-06 12:07:36 765952 --a------ C:\WINDOWS\system\crlds3d.dll <Not Verified; Sensaura Ltd; Sensaura 3DPA>
2008-07-06 12:07:36 1855488 --a------ C:\WINDOWS\mixer.exe <Not Verified; C-Media Electronic Inc. (www.cmedia.com.tw); Mixer>
2008-07-06 12:07:36 139264 --a------ C:\WINDOWS\cmuninst.exe <Not Verified; C-Media Electronics Inc.; CMIUninst Application>
2008-07-06 12:07:36 135168 --a------ C:\WINDOWS\cmuninst.dat <Not Verified; C-Media Electronics Inc.; CMIUninst Application>
2008-07-06 12:07:36 39319 --a------ C:\WINDOWS\cmijack.dat
2008-07-06 12:07:36 23041 --a------ C:\WINDOWS\cmaudio.dat
2008-07-06 02:16:35 2746 --a------ C:\WINDOWS\system32\GDMSRV.SYS
2008-07-05 19:14:45 712704 --a------ C:\WINDOWS\system32\a3d.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-07-05 19:14:45 0 d-------- C:\Gamesurround Muse Series Drivers
2008-07-05 12:11:20 0 d--h----- C:\$AVG8.VAULT$
2008-07-05 12:06:25 0 d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-05 12:06:25 0 d-------- C:\Documents and Settings\Tech1\Application Data\AVGTOOLBAR
2008-06-30 16:33:52 0 d-------- C:\Program Files\AVG

-- Find3M Report ---------------------------------------------------------------

2008-07-14 15:27:46 0 d-------- C:\Documents and Settings\Tech1\Application Data\Azureus
2008-07-13 23:00:50 0 d-------- C:\Program Files\Steam
2008-07-13 18:47:32 0 d-------- C:\Program Files\THQ
2008-07-09 00:58:06 0 d-------- C:\Program Files\PcBugDoctor
2008-07-08 00:52:48 0 d-------- C:\Program Files\PowerISO
2008-07-05 19:14:45 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-01 11:59:55 0 d-------- C:\Program Files\HTV
2008-06-12 22:29:30 0 d-------- C:\Documents and Settings\Tech1\Application Data\Microsoft Games
2008-06-12 22:27:32 0 d-------- C:\Program Files\Advanced System Optimizer
2008-06-12 22:25:52 0 d-------- C:\Program Files\DIFX
2008-06-12 20:41:43 0 d-------- C:\Program Files\Lavasoft
2008-06-12 20:41:21 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 15:36:22 0 d-------- C:\Program Files\AMD
2008-06-10 19:47:08 0 d-------- C:\Program Files\Microsoft Games
2008-06-05 15:52:56 0 d-------- C:\Program Files\Creative
2008-06-05 14:39:50 0 d-------- C:\Documents and Settings\Tech1\Application Data\Adobe
2008-05-24 11:21:40 0 d-------- C:\Program Files\Azureus
2008-05-15 17:09:27 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-05-15 14:55:44 0 d-------- C:\Program Files\AVG(2)
2008-05-15 14:55:11 0 d-------- C:\Program Files\Common Files\ODBC
2008-05-15 14:54:11 0 d-------- C:\Documents and Settings\Tech1\Application Data\dvdcss
2008-05-15 14:54:01 0 d-------- C:\Program Files\Windows Media Connect 2
2008-05-15 14:53:51 0 d-------- C:\Program Files\Realtek AC97
2008-05-15 14:53:44 0 d-------- C:\Program Files\Realtek AC97(2)
2008-05-15 13:28:39 0 d-------- C:\Documents and Settings\Tech1\Application Data\AdobeUM
2008-04-20 19:50:36 4096 --a----c- C:\WINDOWS\system32\crash

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{07AA283A-43D7-4CBE-A064-32A21112D94D}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57E218E6-5A80-4f0c-AB25-83598F25D7E9}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
01/01/2006 12:07 AM 2055960 --a------ C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4D3606E-E871-4A32-AF2E-3143541B0AC2}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A057A204-BACC-4D26-9990-79A187E2698E}"= C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [01/01/2006 12:07 AM 2055960]

[-HKEY_CLASSES_ROOT\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}]
[HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [09/27/2005 01:16 PM]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [01/01/2006 12:07 AM]
"C-Media Mixer"="Mixer.exe" [05/09/2003 11:04 AM C:\WINDOWS\mixer.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 10:56 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0 (0x0)
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=1 (0x1)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsNetHood"=1 (0x1)
"NoFind"=0 (0x0)
"NoRun"=0 (0x0)
"NoInstrumentation"=1 (0x1)
"NoStrCmpLogical"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0 (0x0)
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=1 (0x1)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsHistory]"=1 (0x1)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsNetHood"=1 (0x1)
"NoFind"=1 (0x1)
"NoRun"=0 (0x0)
"NoUserNameInStartMenu"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoStartMenuPinnedList"=0 (0x0)
"NoSharedDocuments"=0 (0x0)
"NoSaveSettings"=1 (0x1)
"NoRecentDocsHistory"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtst]
C:\WINDOWS\system32\awtst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\rqrqoom]
rqrqoom.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winktu32]
winktu32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^VersionTracker Pro.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tech1^Start Menu^Programs^Startup^AbsoluteShield Internet Eraser.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A8GSdsApp]
C:\Program Files\A8GSdsApp\AGSeiApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlazeServoTool]
"C:\Program Files\BlazeVideo\BlazeDVD 5 Standard\MediaDetector.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\boepzvg.dll]
C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\boepzvg.dll,eimzguf

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
C:\WINDOWS\system32\WLTRAY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch]
C:\WINDOWS\system32\taskswitch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
rundll32.exe C:\WINDOWS\system32\drvcaz.dll,startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMon]
C:\ctf\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
"C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FastUser]
C:\WINDOWS\system32\fast.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Nero\Nero8\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
C:\Program Files\Nero\Nero8\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeekmoOE]
C:\Program Files\Seekmo\bin\10.0.406.0\OEAddOn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SeekmoSA]
"C:\Program Files\Seekmo\bin\10.0.406.0\SeekmoSA.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService]
rundll32.exe "C:\WINDOWS\system32\ylvvnqxk.dll",setvm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQ931STI]
C:\WINDOWS\SQ931STI.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Manager]
startUp manager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STICAP]
C:\WINDOWS\Twain_32\Webcam Zoom 2.0\SnapTrap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue RegistryBooster 2]
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VaCtrls]
v7

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{DCA4966D-096C-1033-0309-060315060001}]
"C:\Program Files\Common Files\{DCA4966D-096C-1033-0309-060315060001}\Update.exe" mc-110-12-0000272

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"WMP300NSvc"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="C:\Program Files\Steam\Steam.exe" -silent
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e3e09d8-9649-11db-9ed5-0017313bcd86}]
AutoRun\command- E:\AutoRunCD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3e6ebc2-8848-11da-8464-806d6172696f}]
AutoRun\command- D:\atisetup.exe
launch\command- D:\atisetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe

-- End of Deckard's System Scanner: finished at 2008-07-14 15:28:29 ------------

Extra.txt
~~~~~~~~~~
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: AMD Athlon™ 64 X2 Dual Core Processor 4600+
CPU 1: AMD Athlon™ 64 X2 Dual Core Processor 4600+
Percentage of Memory in Use: 35%
Physical Memory (total/avail): 2047.48 MiB / 1320.37 MiB
Pagefile Memory (total/avail): 3429.86 MiB / 2889.02 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1924.2 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 189.91 GiB total, 72.8 GiB free.
D: is CDROM (CDFS)
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - Maxtor 6B200R0 - 189.92 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 189.91 GiB - C:

-- Security Center -------------------------------------------------------------

AUOptions is set to notify before download.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
AntivirusOverride is set.
FirewallOverride is set.

FW: Sygate Personal Firewall Pro v4.6 (Sygate Technologies, Inc.)
AV: AVG Anti-Virus Free v8.0 (AVG Technologies)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"="C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe:*:Enabled:PlayOnline Viewer"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\Steam\\steamapps\\technolackey\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\technolackey\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\lglor1\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\lglor1\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\lglor1\\half-life 2\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\lglor1\\half-life 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"="C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"="C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"
"C:\\DOCUME~1\\Tech1\\LOCALS~1\\Temp\\win114.tmp.exe"="C:\\DOCUME~1\\Tech1\\LOCALS~1\\Temp\\win114.tmp.exe:*:Enabled:win114.tmp"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Documents and Settings\\Tech1\\Desktop\\Stranglehold\\Binaries\\Retail-Stranglehold.exe"="C:\\Documents and Settings\\Tech1\\Desktop\\Stranglehold\\Binaries\\Retail-Stranglehold.exe:*:Disabled:Stranglehold"
"C:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:iw3mp"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Steam\\steamapps\\technolackey\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\technolackey\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"="C:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe:*:Enabled:iw3mp"
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"="C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe:*:Enabled:Nero ControlCenter"
"C:\\Program Files\\ASUS\\AsusUpdate\\Update.exe"="C:\\Program Files\\ASUS\\AsusUpdate\\Update.exe:*:Enabled:ASUS Windows Platform Flash Program"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users.WINDOWS
APPDATA=C:\Documents and Settings\Tech1\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_11\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=TECHNOLACKEY
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Tech1
LOGONSERVER=\\TECHNOLACKEY
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 43 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2b01
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_11\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Tech1\LOCALS~1\Temp
TMP=C:\DOCUME~1\Tech1\LOCALS~1\Temp
USERDOMAIN=TECHNOLACKEY
USERNAME=Tech1
USERPROFILE=C:\Documents and Settings\Tech1
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI

-- User Profiles ---------------------------------------------------------------

Tech1 (admin)
Administrator.TECHNOLACKEY.000 (new local, admin)

-- Add/Remove Programs ---------------------------------------------------------

-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
-->
--> "C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
--> C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL
--> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
--> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
--> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
--> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
--> C:\WINDOWS\UNRecode.exe /UNINSTALL
--> MsiExec /X{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\Setup.exe" -l0x9
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
Adobe Shockwave Player 11 --> C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
AGEIA PhysX v7.11.13 --> MsiExec.exe /X{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}
Apple Software Update --> MsiExec.exe /I{74EC78BC-B379-4E29-9006-8F161DCAABA6}
ASUSUpdate --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\setup.exe" -l0x9
ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x5445
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG Free 8.0 --> C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Azureus --> C:\Program Files\Azureus\Uninstall.exe
Battlefield 2™ --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x9 -removeonly
Battlefield 2: Special Forces --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{50D4CB89-AF34-4978-96DC-C3034062E901}\setup.exe" -l0x9 -removeonly
Broadcom 802.11 Network Adapter --> "C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter"
Call of Duty 4: Modern Warfare --> "C:\Program Files\Steam\steam.exe" steam://uninstall/7940
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
Conflict: Denied Ops Demo --> "C:\Program Files\Steam\steam.exe" steam://uninstall/8090
Counter-Strike: Source --> "C:\Program Files\Steam\steam.exe" steam://uninstall/240
Creative Multimedia Keyboard --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B9CF7568-ADBB-11D8-9966-00A0C9663221}\SETUP.EXE" -l0x9
Creative PCI Audio Drivers --> C:\PROGRA~1\Creative\Audio\CTSetup\ctsetup.exe -u -3
Creative Surround Mixer --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58582977-44D2-44A0-A09B-031CC2AE5938}\Setup.exe" -l0x9 /remove
Drivers Install For Linksys Easylink Advisor --> MsiExec.exe /I{A1960A82-DB70-474D-A86B-FA74466103C6}
Dual-Core Optimizer --> MsiExec.exe /X{BCA02FAD-2C86-4C8C-A815-51C09F4E51FF}
Gears of War --> C:\Program Files\InstallShield Installation Information\{1170D24F-42B7-40CF-AA1B-6395CE562354}\Setup.exe -runfromtemp -l0x0409
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
K-Lite Codec Pack 3.9.0 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe"
Linksys EasyLink Advisor 1.6 (0032) --> rundll32 C:\PROGRA~1\LINKSY~1\AUInst.dll,ExUninstall
Linksys Wireless-N PCI Adapter --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA20E409-BDB4-439B-B75B-D5B193546779}\setup.exe" -l0x9
LiveUpdate Notice (Symantec Corporation) --> MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Magic ISO Maker v5.4 (build 0239) --> C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Magic ISO Maker v5.4 (build 0251) --> C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Microsoft Games for Windows - LIVE Redistributable --> MsiExec.exe /X{20DEB77C-21D6-4D22-BB47-233E47613D57}
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Software Update for Web Folders (English) 12 -->
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Motorola Driver Installation --> MsiExec.exe /I{3324A5DC-C7F6-430A-ACC8-F251CD8F4FC7}
Motorola Phone Tools --> C:\Program Files\InstallShield Installation Information\{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}\setup.exe -runfromtemp -l0x0009 -removeonly
MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
Nero 7 Ultra Edition --> MsiExec.exe /X{A20A58C4-6784-4B4B-86CC-94E2E3671033}
neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers --> C:\WINDOWS\system32\nvuide.exe UninstallGUI
OpenAL --> "C:\Program Files\OpenAL\OALINST.exe" /U
Panda ActiveScan 2.0 --> C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
PCI Audio Driver --> cmuninst.exe
Pcsx2 0.9.4 Watermoose --> "C:\Program Files\Pcsx2_0.9.4\unins000.exe"
PerfectDisk 2008 Professional --> MsiExec.exe /I{2B6EC03E-6FA0-4D7C-9CCE-1B03819AB613}
PixiePack Codec Pack --> MsiExec.exe /I{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}
PowerISO --> "C:\Program Files\PowerISO\uninstall.exe"
Quicken 2007 --> MsiExec.exe /X{0D2E80C8-0875-43EB-9623-47118E2DFBCA}
QuickTime --> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\Setup.exe" -l0x9 -removeonly
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Office 2007 (KB936514) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C7A78F7F-EF32-4477-BAD7-3439EA7571BF}
Security Update for Visio 2007 (KB947590) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Shaw Speed Test --> C:\WINDOWS\system32\javaws.exe -uninstall "http://sr3so.cg.shaw.../shawrtm1.jnlp"
Sound Blaster PCI128 Drivers Online Help --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\CREATIVE\AUDIO\HELP\SBPCIDRV.isu"
Source SDK Base --> "C:\Program Files\Steam\steam.exe" steam://uninstall/215
Steam --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Sygate Personal Firewall Pro --> MsiExec.exe /I{10B446B3-4DF4-4489-A168-8A98F7CD807E}
Tracks Eraser Pro v6.0 --> "C:\Program Files\Acesoft\Tracks Eraser Pro\unins000.exe"
Tunebite --> MsiExec.exe /I{F863B682-5148-4738-B025-455AF892D723}
Update for Office 2007 (KB934391) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B3091818-7C56-4C45-BE7D-CA23027A5EA5}
Update for Office 2007 (KB934393) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15}
Update for Office 2007 (KB946691) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb953463) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1B78D541-9FF1-4330-ADD8-CED14F0C1E8E}
Ventrilo Client --> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
VideoLAN VLC media player 0.8.6c --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Webcam Zoom 2.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D0AF1483-31AD-4FEB-A961-C9327185439F}\Setup.exe" -l0x9
Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) --> C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_C074F64CC74B03BC354BB5DC973CCF768D5A7194\amdk8.inf
Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Windows Media Format SDK Hotfix - KB891122 --> "C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Mobile® Device Handbook --> C:\Program Files\Windows Mobile Device Handbook\Windows Mobile Device Handbook\Bin\DHUninstall.exe
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
Your Uninstaller! 2006 Version 5 --> "C:\Program Files\Your Uninstaller 2006\unins000.exe"
Zoom 2.0 Webcam --> C:\Program Files\InstallShield Installation Information\{236E24F2-D767-406B-B2F0-892D3A0DEA4A}\setup.exe -runfromtemp -l0x0009 -removeonly

-- Application Event Log -------------------------------------------------------

Event Record #/Type2331 / Success
Event Submitted/Written: 07/14/2008 03:20:09 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type21227 / Warning
Event Submitted/Written: 07/14/2008 03:21:51 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type21224 / Warning
Event Submitted/Written: 07/14/2008 08:19:25 AM
Event ID/Source: 36 / W32Time
Event Description:
The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Event Record #/Type21223 / Error
Even

#4
technolackey

Posted 14 July 2008 - 03:35 PM

Member

Topic Starter
Member
12 posts

Event Record #/Type21223 / Error
Event Submitted/Written: 07/14/2008 06:39:53 AM
Event ID/Source: 31008 / ipnathlp
Event Description:
The DNS proxy agent was unable to read the local list of name-resolution
servers from the registry.
The data is the error code.

Event Record #/Type21222 / Warning
Event Submitted/Written: 07/14/2008 05:23:54 AM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Event Record #/Type21221 / Warning
Event Submitted/Written: 07/14/2008 03:34:39 AM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

-- End of Deckard's System Scanner: finished at 2008-07-14 15:28:29 ------------

#5
fenzodahl512

Posted 15 July 2008 - 04:25 AM

Malware Removal
9,863 posts

Please download SDFix by Andy Manchesta and save it to your desktop.
Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

In Safe Mode, right click the SDFix.zip folder and choose Extract All,
A new folder will be extracted to your %systemdrive%, typically C:\SDFix
Open the extracted folder and double click RunThis.bat to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt along with any other requested logs at the end of these instructions.

Please also include a fresh DSS log (after SDFix step).

Regards
fenzodahl512

#6
technolackey

Posted 15 July 2008 - 11:47 AM

Member

Topic Starter
Member
12 posts

SDFix: Version 1.205
Run by Administrator on Tue 07/15/2008 at 11:37 AM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\unsvchosts.lzma - Deleted
C:\WINDOWS\twain_16.dll - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 11:44:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:2b,cb,e6,d5,1c,e6,2f,b6,dc,29,ff,c8,45,c3,91,0f,a5,d5,20,67,94,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:fd,35,87,5b,1b,0b,96,b9,66,9a,05,f1,0b,81,a2,fc,01,df,96,a8,61,..
"a0"=hex:20,01,00,00,13,81,25,bf,b8,cf,29,68,cf,f1,9a,b3,25,fa,29,e6,95,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:4d,f3,09,03,6c,52,a5,e4,3b,2e,26,44,c3,22,7e,9f,f0,86,6f,12,7b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:2b,cb,e6,d5,1c,e6,2f,b6,dc,29,ff,c8,45,c3,91,0f,a5,d5,20,67,94,..
"p0"="C:\Program Files\DAEMON Tools\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:fd,35,87,5b,1b,0b,96,b9,66,9a,05,f1,0b,81,a2,fc,01,df,96,a8,61,..
"a0"=hex:20,01,00,00,13,81,25,bf,b8,cf,29,68,cf,f1,9a,b3,25,fa,29,e6,95,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:4d,f3,09,03,6c,52,a5,e4,3b,2e,26,44,c3,22,7e,9f,f0,86,6f,12,7b,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:024bcef4
"s2"=dword:01fcdf7f
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:00,9e,b5,0c,ae,6b,0c,06,08,95,e7,b4,ec,11,35,25,aa,c5,7c,e5,a4,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,ed,59,d1,55,6a,37,21,2f,75,8f,3d,4b,7b,04,58,b5,13,..
"khjeh"=hex:20,b7,6c,2b,d5,a7,42,2c,c1,c7,03,b6,e6,2f,e9,fd,c2,df,92,99,f8,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:08,af,93,1d,ab,51,b8,d1,84,68,3b,2e,a5,c9,95,37,c8,35,74,4c,f2,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:9c,bb,3c,87,91,4c,c7,1c,b2,7c,8d,f7,8c,02,4e,63,94,97,93,53,bd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:00,9e,b5,0c,ae,6b,0c,06,08,95,e7,b4,ec,11,35,25,aa,c5,7c,e5,a4,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,ed,59,d1,55,6a,37,21,2f,75,8f,3d,4b,7b,04,58,b5,13,..
"khjeh"=hex:20,b7,6c,2b,d5,a7,42,2c,c1,c7,03,b6,e6,2f,e9,fd,c2,df,92,99,f8,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:08,af,93,1d,ab,51,b8,d1,84,68,3b,2e,a5,c9,95,37,c8,35,74,4c,f2,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:9c,bb,3c,87,91,4c,c7,1c,b2,7c,8d,f7,8c,02,4e,63,94,97,93,53,bd,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="C820DC2D074275358C80398474730104D0249EA4E8AE20D4E41858C10CCAF06DA3E0A250891
AE61C8D1F38D03B7C29B2FAFD7A68DC37F53D577E21CAD5A1A49970897AED8BA52BD2D353C018C889
39D643907FB4B889E4F0AAFB7D7DE74A6321332B49F55D92D5B6E42EC2AE40549E424D8AC3618F0F5
2D943FD505A66FA2EA3B68ED8FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E12
7BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667C038D530D6EB34525D575E7D6
A3B9808C038D530D6EB3452A067AF488A394625C4869577D18418C673A67CAE28C286C63CE8E5AF03
D2A64F6531A216E6C30C5F4AE784496E255C881751D914B161B8465374B8B27630EBDBB9101C062C1
4F44CDD24D047426854552885AFD843FBB8871A86B01AC94AEDE8EDAB3D5ABBAB232577F4654AE22F
FECEE0AD590D46F683B632DDB3CF5B9F45C928B519F50AC9ED85E19AA54F7B9E0F7BD23C23E83974C
9618EBB9DE4207A41B4E25E39E09E79606EBB596476469EED44E0A54FC52E5E6FF8F9E5BB899E62E1
C5EA5D98C61502B744F7796B0796D9B575C26195214BE28D56102553957126DC7CE16EA6772076E6C
EDCC4F8E6D1C2B542056D1D9C4BF2F0B1C2C89A844AD71BBC3ECD486781A7953A850DBC246F0BF13F
074A077FFCC218AA5622BB75694E3CCCC9BFD52E922C1D19E0A35CF07E2D23E57BFBE2B1C04C3B436
206D62A28A28F59220B9A87BFE08BDCB162EF209F64B2136B8AB8420F4C3F61D54E7F0BF0B39BF039
F9575488E425600F2485AC08304209320501E2F0C343CF6F583A21C3239A06D45BBE17031A5FDE624
81D32815423ED00792A6A84F8163DC307849D32D7F7720E80F9F755A864776CB2AD7068DA5F48D87E
96D07CF3BCBC3E3F4DD1667A5870D2C1A544BCFA93313E4A9E4F2F0F300893AA9C369F8170439A6A7
5B4987B0E9EE579CFE989C0FE73BFFBCC55D980867EDB1D05D9C7B41D2BE7F5D5601A8B25805C857E
7E20ECEC0A2A368AB00384055F32748FA463DFE2B40CD339164D21597E9FC929B9F7B6D7268EED9B3
1D5B183C56AD56C9E739F9700407ADE3729769DE3EEAB3A751F996F5BCD99B9CC16E50EAD2C6AC2F4
8F4D429591E2F8CABA0996E0D99614B3345415A2A035119B9740E3F9735F2C7BE10DA05EDE8A2FFB1
F9B1E8648780918EB6A60D70FC144DA4425F76E8E6437A72943A2A85FF29B9A0B34C04D7245E26A8D
229A3D7AC0E6EA19BCF1B6232E6613B697EC281AA2CE17459DC19066F25C16F7084374943B03D127F
2AE5E2875ADFAF0F8D772EC234A0A29649511877B252B19698B8763BB14B794783D5769F679425298
70810801062EA55CE5EF895E61DD775BDB63C3530D6A9940DEF68774A56E6A6AF5B46FCD6DE2BD9B9
0B5F61EAA06A8344D566294D25983"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"="C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe:*:Enabled:PlayOnline Viewer"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\Steam\\steamapps\\technolackey\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\technolackey\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\lglor1\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\lglor1\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\lglor1\\half-life 2\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\lglor1\\half-life 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"="C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"="C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"
"C:\\DOCUME~1\\Tech1\\LOCALS~1\\Temp\\win114.tmp.exe"="C:\\DOCUME~1\\Tech1\\LOCALS~1\\Temp\\win114.tmp.exe:*:Enabled:win114.tmp"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Documents and Settings\\Tech1\\Desktop\\Stranglehold\\Binaries\\Retail-Stranglehold.exe"="C:\\Documents and Settings\\Tech1\\Desktop\\Stranglehold\\Binaries\\Retail-Stranglehold.exe:*:Disabled:Stranglehold"
"C:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:iw3mp"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Steam\\steamapps\\technolackey\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\technolackey\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"="C:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe:*:Enabled:iw3mp"
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"="C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe:*:Enabled:Nero ControlCenter"
"C:\\Program Files\\ASUS\\AsusUpdate\\Update.exe"="C:\\Program Files\\ASUS\\AsusUpdate\\Update.exe:*:Enabled:ASUS Windows Platform Flash Program"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 3 Aug 2004 4,639 A.SH. --- "C:\Program Files\Windows Media Player\mplayer2.exe"
Wed 22 Sep 2004 73,728 A.SH. --- "C:\Program Files\Windows Media Player\wmplayer.exe"
Wed 28 Nov 2007 8 ..SHR --- "C:\WINDOWS\system32\EB3B5AC296.sys"
Wed 28 Nov 2007 3,350 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sun 1 Apr 2007 767,415 A.SH. --- "C:\WINDOWS\system32\tstwa.bak1"
Tue 3 Apr 2007 778,010 A.SH. --- "C:\WINDOWS\system32\tstwa.bak2"
Thu 15 Feb 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Sun 11 May 2008 0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv02.tmp"
Mon 13 Nov 2006 319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
Mon 14 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b5ceb6274f4d7fd206d6adab3df8e834\BIT1.tmp"
Sun 6 Apr 2008 2,633 ...HR --- "C:\Documents and Settings\Tech1\Application Data\SecuROM\UserData\securom_v7_01.bak"
Sun 1 Jan 2006 8 A..H. --- "C:\Documents and Settings\All Users.WINDOWS\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"
Sun 1 Jan 2006 8 A..H. --- "C:\Documents and Settings\All Users.WINDOWS\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp"
Sun 1 Jan 2006 8 A..H. --- "C:\Documents and Settings\Tech1\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Sun 1 Jan 2006 8 A..H. --- "C:\Documents and Settings\Tech1\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"

Finished!

#7
technolackey

Posted 15 July 2008 - 11:50 AM

Member

Topic Starter
Member
12 posts

#8
fenzodahl512

Posted 15 July 2008 - 11:57 AM

Malware Removal
9,863 posts

Please download VundoFix.exe to your desktop

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

IMPORTANT: If VundoFix needs to reboot to complete the fix, please allow your computer to reboot before proceed to the next step

NEXT

Please visit below webpage for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. DO NOT select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix (located in C:\combofix.txt) when you've accomplished that, along with a new HijackThis log.

Please post the following logs in your next reply...

1. VundoFix
2. ComboFix
3. A fresh HijackThis log (after ComboFix step)

Regards
fenzodahl512

#9
technolackey

Posted 15 July 2008 - 06:09 PM

Member

Topic Starter
Member
12 posts

VundoFix V7.0.6

Scan started at 2:16:57 PM 7/15/2008

Listing files found while scanning....

No infected files were found.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ComboFix 08-07-14.2 - Tech1 2008-07-15 17:57:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1499 [GMT -6:00]
Running from: C:\Documents and Settings\Tech1\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.WINDOWS\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
C:\Documents and Settings\All Users.WINDOWS\Application Data\SeekmoSA
C:\Documents and Settings\All Users.WINDOWS\Application Data\SeekmoSA\SeekmoSA.dat
C:\Documents and Settings\All Users.WINDOWS\Application Data\SeekmoSA\SeekmoSA_kyf_update.dat
C:\Documents and Settings\All Users.WINDOWS\Application Data\SeekmoSA\SeekmoSAAbout.mht
C:\Documents and Settings\All Users.WINDOWS\Application Data\SeekmoSA\SeekmoSAau.dat
C:\Documents and Settings\All Users.WINDOWS\Application Data\SeekmoSA\SeekmoSAEULA.mht
C:\Documents and Settings\All Users.WINDOWS\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\All Users.WINDOWS\Application Data\WinAntiVirus Pro 2007\Data\Abbr
C:\Documents and Settings\All Users.WINDOWS\Application Data\WinAntiVirus Pro 2007\Data\ActivationCode
C:\Documents and Settings\All Users.WINDOWS\Application Data\WinAntiVirus Pro 2007\Data\ProductCode
C:\Documents and Settings\Tech1\Application Data\ShoppingReport
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\Tech1\Application Data\ShoppingReport\cs\res1\WhiteList.dbs
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007\avtasks.dat
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007\history.db
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007\Logs\update.log
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007\Logs\wa7Support.log
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007\Logs\winav.log
C:\Documents and Settings\Tech1\Application Data\WinAntiVirus Pro 2007\PGE.dat
C:\WINDOWS\system32\absvnoih.ini
C:\WINDOWS\system32\kxqnvvly.ini
C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\tstwa.bak1
C:\WINDOWS\system32\tstwa.bak2
C:\WINDOWS\system32\tstwa.ini
C:\WINDOWS\system32\tstwa.ini2
C:\WINDOWS\system32\tstwa.tmp2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_COM+_MESSAGES
-------\Legacy_IPRIP
-------\Service_COM+ Messages
-------\Service_Iprip

((((((((((((((((((((((((( Files Created from 2008-06-16 to 2008-07-16 )))))))))))))))))))))))))))))))
.

2008-07-15 14:16 . 2008-07-15 14:16 <DIR> d-------- C:\VundoFix Backups
2008-07-15 11:35 . 2008-07-15 11:35 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-15 11:35 . 2008-07-15 11:46 <DIR> d-------- C:\SDFix
2008-07-15 11:29 . 2008-07-15 11:29 1,441,949 --a------ C:\SDFix.exe
2008-07-14 15:25 . 2008-07-14 15:25 <DIR> d-------- C:\Deckard
2008-07-14 15:23 . 2008-07-14 15:23 244 --ah----- C:\sqmnoopt10.sqm
2008-07-14 15:23 . 2008-07-14 15:23 232 --ah----- C:\sqmdata10.sqm
2008-07-13 22:44 . 2008-07-13 22:44 244 --ah----- C:\sqmnoopt09.sqm
2008-07-13 22:44 . 2008-07-13 22:44 232 --ah----- C:\sqmdata09.sqm
2008-07-13 17:43 . 2008-07-13 17:43 244 --ah----- C:\sqmnoopt08.sqm
2008-07-13 17:43 . 2008-07-13 17:43 232 --ah----- C:\sqmdata08.sqm
2008-07-13 17:33 . 2008-07-13 17:33 244 --ah----- C:\sqmnoopt07.sqm
2008-07-13 17:33 . 2008-07-13 17:33 232 --ah----- C:\sqmdata07.sqm
2008-07-13 12:50 . 2008-07-13 12:50 244 --ah----- C:\sqmnoopt06.sqm
2008-07-13 12:50 . 2008-07-13 12:50 232 --ah----- C:\sqmdata06.sqm
2008-07-11 00:04 . 2008-07-11 00:04 <DIR> d-------- C:\Program Files\EA GAMES
2008-07-09 13:20 . 2008-07-09 13:20 <DIR> d-------- C:\Program Files\PixiePack Codec Pack
2008-07-09 13:20 . 2008-07-11 02:46 <DIR> d-------- C:\Documents and Settings\Tech1\Application Data\Tunebite
2008-07-09 13:20 . 2008-02-20 13:47 27,936 --a------ C:\WINDOWS\system32\drivers\tbhsd.sys
2008-07-09 13:18 . 2008-07-09 13:18 <DIR> d-------- C:\Program Files\RapidSolution
2008-07-09 13:18 . 2008-07-09 13:21 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\RapidSolution
2008-07-09 13:07 . 2008-07-09 13:07 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-09 11:31 . 2008-07-09 11:57 <DIR> d-------- C:\Documents and Settings\Tech1\DoctorWeb
2008-07-06 13:45 . 2008-07-06 13:45 25 --a------ C:\WINDOWS\mixerdef.ini
2008-07-06 12:07 . 2003-05-09 11:04 1,855,488 --a------ C:\WINDOWS\mixer.exe
2008-07-06 12:07 . 2003-05-09 11:04 1,855,488 --a------ C:\temp\MIXER.EXE
2008-07-06 12:07 . 2000-10-20 18:28 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-07-06 12:07 . 2000-10-20 18:28 765,952 --a------ C:\temp\CRLDS3D.DLL
2008-07-06 12:07 . 2001-11-23 12:08 712,704 --a------ C:\WINDOWS\system32\Audio3D.dll
2008-07-06 12:07 . 2001-11-23 12:08 712,704 --a------ C:\temp\AUDIO3D.DLL
2008-07-06 12:07 . 2004-10-01 15:06 373,952 --a------ C:\WINDOWS\system32\drivers\cmaudio.sys
2008-07-06 12:07 . 2004-10-01 15:06 373,952 --a------ C:\temp\cmaudio.sys
2008-07-06 12:07 . 2002-07-11 11:24 139,264 --a------ C:\WINDOWS\cmuninst.exe
2008-07-06 12:07 . 2002-07-11 11:24 139,264 --a------ C:\temp\CMUNINST.EXE
2008-07-06 12:07 . 2002-07-11 12:13 135,168 --a------ C:\WINDOWS\cmuninst.dat
2008-07-06 12:07 . 2002-07-11 12:13 135,168 --a------ C:\temp\CMUNINST.DAT
2008-07-06 12:07 . 2006-05-23 19:40 39,319 --a------ C:\WINDOWS\cmijack.dat
2008-07-06 12:07 . 2006-05-23 19:40 39,319 --a------ C:\temp\cmijack.dat
2008-07-06 12:07 . 2002-10-09 09:38 32,768 --a------ C:\WINDOWS\system32\cmnprop.dll
2008-07-06 12:07 . 2002-10-09 09:38 32,768 --a------ C:\temp\CMNPROP.DLL
2008-07-06 12:07 . 2003-04-03 18:37 23,041 --a------ C:\WINDOWS\cmaudio.dat
2008-07-06 12:07 . 2003-04-03 18:37 23,041 --a------ C:\temp\cmaudio.dat
2008-07-06 12:07 . 2002-02-07 17:54 3,712 --a------ C:\WINDOWS\system32\drivers\cmigameport.sys
2008-07-06 12:07 . 2002-02-07 17:54 3,712 --a------ C:\temp\CMIGAMEPORT.sys
2008-07-06 02:16 . 2001-06-20 17:09 2,746 --a------ C:\WINDOWS\system32\GDMSRV.SYS
2008-07-05 19:14 . 2008-07-05 19:14 <DIR> d-------- C:\Gamesurround Muse Series Drivers
2008-07-05 19:14 . 2001-11-23 12:08 712,704 --a------ C:\WINDOWS\system32\a3d.dll
2008-07-05 12:11 . 2008-07-05 18:47 <DIR> d--h----- C:\$AVG8.VAULT$
2008-07-05 12:06 . 2008-07-06 12:14 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-05 12:06 . 2008-07-05 12:10 <DIR> d-------- C:\Documents and Settings\Tech1\Application Data\AVGTOOLBAR
2008-07-05 12:06 . 2006-01-01 00:07 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-05 12:06 . 2008-07-05 12:06 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll.old
2008-07-05 12:06 . 2006-01-01 00:07 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-30 16:33 . 2008-06-30 16:33 <DIR> d-------- C:\Program Files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-15 08:32 --------- d-----w C:\Documents and Settings\Tech1\Application Data\Azureus
2008-07-14 05:00 --------- d-----w C:\Program Files\Steam
2008-07-14 00:47 --------- d-----w C:\Program Files\THQ
2008-07-14 00:43 --------- d---a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-07-11 06:02 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2008-07-09 06:58 --------- d-----w C:\Program Files\PcBugDoctor
2008-07-08 06:52 --------- d-----w C:\Program Files\PowerISO
2008-07-06 01:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-05 18:06 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-07-01 17:59 --------- d-----w C:\Program Files\HTV
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 04:29 --------- d-----w C:\Documents and Settings\Tech1\Application Data\Microsoft Games
2008-06-13 04:27 --------- d-----w C:\Program Files\Advanced System Optimizer
2008-06-13 04:25 --------- d-----w C:\Program Files\DIFX
2008-06-13 02:41 --------- d-----w C:\Program Files\Lavasoft
2008-06-13 02:41 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-13 02:41 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-06-12 06:28 56,108 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
2008-06-11 21:36 --------- d-----w C:\Program Files\AMD
2008-06-11 01:47 --------- d-----w C:\Program Files\Microsoft Games
2008-06-08 00:54 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-05 21:52 --------- d-----w C:\Program Files\Creative
2008-05-24 17:21 --------- d-----w C:\Program Files\Azureus
2008-04-11 04:51 18,731,440 ----a-w C:\Documents and Settings\Tech1\backup.reg
2007-11-25 22:25 22,328 ----a-w C:\Documents and Settings\Tech1\Application Data\PnkBstrK.sys
2007-10-22 10:49 867,848 ----a-w C:\Program Files\NOV2007_d3dx10_36_x64.cab
2007-10-22 10:49 807,132 ----a-w C:\Program Files\NOV2007_d3dx10_36_x86.cab
2007-10-22 10:49 49,392 ----a-w C:\Program Files\NOV2007_X3DAudio_x64.cab
2007-10-22 10:49 44,850 ----a-w C:\Program Files\dxdllreg_x86.cab
2007-10-22 10:49 21,744 ----a-w C:\Program Files\NOV2007_X3DAudio_x86.cab
2007-10-22 10:49 200,010 ----a-w C:\Program Files\NOV2007_XACT_x64.cab
2007-10-22 10:49 151,512 ----a-w C:\Program Files\NOV2007_XACT_x86.cab
2007-10-22 10:49 1,805,306 ----a-w C:\Program Files\NOV2007_d3dx9_36_x64.cab
2007-10-22 10:49 1,712,608 ----a-w C:\Program Files\NOV2007_d3dx9_36_x86.cab
2007-11-29 02:49 8 --sh--r C:\WINDOWS\system32\EB3B5AC296.sys
2007-11-29 02:49 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2005-09-27 13:16 2635472]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2006-01-01 00:07 1232152]
"C-Media Mixer"="Mixer.exe" [2003-05-09 11:04 1855488 C:\WINDOWS\mixer.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoFavoritesMenu"= 1 (0x1)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFavoritesMenu"= 1 (0x1)
"NoSMMyPictures"= 0 (0x0)
"NoStartMenuMyMusic"= 0 (0x0)
"NoRecentDocsNetHood"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoStartMenuPinnedList"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^VersionTracker Pro.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^Tech1^Start Menu^Programs^Startup^AbsoluteShield Internet Eraser.lnk]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VaCtrls]
v7 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-05-16 10:27 153136 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
--a------ 2006-04-25 00:51 1273856 C:\WINDOWS\system32\WLTRAY.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a--c--- 2004-08-03 22:56 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 10:51 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
--a------ 2007-03-15 19:16 454784 C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 01:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 12:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a--c--- 2007-07-15 19:51 286720 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQ931STI]
--a--c--- 2006-01-01 00:36 151552 C:\WINDOWS\SQ931STI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
--a------ 2006-11-10 13:35 90112 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-03-27 23:18 1271032 C:\Program Files\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STICAP]
--a--c--- 2004-11-05 09:59 155648 C:\WINDOWS\twain_32\Webcam Zoom 2.0\SnapTrap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a--c--- 2006-10-12 04:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
--a------ 2004-06-11 13:48 518144 C:\WINDOWS\mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
-----c--- 2003-03-04 03:50 19968 C:\WINDOWS\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2005-07-12 01:55 81920 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"WMP300NSvc"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="C:\Program Files\Steam\Steam.exe" -silent
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Steam\\steamapps\\technolackey\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\lglor1\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Steam\\steamapps\\technolackey\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"=
"C:\\Program Files\\ASUS\\AsusUpdate\\Update.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"57707:TCP"= 57707:TCP:azer1
"57708:UDP"= 57708:UDP:azer2

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2006-01-01 00:07]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2006-01-01 00:07]
R2 PD91Agent;PD91Agent;C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe [2008-04-16 13:00]
S1 SysTool;SysTool Overclocking Utility;C:\WINDOWS\system32\DRIVERS\SysTool.sys [2006-11-10 07:08]
S3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys []
S3 GDMSRV0;GDMSRV0;C:\WINDOWS\system32\GDMSRV.SYS [2001-06-20 17:09]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 p2psvc;Peer Networking;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 PD91Engine;PD91Engine;C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe [2008-04-16 13:00]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\system32\svchost.exe [2004-08-03 22:56]
S3 SQ931;Zoom 2.0 Webcam;C:\WINDOWS\system32\Drivers\Capt931a.sys [2007-01-25 11:07]
S3 SQTECH930B;USB 2.0 Webcam;C:\WINDOWS\system32\Drivers\Capt930b.sys [2006-03-23 17:22]
S4 WMP300NSvc;WMP300NSvc;C:\Program Files\Wireless-N PCI Adapter\WLService.exe WMP300N.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e3e09d8-9649-11db-9ed5-0017313bcd86}]
\Shell\AutoRun\command - E:\AutoRunCD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3e6ebc2-8848-11da-8464-806d6172696f}]
\Shell\AutoRun\command - D:\atisetup.exe
\Shell\launch\command - D:\atisetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-07-04 23:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-07-10 05:38:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

BHO-{B4D3606E-E871-4A32-AF2E-3143541B0AC2} - (no file)
ShellIconOverlayIdentifiers-{8D2223A2-B3C6-4e32-B096-CDD11F628C60} - (no file)
Notify-awtst - C:\WINDOWS\system32\awtst.dll
Notify-rqrqoom - rqrqoom.dll
Notify-winktu32 - winktu32.dll
MSConfigStartUp-A8GSdsApp - C:\Program Files\A8GSdsApp\AGSeiApp.exe
MSConfigStartUp-ATICCC - C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe
MSConfigStartUp-BlazeServoTool - C:\Program Files\BlazeVideo\BlazeDVD 5 Standard\MediaDetector.exe
MSConfigStartUp-boepzvg - C:\WINDOWS\system32\boepzvg.dll
MSConfigStartUp-CoolSwitch - C:\WINDOWS\system32\taskswitch.exe
MSConfigStartUp-CTDrive - C:\WINDOWS\system32\drvcaz.dll
MSConfigStartUp-CTFMon - C:\ctf\ctfmon.exe
MSConfigStartUp-FastUser - C:\WINDOWS\system32\fast.exe
MSConfigStartUp-PC Connection Agent - C:\Program Files\Microsoft ActiveSync\wcescomm.exe
MSConfigStartUp-InCD - C:\Program Files\Nero\Nero8\InCD\InCD.exe
MSConfigStartUp-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
MSConfigStartUp-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-SecurDisc - C:\Program Files\Nero\Nero8\InCD\NBHGui.exe
MSConfigStartUp-SeekmoOE - C:\Program Files\Seekmo\bin\10.0.406.0\OEAddOn.exe
MSConfigStartUp-SeekmoSA - C:\Program Files\Seekmo\bin\10.0.406.0\SeekmoSA.exe
MSConfigStartUp-SoundService - C:\WINDOWS\system32\ylvvnqxk.dll
MSConfigStartUp-swg - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
MSConfigStartUp-Uniblue RegistryBooster 2 - C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
MSConfigStartUp-{DCA4966D-096C-1033-0309-060315060001} - C:\Program Files\Common Files\{DCA4966D-096C-1033-0309-060315060001}\Update.exe
MSConfigStartUp-Startup Manager - startUp manager.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 18:02:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\vsdatant]
"ImagePath"=""
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINDOWS\system32\snmp.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-07-15 18:05:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-16 00:05:33

Pre-Run: 77,871,468,544 bytes free
Post-Run: 77,773,631,488 bytes free

366 --- E O F --- 2008-07-11 06:02:37

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:06:14 PM, on 7/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100005000004} - https://secure.wideb...b685ebe1_35.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 7030 bytes

#10
fenzodahl512

Posted 15 July 2008 - 11:32 PM

Malware Removal
9,863 posts

Please show hidden files and folders. Please visit HERE if you don't know how.

Jotti File Submission:

Please go to Jotti's malware scan
Copy and paste the following file path into the "File to upload & scan"box on the top of the page:
- C:\WINDOWS\SQ931STI.exe
  C:\WINDOWS\system32\GDMSRV.SYS
Click on the submit button. You can only submit one file per round..
Please post the results in your next reply.

If Jotti server is too busy, please submit the file to VirusTotal instead.

NEXT

The steps that I am about to suggest involve modifying the registry. Modfying the registry can be dangerous so we will make a backup of the registry first.
Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot perform some of these steps or if you have ANY questions please ask BEFORE proceeding.

Backing Up Your Registry

Go Here and download ERUNT
(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)
Install ERUNT by following the prompts
(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)
Start ERUNT
(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)
Choose a location for the backup
(the default location is C:\WINDOWS\ERDNT which is acceptable).
Make sure that at least the first two check boxes are ticked
Press OK
Press YES to create the folder.

For detailed instruction on how to back-up registry via ERUNT, please visit HERE

NEXT

Please copy and paste the following into a Notepad

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VaCtrls]

Save it in desktop as Fix.reg and in Save as type: choose All Files

A new registry file will then created on your desktop. It should look like this: Posted Image

Just double-click the file and choose Yes at prompt.

If you do not sure how to make a registry file, please visit HERE for the tutorial.

NEXT

Please download Malwarebytes' Anti-Malware from HERE or HERE

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post the following logs in your next reply.. Post each log in separate post..

1. Jotti/VirusTotal
2. Malwarebytes'
3. A fresh DSS log (after Malwarebytes' step)

Regards
fenzodahl512

#11
technolackey

Posted 16 July 2008 - 02:33 AM

Member

Topic Starter
Member
12 posts

C:\WINDOWS\SQ931STI.exe results

Antivirus Version Last Update Result
AhnLab-V3 2008.7.4.1 2008.07.05 -
AntiVir 7.8.0.64 2008.07.05 -
Authentium 5.1.0.4 2008.07.04 -
Avast 4.8.1195.0 2008.07.05 -
AVG 7.5.0.516 2008.07.05 -
BitDefender 7.2 2008.07.05 -
CAT-QuickHeal 9.50 2008.07.04 -
ClamAV 0.93.1 2008.07.05 -
DrWeb 4.44.0.09170 2008.07.05 -
eSafe 7.0.17.0 2008.07.03 -
eTrust-Vet 31.6.5929 2008.07.05 -
Ewido 4.0 2008.07.05 -
F-Prot 4.4.4.56 2008.07.04 -
F-Secure 7.60.13501.0 2008.07.03 -
Fortinet 3.14.0.0 2008.07.05 -
GData 2.0.7306.1023 2008.07.05 -
Ikarus T3.1.1.26.0 2008.07.05 -
Kaspersky 7.0.0.125 2008.07.05 -
McAfee 5332 2008.07.04 -
Microsoft 1.3704 2008.07.05 -
NOD32v2 3244 2008.07.05 -
Norman 5.80.02 2008.07.04 -
Panda 9.0.0.4 2008.07.05 -
Prevx1 V2 2008.07.05 -
Rising 20.51.42.00 2008.07.04 -
Sophos 4.31.0 2008.07.05 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.05 -
TheHacker 6.2.96.373 2008.07.05 -
TrendMicro 8.700.0.1004 2008.07.05 -
VBA32 3.12.6.8 2008.07.05 -
VirusBuster 4.5.11.0 2008.07.05 -
Webwasher-Gateway 6.6.2 2008.07.05 -
Additional information
File size: 151552 bytes
MD5...: cb2d509acf5c2606710797596bc6ff2c
SHA1..: f06db3bcd69742ec4f79d3decc9cf9fa5e154433
SHA256: 86419b87648ea6228c0d510d08995b63b7e321236e4e7b59ebf1a9cd31167995
SHA512: 8de15c904e5372c444cd5b481c5e80bc314b0783a8b96a181f079d224b9e3021
3e136571887c7d0c986e3af1f306feeaa90e6877c90a02df088bae50c9bfbbee
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x402e5e
timedatestamp.....: 0x45b6fb98 (Wed Jan 24 06:24:24 2007)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x15fba 0x16000 6.61 f03efcb64396b74c2ca191cad07cc86d
.rdata 0x17000 0x4c30 0x5000 4.79 a6069d6a8933950f58a8d26e5ddf3a93
.data 0x1c000 0x7b48 0x4000 1.94 0a3b6746f3dd436ded9e84b35bcdd2b3
.rsrc 0x24000 0x4050 0x5000 3.57 3487f0f1dbaccf4bea0b2b247556b450

( 9 imports )
> KERNEL32.dll: InitializeCriticalSection, TlsAlloc, DeleteCriticalSection, GlobalHandle, TlsFree, LeaveCriticalSection, GlobalReAlloc, EnterCriticalSection, TlsSetValue, LocalReAlloc, TlsGetValue, lstrcpynA, GlobalFlags, WritePrivateProfileStringA, GetProcessVersion, SizeofResource, GetCPInfo, GetOEMCP, SetErrorMode, GetCurrentProcess, WriteFile, SetFilePointer, FlushFileBuffers, LocalAlloc, RtlUnwind, GetStartupInfoA, GetCommandLineA, ExitProcess, TerminateProcess, HeapFree, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, GetACP, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, SetStdHandle, GetProfileStringA, LocalFree, MulDiv, SetLastError, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, lstrcpyA, GetModuleHandleA, MultiByteToWideChar, lstrlenA, InterlockedDecrement, InterlockedIncrement, WideCharToMultiByte, GlobalUnlock, GlobalFree, LockResource, FindResourceA, LoadResource, GetModuleFileNameA, GlobalLock, GlobalAlloc, GlobalDeleteAtom, lstrcmpA, lstrcmpiA, GetCurrentThread, GetCurrentThreadId, LoadLibraryA, GetLastError, GetProcAddress, FreeLibrary, WaitForMultipleObjects, ResetEvent, OutputDebugStringA, SetEvent, CloseHandle, WaitForSingleObject, CreateEventA, CreateThread, lstrlenW
> USER32.dll: GetDlgCtrlID, GetWindowTextA, GetWindowTextLengthA, GetMenuItemID, GetSubMenu, GetMenuItemCount, GetMenu, RegisterClassA, GetClassInfoA, WinHelpA, GetCapture, GetTopWindow, CopyRect, ScreenToClient, AdjustWindowRectEx, SetFocus, GetSysColor, MapWindowPoints, SendDlgItemMessageA, UpdateWindow, IsDialogMessageA, SetWindowTextA, ShowWindow, LoadStringA, DestroyMenu, ClientToScreen, GetDC, ReleaseDC, GetWindowDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, LoadCursorA, GetClassNameA, PtInRect, DefWindowProcA, GetSysColorBrush, InvalidateRect, IsWindowUnicode, CharNextA, InflateRect, DefDlgProcA, DrawFocusRect, ExcludeUpdateRgn, ShowCaret, HideCaret, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowLongA, SetWindowPos, RegisterWindowMessageA, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, EndDialog, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, DestroyWindow, GetDlgItem, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, MessageBoxA, SetCursor, PostQuitMessage, PostMessageA, CreateWindowExA, GetClassLongA, SetPropA, GetPropA, RemovePropA, CallWindowProcA, GetMessageTime, GetMessagePos, EnableWindow, UnhookWindowsHookEx, SetWindowsHookExA, FindWindowA, UnregisterDeviceNotification, IsIconic, GetSystemMetrics, GetClientRect, DrawIcon, GetSystemMenu, AppendMenuA, SendMessageA, RegisterDeviceNotificationA, LoadIconA, wsprintfA, GetActiveWindow, UnregisterClassA
> ole32.dll: CoInitialize, CoCreateInstance, CoUninitialize
> OLEAUT32.dll: -, -
> ADVAPI32.dll: RegCloseKey, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA
> WINSPOOL.DRV: OpenPrinterA, DocumentPropertiesA, ClosePrinter
> SHELL32.dll: ShellExecuteA
> COMCTL32.dll: -
> GDI32.dll: GetStockObject, SetBkMode, GetTextExtentPointA, PatBlt, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, SelectObject, CreateSolidBrush, RestoreDC, SaveDC, DeleteDC, GetDeviceCaps, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateDIBitmap, CreateCompatibleDC, BitBlt, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, IntersectClipRect, DeleteObject, CreateBitmap

( 0 exports )

C:\WINDOWS\system32\GDMSRV.SYS results

File size: 2746 bytes
MD5...: d0078845b415abc80ce57c3068fbe2b3
SHA1..: cb1f8d48b20e79b4b74dd7425e972c328220c044
SHA256: 2c2e81726f8b50315fb62fac55427bec2b24a4082daadfe37e0c8977d064e2ca
SHA512: e203b09446e8e968136ea87ee74173586355b0b8894aa1031536cff145a8b52e
f29be81eb9633e80f76c16858313247c90ee106945c77b2bad51f574e21a0a45
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x102a8
timedatestamp.....: 0x3b30bcb5 (Wed Jun 20 15:09:41 2001)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x260 0x418 0x420 6.06 05fd3f4e27085dd43a75b42e50549dc5
.rdata 0x680 0x96 0xa0 2.43 864bab66f502b13a0834f54e330418cf
INIT 0x720 0x1a0 0x1a0 4.76 479dca25343aeed5fcadedb710f6e029
.reloc 0x8c0 0x5e 0x60 3.71 1e9e16ec0388f9ff60557c527a0d1b41

( 2 imports )
> ntoskrnl.exe: IoDeleteDevice, RtlInitUnicodeString, IoDeleteSymbolicLink, IofCompleteRequest, RtlFreeUnicodeString, IoCreateSymbolicLink, IoCreateDevice, ZwOpenKey, DbgPrint, RtlAnsiStringToUnicodeString, RtlInitAnsiString, ZwClose, ZwDeleteKey
> HAL.dll: HalGetBusData

( 0 exports )

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes' Anti-Malware 1.20
Database version: 957
Windows 5.1.2600 Service Pack 2

2:25:00 AM 7/16/2008
mbam-log-7-16-2008 (02-25-00).txt

Scan type: Full Scan (C:\|)
Objects scanned: 140158
Time elapsed: 39 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 41
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{00b77587-be1b-4201-b8e9-09fcf50ab771} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{067c6a37-72ea-4437-863a-5be20c246f3c} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{34e29700-0d13-46aa-b9a5-ace68e21a091} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3661af2d-c27b-499c-9bcf-66c8502a3806} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{99123ac9-7dda-4c82-b252-44c2804bf392} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{08755390-f46d-4d09-968c-3430166b3189} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5a4737a8-b92a-4e54-970e-c2891d98ce3f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ace99e77-aa2a-43c2-8c9d-caf2020fdf2b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e0fb1610-b25b-49f6-be20-751b2f230e6f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3f0915b8-b238-4c2d-ad1e-60db1e14d27a} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ea58c2ea-be26-49dd-9b9a-c8e4e5ca7791} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fca28ac5-c1e1-4d67-a5ae-c44d6c374d9f} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{0923208c-e259-4ed5-a778-cb607da350ad} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1230cf51-6bc4-4a23-b3f1-c7cf0afed619} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1a2af056-1fe1-47ca-993d-5d09d18e674e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e8b851b-05b0-4baf-b24d-d0dfe88dded3} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{50c3e2b3-4fd7-4cb9-91f9-641a6e6b3689} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{62b0b239-f9ac-4a5b-bfae-62c7a23f7627} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{726f0ab9-b842-4ae4-90c7-230e233e6a99} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b9cc2b92-5611-453f-8381-8b6f72d9c0b8} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c4543e64-1498-410d-8e72-4744eea99ab9} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{229d2451-a617-4b30-b5e8-8138694240cb} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2b81f920-6660-4f76-93bf-b1c67bf5d1a0} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{49155dae-c471-40fa-98ee-b2b3cad115ce} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4d783385-0dda-4188-a529-c97dc3d67cbd} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{54a3f8b7-228e-4ed8-895b-de832b2c3959} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e10479b-31e8-4a3b-81b1-ddaf39097f19} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e420a65f-9984-4b8c-9fa9-1ed69d3b0a13} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{9720de03-5820-4059-b4a4-639d5e52bd09} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b247f5bf-bd9d-4ecd-8fc1-365f36a1fda1} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbbfb891-98ae-4678-86f3-bd5a2eed86c9} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bf1bf02c-5a86-4ecf-adac-472c54c4d21e} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c23fa5a4-1fea-419f-8b14-f7465df062bc} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{ccc6e232-aa4c-4813-a019-9c14b27776b6} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{914a8f99-38e4-47ec-b875-2b0653516030} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e313f5dc-cfe7-4568-84a4-c76653547571} (Adware.Seekmo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Motorola Phone Tools\MPT_TEST_Info.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\WinRAR 3.30 Plus Edition\WinRAR 3.30 Plus Edition\Default.SFX (Rogue.Installer) -> Quarantined and deleted successfully.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deckard's System Scanner v20071014.68
Run by Tech1 on 2008-07-16 02:26:12
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
7: 2008-07-16 08:26:17 UTC - RP7 - Deckard's System Scanner Restore Point
6: 2008-07-16 00:54:58 UTC - RP6 - Installed AVG 8.0
5: 2008-07-16 00:54:37 UTC - RP5 - Removed AVG 8.0
4: 2008-07-15 23:57:21 UTC - RP4 - ComboFix created restore point
3: 2008-07-15 08:32:18 UTC - RP3 - Restore Operation

-- First Restore Point --
1: 2008-07-14 21:25:31 UTC - RP1 - System Checkpoint

Backed up registry hives.
Performed disk cleanup.

-- HijackThis (run as Tech1.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:27:18 AM, on 7/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Tech1\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Tech1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100005000004} - https://secure.wideb...b685ebe1_35.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 5876 bytes

-- File Associations -----------------------------------------------------------

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 Teefer (Teefer for NT) - c:\windows\system32\drivers\teefer.sys <Not Verified; Sygate Technologies, Inc.; Sygate Teefer Driver>
R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt>
R3 cmigameport - c:\windows\system32\drivers\cmigameport.sys
R3 cmpci (C-Media PCI Audio Driver (WDM)) - c:\windows\system32\drivers\cmaudio.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>

S1 SysTool (SysTool Overclocking Utility) - c:\windows\system32\drivers\systool.sys <Not Verified; ; Low-Level Driver>
S2 ASInsHelp - c:\windows\system32\drivers\asinshelp32.sys (file missing)
S3 Afc (PPdus ASPI Shell) - c:\windows\system32\drivers\afc.sys <Not Verified; Arcsoft, Inc.; Arcsoft® ASPI Shell>
S3 AmdTools (AMD Special Tools Driver) - c:\windows\system32\drivers\amdtools.sys (file missing)
S3 dtscsi - c:\windows\system32\drivers\dtscsi.sys (file missing)
S3 GDMSRV0 - c:\windows\system32\gdmsrv.sys
S3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\program files\wireless-n pci adapter\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
S3 mcdbus (Driver for MagicISO SCSI Host Controller) - c:\windows\system32\drivers\mcdbus.sys (file missing)
S3 ndiscm (Motorola SURFboard USB Cable Modem Windows Driver) - c:\windows\system32\drivers\netmotcm.sys (file missing)
S3 SQ931 (Zoom 2.0 Webcam) - c:\windows\system32\drivers\capt931a.sys
S3 SQTECH930B (USB 2.0 Webcam) - c:\windows\system32\drivers\capt930b.sys

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S2 CLTNetCnService (Symantec Lic NetConnect service) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)
S2 LiveUpdate Notice Ex (LiveUpdate Notice Service Ex) - "c:\program files\common files\symantec shared\ccsvchst.exe" /h cccommon (file missing)
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {85B5DDD0-E090-4B15-BDF2-A443A3CA0B66}
Description: ATITool Driver
Device ID: ROOT\*ATITOOLDEVICE\0000
Manufacturer: W1zzard
Name: ATITool Driver
PNP Device ID: ROOT\*ATITOOLDEVICE\0000
Service: ATITool

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: Realtek AC'97 Audio
Device ID: PCI\VEN_10DE&DEV_0059&SUBSYS_81AE1043&REV_A2\3&2411E6FE&0&20
Manufacturer: Realtek
Name: Realtek AC'97 Audio
PNP Device ID: PCI\VEN_10DE&DEV_0059&SUBSYS_81AE1043&REV_A2\3&2411E6FE&0&20
Service: ALCXWDM

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: NVIDIA nForce Networking Controller
Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&1F09082D&0&01
Manufacturer: NVIDIA
Name: NVIDIA nForce Networking Controller
PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0057\4&1F09082D&0&01
Service: NVENETFD

Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: MPU-401 Compatible MIDI Device
Device ID: ACPI\PNPB006\3&2411E6FE&0
Manufacturer: Microsoft
Name: MPU-401 Compatible MIDI Device
PNP Device ID: ACPI\PNPB006\3&2411E6FE&0
Service: ms_mpu401

-- Scheduled Tasks -------------------------------------------------------------

2008-07-09 23:38:02 284 --a----c- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-07-04 17:15:00 390 --a----c- C:\WINDOWS\Tasks\1-Click Maintenance.job

-- Files created between 2008-06-16 and 2008-07-16 -----------------------------

2008-07-16 01:29:53 0 d-------- C:\Documents and Settings\Tech1\Application Data\Malwarebytes
2008-07-16 01:29:51 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-07-16 01:29:50 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-15 21:07:56 0 dr-h----- C:\Documents and Settings\Tech1\Recent
2008-07-15 18:54:58 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg8
2008-07-15 17:53:57 68096 --a------ C:\WINDOWS\zip.exe
2008-07-15 17:53:57 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-15 17:53:57 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-15 17:53:57 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-15 17:53:57 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-15 17:53:57 98816 --a------ C:\WINDOWS\sed.exe
2008-07-15 17:53:57 80412 --a------ C:\WINDOWS\grep.exe
2008-07-15 17:53:57 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-07-15 14:16:57 0 d-------- C:\VundoFix Backups
2008-07-15 11:35:38 0 d-------- C:\WINDOWS\ERUNT
2008-07-15 11:29:40 1441949 --a------ C:\SDFix.exe
2008-07-11 00:04:44 0 d-------- C:\Program Files\EA GAMES
2008-07-09 13:20:46 0 d-------- C:\Program Files\PixiePack Codec Pack
2008-07-09 13:20:07 0 d-------- C:\Documents and Settings\Tech1\Application Data\Tunebite
2008-07-09 13:18:29 0 d-------- C:\Program Files\RapidSolution
2008-07-09 13:18:29 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\RapidSolution
2008-07-09 13:07:16 0 d-------- C:\Program Files\Trend Micro
2008-07-09 11:31:52 0 d-------- C:\Documents and Settings\Tech1\DoctorWeb
2008-07-06 12:07:36 3712 --a------ C:\WINDOWS\system32\drivers\cmigameport.sys
2008-07-06 12:07:36 373952 --a------ C:\WINDOWS\system32\drivers\cmaudio.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
2008-07-06 12:07:36 32768 --a------ C:\WINDOWS\system32\cmnprop.dll <Not Verified; C-Media Corporation; CMI8738/CMI9738 Audio Device>
2008-07-06 12:07:36 712704 --a------ C:\WINDOWS\system32\Audio3D.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-07-06 12:07:36 765952 --a------ C:\WINDOWS\system\crlds3d.dll <Not Verified; Sensaura Ltd; Sensaura 3DPA>
2008-07-06 12:07:36 1855488 --a------ C:\WINDOWS\mixer.exe <Not Verified; C-Media Electronic Inc. (www.cmedia.com.tw); Mixer>
2008-07-06 12:07:36 139264 --a------ C:\WINDOWS\cmuninst.exe <Not Verified; C-Media Electronics Inc.; CMIUninst Application>
2008-07-06 12:07:36 135168 --a------ C:\WINDOWS\cmuninst.dat <Not Verified; C-Media Electronics Inc.; CMIUninst Application>
2008-07-06 12:07:36 39319 --a------ C:\WINDOWS\cmijack.dat
2008-07-06 12:07:36 23041 --a------ C:\WINDOWS\cmaudio.dat
2008-07-06 02:16:35 2746 --a------ C:\WINDOWS\system32\GDMSRV.SYS
2008-07-05 19:14:45 712704 --a------ C:\WINDOWS\system32\a3d.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-07-05 19:14:45 0 d-------- C:\Gamesurround Muse Series Drivers
2008-06-30 16:33:52 0 d-------- C:\Program Files\AVG

-- Find3M Report ---------------------------------------------------------------

2008-07-15 20:15:48 0 d-------- C:\Program Files\Steam
2008-07-15 02:32:59 0 d-------- C:\Documents and Settings\Tech1\Application Data\Azureus
2008-07-13 18:47:32 0 d-------- C:\Program Files\THQ
2008-07-09 00:58:06 0 d-------- C:\Program Files\PcBugDoctor
2008-07-08 00:52:48 0 d-------- C:\Program Files\PowerISO
2008-07-05 19:14:45 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-01 11:59:55 0 d-------- C:\Program Files\HTV
2008-06-12 22:29:30 0 d-------- C:\Documents and Settings\Tech1\Application Data\Microsoft Games
2008-06-12 22:27:32 0 d-------- C:\Program Files\Advanced System Optimizer
2008-06-12 22:25:52 0 d-------- C:\Program Files\DIFX
2008-06-12 20:41:43 0 d-------- C:\Program Files\Lavasoft
2008-06-12 20:41:21 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 15:36:22 0 d-------- C:\Program Files\AMD
2008-06-10 19:47:08 0 d-------- C:\Program Files\Microsoft Games
2008-06-05 15:52:56 0 d-------- C:\Program Files\Creative
2008-06-05 14:39:50 0 d-------- C:\Documents and Settings\Tech1\Application Data\Adobe
2008-05-24 11:21:40 0 d-------- C:\Program Files\Azureus
2008-04-20 19:50:36 4096 --a----c- C:\WINDOWS\system32\crash

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [09/27/2005 01:16 PM]
"C-Media Mixer"="Mixer.exe" [05/09/2003 11:04 AM C:\WINDOWS\mixer.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 10:56 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=1 (0x1)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsNetHood"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoStrCmpLogical"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=1 (0x1)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsHistory]"=1 (0x1)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsNetHood"=1 (0x1)
"NoUserNameInStartMenu"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoStartMenuPinnedList"=0 (0x0)
"NoSharedDocuments"=0 (0x0)
"NoRecentDocsHistory"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^VersionTracker Pro.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tech1^Start Menu^Programs^Startup^AbsoluteShield Internet Eraser.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
C:\WINDOWS\system32\WLTRAY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
"C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQ931STI]
C:\WINDOWS\SQ931STI.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STICAP]
C:\WINDOWS\Twain_32\Webcam Zoom 2.0\SnapTrap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"WMP300NSvc"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="C:\Program Files\Steam\Steam.exe" -silent
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e3e09d8-9649-11db-9ed5-0017313bcd86}]
AutoRun\command- E:\AutoRunCD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3e6ebc2-8848-11da-8464-806d6172696f}]
AutoRun\command- D:\atisetup.exe
launch\command- D:\atisetup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe

-- End of Deckard's System Scanner: finished at 2008-07-16 02:28:17 ------------

#12
fenzodahl512

Posted 16 July 2008 - 09:41 AM

Malware Removal
9,863 posts

Alright mate.. your log looks clean to my eyes.. However, I haven't seen any antivirus in your logs.. Antivirus is extremely crucial as without it you will get re-infected again! Do you have any? If you don't, please install ONLY ONE of these free and excellent antivirus below:

Please install ONLY ONE of the antivirus above and then update >> run a full scan with it..

Then post me a fresh DSS log for my final review.. Also, tell me about your computer conditions...

Regards
fenzodahl512

#13
technolackey

Posted 16 July 2008 - 10:03 PM

Member

Topic Starter
Member
12 posts

system seems to be running ok now, but was wondering, theres like 38 processes running, are they nessecary? i would like to only have ones that HAVE to run, as opposed to them running just cause they can

and BTW TYVM for helpin me out with this...

Deckard's System Scanner v20071014.68
Run by Tech1 on 2008-07-16 21:52:53
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Tech1.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:56 PM, on 7/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Azureus\Azureus.exe
C:\Documents and Settings\Tech1\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Tech1.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00000005-0000-0000-0000-100005000004} - https://secure.wideb...b685ebe1_35.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.syma...bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail....es/MSNPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 6480 bytes

-- Files created between 2008-06-16 and 2008-07-16 -----------------------------

2008-07-16 20:11:06 0 d-------- C:\Program Files\Avira
2008-07-16 20:11:06 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avira
2008-07-16 02:34:21 0 dr-h----- C:\Documents and Settings\Tech1\Recent
2008-07-16 01:29:53 0 d-------- C:\Documents and Settings\Tech1\Application Data\Malwarebytes
2008-07-16 01:29:51 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-07-16 01:29:50 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-15 18:54:58 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg8
2008-07-15 17:53:57 68096 --a------ C:\WINDOWS\zip.exe
2008-07-15 17:53:57 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-15 17:53:57 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-15 17:53:57 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-15 17:53:57 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-15 17:53:57 98816 --a------ C:\WINDOWS\sed.exe
2008-07-15 17:53:57 80412 --a------ C:\WINDOWS\grep.exe
2008-07-15 17:53:57 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-07-15 11:35:38 0 d-------- C:\WINDOWS\ERUNT
2008-07-11 00:04:44 0 d-------- C:\Program Files\EA GAMES
2008-07-09 13:20:46 0 d-------- C:\Program Files\PixiePack Codec Pack
2008-07-09 13:20:07 0 d-------- C:\Documents and Settings\Tech1\Application Data\Tunebite
2008-07-09 13:18:29 0 d-------- C:\Program Files\RapidSolution
2008-07-09 13:18:29 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\RapidSolution
2008-07-09 13:07:16 0 d-------- C:\Program Files\Trend Micro
2008-07-09 11:31:52 0 d-------- C:\Documents and Settings\Tech1\DoctorWeb
2008-07-06 12:07:36 3712 --a------ C:\WINDOWS\system32\drivers\cmigameport.sys
2008-07-06 12:07:36 373952 --a------ C:\WINDOWS\system32\drivers\cmaudio.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
2008-07-06 12:07:36 32768 --a------ C:\WINDOWS\system32\cmnprop.dll <Not Verified; C-Media Corporation; CMI8738/CMI9738 Audio Device>
2008-07-06 12:07:36 712704 --a------ C:\WINDOWS\system32\Audio3D.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-07-06 12:07:36 765952 --a------ C:\WINDOWS\system\crlds3d.dll <Not Verified; Sensaura Ltd; Sensaura 3DPA>
2008-07-06 12:07:36 1855488 --a------ C:\WINDOWS\mixer.exe <Not Verified; C-Media Electronic Inc. (www.cmedia.com.tw); Mixer>
2008-07-06 12:07:36 139264 --a------ C:\WINDOWS\cmuninst.exe <Not Verified; C-Media Electronics Inc.; CMIUninst Application>
2008-07-06 12:07:36 135168 --a------ C:\WINDOWS\cmuninst.dat <Not Verified; C-Media Electronics Inc.; CMIUninst Application>
2008-07-06 12:07:36 39319 --a------ C:\WINDOWS\cmijack.dat
2008-07-06 12:07:36 23041 --a------ C:\WINDOWS\cmaudio.dat
2008-07-06 02:16:35 2746 --a------ C:\WINDOWS\system32\GDMSRV.SYS
2008-07-05 19:14:45 712704 --a------ C:\WINDOWS\system32\a3d.dll <Not Verified; Sensaura Ltd; Sensaura>
2008-07-05 19:14:45 0 d-------- C:\Gamesurround Muse Series Drivers

-- Find3M Report ---------------------------------------------------------------

2008-07-16 21:53:04 0 d-------- C:\Documents and Settings\Tech1\Application Data\Azureus
2008-07-16 21:17:24 0 d-------- C:\Program Files\Starcraft <STARCR~1>
2008-07-15 20:15:48 0 d-------- C:\Program Files\Steam
2008-07-13 18:47:32 0 d-------- C:\Program Files\THQ
2008-07-09 00:58:06 0 d-------- C:\Program Files\PcBugDoctor
2008-07-08 00:52:48 0 d-------- C:\Program Files\PowerISO
2008-07-05 19:14:45 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-01 11:59:55 0 d-------- C:\Program Files\HTV
2008-06-12 22:29:30 0 d-------- C:\Documents and Settings\Tech1\Application Data\Microsoft Games
2008-06-12 22:27:32 0 d-------- C:\Program Files\Advanced System Optimizer
2008-06-12 22:25:52 0 d-------- C:\Program Files\DIFX
2008-06-12 20:41:43 0 d-------- C:\Program Files\Lavasoft
2008-06-12 20:41:21 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 15:36:22 0 d-------- C:\Program Files\AMD
2008-06-10 19:47:08 0 d-------- C:\Program Files\Microsoft Games
2008-06-05 15:52:56 0 d-------- C:\Program Files\Creative
2008-06-05 14:39:50 0 d-------- C:\Documents and Settings\Tech1\Application Data\Adobe
2008-05-24 11:21:40 0 d-------- C:\Program Files\Azureus
2008-04-20 19:50:36 4096 --a----c- C:\WINDOWS\system32\crash

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [09/27/2005 01:16 PM]
"C-Media Mixer"="Mixer.exe" [05/09/2003 11:04 AM C:\WINDOWS\mixer.exe]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [02/12/2008 10:06 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/03/2004 10:56 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=1 (0x1)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsNetHood"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoStrCmpLogical"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsMenu"=1 (0x1)
"NoFavoritesMenu"=1 (0x1)
"NoSMMyDocs"=0 (0x0)
"NoSMMyPictures"=0 (0x0)
"NoStartMenuMyMusic"=0 (0x0)
"NoRecentDocsHistory]"=1 (0x1)
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsNetHood"=1 (0x1)
"NoUserNameInStartMenu"=1 (0x1)
"NoInstrumentation"=1 (0x1)
"NoStartMenuPinnedList"=0 (0x0)
"NoSharedDocuments"=0 (0x0)
"NoRecentDocsHistory"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^VersionTracker Pro.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Tech1^Start Menu^Programs^Startup^AbsoluteShield Internet Eraser.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
C:\WINDOWS\system32\WLTRAY.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]
mHotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
"C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
"C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\F-Secure TNB]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
Logi_MwX.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SQ931STI]
C:\WINDOWS\SQ931STI.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STICAP]
C:\WINDOWS\Twain_32\Webcam Zoom 2.0\SnapTrap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"WMP300NSvc"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Steam"="C:\Program Files\Steam\Steam.exe" -silent
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e3e09d8-9649-11db-9ed5-0017313bcd86}]
AutoRun\command- E:\AutoRunCD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3e6ebc2-8848-11da-8464-806d6172696f}]
AutoRun\command- D:\atisetup.exe
launch\command- D:\atisetup.exe

*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe

-- End of Deckard's System Scanner: finished at 2008-07-16 21:53:12 ------------

#14
technolackey

Posted 16 July 2008 - 10:07 PM

Member

Topic Starter
Member
12 posts

oh and another problem just popped up. Every time i use WMP to watch a movie, WMP, Explorer, and Drwatson (W/e) shuts down and freezes, explorer has to be shut off in taskmanager and then restarted to get my icons back.
will post addictional info, should be easy to do again

#15
technolackey

Posted 16 July 2008 - 10:12 PM

Member

Topic Starter
Member
12 posts

these are the error logs... dunno, gibberish to me, but seems to have same problem with libavcodec.dll or sumthing....

<?xml version="1.0" encoding="UTF-16"?>
<DATABASE>
<EXE NAME="SYSTEM INFO" FILTER="GRABMI_FILTER_SYSTEM">
<MATCHING_FILE NAME="advapi32.dll" SIZE="616960" CHECKSUM="0x8E9BCF02" BIN_FILE_VERSION="5.1.2600.2180" BIN_PRODUCT_VERSION="5.1.2600.2180" PRODUCT_VERSION="5.1.2600.2180" FILE_DESCRIPTION="Advanced Windows 32 Base API" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" ORIGINAL_FILENAME="advapi32.dll" INTERNAL_NAME="advapi32.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xA0DE4" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.2180" UPTO_BIN_PRODUCT_VERSION="5.1.2600.2180" LINK_DATE="08/04/2004 07:56:23" UPTO_LINK_DATE="08/04/2004 07:56:23" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="gdi32.dll" SIZE="282624" CHECKSUM="0x92E2A72F" BIN_FILE_VERSION="5.1.2600.3316" BIN_PRODUCT_VERSION="5.1.2600.3316" PRODUCT_VERSION="5.1.2600.3316" FILE_DESCRIPTION="GDI Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.3316 (xpsp_sp2_gdr.080219-1316)" ORIGINAL_FILENAME="gdi32" INTERNAL_NAME="gdi32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x4AB95" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.3316" UPTO_BIN_PRODUCT_VERSION="5.1.2600.3316" LINK_DATE="02/20/2008 06:51:05" UPTO_LINK_DATE="02/20/2008 06:51:05" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="kernel32.dll" SIZE="984576" CHECKSUM="0xF0B331F6" BIN_FILE_VERSION="5.1.2600.3119" BIN_PRODUCT_VERSION="5.1.2600.3119" PRODUCT_VERSION="5.1.2600.3119" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.3119 (xpsp_sp2_gdr.070416-1301)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xF9293" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.3119" UPTO_BIN_PRODUCT_VERSION="5.1.2600.3119" LINK_DATE="04/16/2007 15:52:53" UPTO_LINK_DATE="04/16/2007 15:52:53" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="ntdll.dll" SIZE="708096" CHECKSUM="0x9D20568" BIN_FILE_VERSION="5.1.2600.2180" BIN_PRODUCT_VERSION="5.1.2600.2180" PRODUCT_VERSION="5.1.2600.2180" FILE_DESCRIPTION="NT Layer DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" ORIGINAL_FILENAME="ntdll.dll" INTERNAL_NAME="ntdll.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xAF2F7" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.2180" UPTO_BIN_PRODUCT_VERSION="5.1.2600.2180" LINK_DATE="08/04/2004 07:56:36" UPTO_LINK_DATE="08/04/2004 07:56:36" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="ole32.dll" SIZE="1285120" CHECKSUM="0xA38DDD0E" BIN_FILE_VERSION="5.1.2600.2726" BIN_PRODUCT_VERSION="5.1.2600.2726" PRODUCT_VERSION="5.1.2600.2726" FILE_DESCRIPTION="Microsoft OLE for Windows" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)" ORIGINAL_FILENAME="OLE32.DLL" INTERNAL_NAME="OLE32.DLL" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x13DC6B" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.2726" UPTO_BIN_PRODUCT_VERSION="5.1.2600.2726" LINK_DATE="07/26/2005 04:39:47" UPTO_LINK_DATE="07/26/2005 04:39:47" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="oleaut32.dll" SIZE="550912" CHECKSUM="0x96DD1D1E" BIN_FILE_VERSION="5.1.2600.3266" BIN_PRODUCT_VERSION="5.1.2600.3266" PRODUCT_VERSION="5.1.2600.3266" COMPANY_NAME="Microsoft Corporation" FILE_VERSION="5.1.2600.3266" INTERNAL_NAME="OLEAUT32.DLL" LEGAL_COPYRIGHT="Copyright © Microsoft Corp. 1993-2001." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x86DD3" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.3266" UPTO_BIN_PRODUCT_VERSION="5.1.2600.3266" LINK_DATE="12/04/2007 18:38:12" UPTO_LINK_DATE="12/04/2007 18:38:12" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="shell32.dll" SIZE="8460288" CHECKSUM="0x36D837B1" BIN_FILE_VERSION="6.0.2900.3241" BIN_PRODUCT_VERSION="6.0.2900.3241" PRODUCT_VERSION="6.00.2900.3241" FILE_DESCRIPTION="Windows Shell Common Dll" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="6.00.2900.3241 (xpsp_sp2_qfe.071025-1245)" ORIGINAL_FILENAME="SHELL32.DLL" INTERNAL_NAME="SHELL32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x82073E" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="6.0.2900.3241" UPTO_BIN_PRODUCT_VERSION="6.0.2900.3241" LINK_DATE="10/26/2007 03:33:59" UPTO_LINK_DATE="10/26/2007 03:33:59" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="user32.dll" SIZE="577536" CHECKSUM="0x1AB40203" BIN_FILE_VERSION="5.1.2600.3099" BIN_PRODUCT_VERSION="5.1.2600.3099" PRODUCT_VERSION="5.1.2600.3099" FILE_DESCRIPTION="Windows XP USER API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.3099 (xpsp_sp2_gdr.070308-0222)" ORIGINAL_FILENAME="user32" INTERNAL_NAME="user32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x940E1" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.3099" UPTO_BIN_PRODUCT_VERSION="5.1.2600.3099" LINK_DATE="03/08/2007 15:36:28" UPTO_LINK_DATE="03/08/2007 15:36:28" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wininet.dll" SIZE="659456" CHECKSUM="0xD8968DA2" BIN_FILE_VERSION="6.0.2900.3354" BIN_PRODUCT_VERSION="6.0.2900.3354" PRODUCT_VERSION="6.00.2900.3354" FILE_DESCRIPTION="Internet Extensions for Win32" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="6.00.2900.3354 (xpsp_sp2_gdr.080417-1412)" ORIGINAL_FILENAME="wininet.dll" INTERNAL_NAME="wininet.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xAB59E" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="6.0.2900.3354" UPTO_BIN_PRODUCT_VERSION="6.0.2900.3354" LINK_DATE="04/21/2008 07:04:00" UPTO_LINK_DATE="04/21/2008 07:04:00" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="winsock.dll" SIZE="2864" CHECKSUM="0x73AE8088" BIN_FILE_VERSION="3.10.0.103" BIN_PRODUCT_VERSION="3.10.0.103" PRODUCT_VERSION="3.10" FILE_DESCRIPTION="Windows Socket 16-Bit DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows™ Operating System" FILE_VERSION="3.10" ORIGINAL_FILENAME="WINSOCK.DLL" INTERNAL_NAME="WINSOCK" LEGAL_COPYRIGHT="Copyright © Microsoft Corp. 1981-1996" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x10001" VERFILETYPE="0x2" MODULE_TYPE="WIN16" S16BIT_DESCRIPTION="BSD Socket API for Windows" S16BIT_MODULE_NAME="WINSOCK" UPTO_BIN_FILE_VERSION="3.10.0.103" UPTO_BIN_PRODUCT_VERSION="3.10.0.103" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
<EXE NAME="libavcodec.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
<MATCHING_FILE NAME="libavcodec.dll" SIZE="3142656" CHECKSUM="0xCBA2F392" MODULE_TYPE="WIN32" PE_CHECKSUM="0x30D4EE" LINKER_VERSION="0x10000" LINK_DATE="04/13/2008 11:00:03" UPTO_LINK_DATE="04/13/2008 11:00:03" />
</EXE>
</DATABASE>

<?xml version="1.0" encoding="UTF-16"?>
<DATABASE>
<EXE NAME="wmplayer.exe" FILTER="GRABMI_FILTER_PRIVACY">
<MATCHING_FILE NAME="custsat.dll" SIZE="28672" CHECKSUM="0xA3A3A810" BIN_FILE_VERSION="1.0.18.1900" BIN_PRODUCT_VERSION="1.0.18.1900" PRODUCT_VERSION="1.00.0018.1900" FILE_DESCRIPTION="custsat" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® CustSat DLL" FILE_VERSION="1.00.0018.1900 (xpsp.040420-1835)" ORIGINAL_FILENAME="custsat.dll" INTERNAL_NAME="custsat" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0xE989" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="1.0.18.1900" UPTO_BIN_PRODUCT_VERSION="1.0.18.1900" LINK_DATE="04/21/2004 04:17:56" UPTO_LINK_DATE="04/21/2004 04:17:56" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="migrate.exe" SIZE="991232" CHECKSUM="0xF6474F8C" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="MLS Migrate DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Services" FILE_VERSION="10.00.00.3646 built by: DNSRV(bld4act)" ORIGINAL_FILENAME="migrate.exe" INTERNAL_NAME="migrate.exe" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFED9E" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="08/11/2004 04:51:22" UPTO_LINK_DATE="08/11/2004 04:51:22" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="mplayer2.exe" SIZE="4639" CHECKSUM="0xD936D10" BIN_FILE_VERSION="6.4.9.1125" BIN_PRODUCT_VERSION="6.4.9.1125" PRODUCT_VERSION="6.4.09.1125" FILE_DESCRIPTION="Windows Media Player" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft Windows Media Player" FILE_VERSION="6.4.09.1125" ORIGINAL_FILENAME="MPlayer2.exe" INTERNAL_NAME="MPlayer2.exe" LEGAL_COPYRIGHT="Copyright © 1992-1999 Microsoft Corp." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0xAFD9" LINKER_VERSION="0x50000" UPTO_BIN_FILE_VERSION="6.4.9.1125" UPTO_BIN_PRODUCT_VERSION="6.4.9.1125" LINK_DATE="07/30/2002 01:25:22" UPTO_LINK_DATE="07/30/2002 01:25:22" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="mpvis.dll" SIZE="344064" CHECKSUM="0xBFFAAC26" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="Windows Media Player Visualization" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3646" ORIGINAL_FILENAME="MPVIS.DLL" INTERNAL_NAME="MPVIS.DLL" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x5D2D6" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="08/11/2004 05:07:06" UPTO_LINK_DATE="08/11/2004 05:07:06" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="msoobci.dll" SIZE="47616" CHECKSUM="0x1DDFDC4E" BIN_FILE_VERSION="5.2.3790.1216" BIN_PRODUCT_VERSION="5.2.3790.1216" PRODUCT_VERSION="5.2.3790.1216" FILE_DESCRIPTION="Out of Band Component Installer" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.2.3790.1216 (dnsrv_dev(mariant).040225-1544)" ORIGINAL_FILENAME="MSOOBCI.DLL" INTERNAL_NAME="MSOOBCI.DLL" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x12DF3" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="5.2.3790.1216" UPTO_BIN_PRODUCT_VERSION="5.2.3790.1216" LINK_DATE="07/08/2004 23:23:52" UPTO_LINK_DATE="07/08/2004 23:23:52" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="npdrmv2.dll" SIZE="226816" CHECKSUM="0xF0B44A00" BIN_FILE_VERSION="9.0.0.3250" BIN_PRODUCT_VERSION="9.0.0.3250" PRODUCT_VERSION="9.00.00.3250" FILE_DESCRIPTION="DRM Netscape Network Object" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® DRM" FILE_VERSION="9.00.00.3250" ORIGINAL_FILENAME="npdrmv2.dll" INTERNAL_NAME="npdrmv2.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x3F3AF" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="9.0.0.3250" UPTO_BIN_PRODUCT_VERSION="9.0.0.3250" LINK_DATE="08/04/2004 07:56:52" UPTO_LINK_DATE="08/04/2004 07:56:52" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="npdsplay.dll" SIZE="364544" CHECKSUM="0xCC73BBE3" BIN_FILE_VERSION="3.0.2.629" BIN_PRODUCT_VERSION="3.0.2.629" PRODUCT_VERSION="3.0.2.629" FILE_DESCRIPTION="Npdsplay dll" COMPANY_NAME="Microsoft Corporation (written by Digital Renaissance Inc.)" PRODUCT_NAME="Windows Media Player Plug-in Dynamic Link Library" FILE_VERSION="3.0.2.629" ORIGINAL_FILENAME="Npdsplay.dll" INTERNAL_NAME="Npdsplay" LEGAL_COPYRIGHT="Copyright © 1999-2001" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="3.0.2.629" UPTO_BIN_PRODUCT_VERSION="3.0.2.629" LINK_DATE="11/30/2005 00:27:04" UPTO_LINK_DATE="11/30/2005 00:27:04" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="npwmsdrm.dll" SIZE="10240" CHECKSUM="0xAF8EB2D7" BIN_FILE_VERSION="9.0.0.3250" BIN_PRODUCT_VERSION="9.0.0.3250" PRODUCT_VERSION="9.00.00.3250" FILE_DESCRIPTION="DRM Store Netscape Plugin" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® DRM" FILE_VERSION="9.00.00.3250" ORIGINAL_FILENAME="npwmsdrm.dll" INTERNAL_NAME="npwmsdrm.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFB9F" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="9.0.0.3250" UPTO_BIN_PRODUCT_VERSION="9.0.0.3250" LINK_DATE="08/04/2004 07:56:55" UPTO_LINK_DATE="08/04/2004 07:56:55" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="setup_wm(2).exe" SIZE="1669120" CHECKSUM="0xDE341C53" BIN_FILE_VERSION="11.0.5721.5146" BIN_PRODUCT_VERSION="11.0.5721.5146" PRODUCT_VERSION="11.0.5721.5146" FILE_DESCRIPTION="Microsoft Windows Media Configuration Utility" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="11.0.5721.5146 (WMP_11.061018-2006)" ORIGINAL_FILENAME="setup_wm.exe" INTERNAL_NAME="setup_wm.exe" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x198E91" LINKER_VERSION="0x60000" UPTO_BIN_FILE_VERSION="11.0.5721.5146" UPTO_BIN_PRODUCT_VERSION="11.0.5721.5146" LINK_DATE="11/02/2006 02:31:36" UPTO_LINK_DATE="11/02/2006 02:31:36" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="setup_wm(3).exe" SIZE="1669120" CHECKSUM="0xDE341C53" BIN_FILE_VERSION="11.0.5721.5146" BIN_PRODUCT_VERSION="11.0.5721.5146" PRODUCT_VERSION="11.0.5721.5146" FILE_DESCRIPTION="Microsoft Windows Media Configuration Utility" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="11.0.5721.5146 (WMP_11.061018-2006)" ORIGINAL_FILENAME="setup_wm.exe" INTERNAL_NAME="setup_wm.exe" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x198E91" LINKER_VERSION="0x60000" UPTO_BIN_FILE_VERSION="11.0.5721.5146" UPTO_BIN_PRODUCT_VERSION="11.0.5721.5146" LINK_DATE="11/02/2006 02:31:36" UPTO_LINK_DATE="11/02/2006 02:31:36" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="setup_wm.exe" SIZE="819200" CHECKSUM="0x15D7021D" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="Microsoft Windows Media Configuration Utility" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3646" ORIGINAL_FILENAME="setup_wm" INTERNAL_NAME="setup_wm" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0xC9FDA" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="09/10/2004 22:07:46" UPTO_LINK_DATE="09/10/2004 22:07:46" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wmlaunch.exe" SIZE="122880" CHECKSUM="0x8F9D7076" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="Windows Media Player Launcher" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3646" ORIGINAL_FILENAME="WMLaunch.exe" INTERNAL_NAME="WMLaunch.exe" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x25A9D" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="08/11/2004 04:52:14" UPTO_LINK_DATE="08/11/2004 04:52:14" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wmpband.dll" SIZE="77824" CHECKSUM="0x690D3FA6" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="Windows Media Player" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3646" ORIGINAL_FILENAME="WMDBAND.DLL" INTERNAL_NAME="WMDBAND.DLL" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x17FA2" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="08/11/2004 07:34:03" UPTO_LINK_DATE="08/11/2004 07:34:03" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wmpenc.exe" SIZE="28672" CHECKSUM="0xE3442F26" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="Windows Media Player Encoder Helper" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3646" ORIGINAL_FILENAME="WMPENC.EXE" INTERNAL_NAME="WMPENC.EXE" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0xE3C5" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="08/11/2004 04:52:17" UPTO_LINK_DATE="08/11/2004 04:52:17" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wmplayer.exe" SIZE="73728" CHECKSUM="0xE5EA16B6" BIN_FILE_VERSION="10.0.0.3646" BIN_PRODUCT_VERSION="10.0.0.3646" PRODUCT_VERSION="10.00.00.3646" FILE_DESCRIPTION="Windows Media Player" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3646" ORIGINAL_FILENAME="WMPLAYER.EXE" INTERNAL_NAME="WMPLAYER.EXE" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x18F0C" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3646" UPTO_BIN_PRODUCT_VERSION="10.0.0.3646" LINK_DATE="08/11/2004 07:34:06" UPTO_LINK_DATE="08/11/2004 07:34:06" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wmpns.dll" SIZE="221184" CHECKSUM="0xC2DBDAE7" BIN_FILE_VERSION="9.0.0.3250" BIN_PRODUCT_VERSION="9.0.0.3250" PRODUCT_VERSION="9.00.00.3250" FILE_DESCRIPTION="Windows Media Player Applet Support DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="9.00.00.3250" ORIGINAL_FILENAME="WMPNS.DLL" INTERNAL_NAME="WMPNS.DLL" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x3B87B" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="9.0.0.3250" UPTO_BIN_PRODUCT_VERSION="9.0.0.3250" LINK_DATE="08/04/2004 07:57:23" UPTO_LINK_DATE="08/04/2004 07:57:23" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wmsetsdk.exe" SIZE="819200" CHECKSUM="0x15D7021D" BIN_FILE_VERSION="10.0.0.3802" BIN_PRODUCT_VERSION="10.0.0.3802" PRODUCT_VERSION="10.00.00.3802" FILE_DESCRIPTION="Microsoft Windows Media Configuration Utility" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows Media Player" FILE_VERSION="10.00.00.3802" ORIGINAL_FILENAME="setup_wm" INTERNAL_NAME="setup_wm" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0xD2989" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="10.0.0.3802" UPTO_BIN_PRODUCT_VERSION="10.0.0.3802" LINK_DATE="01/28/2005 09:26:04" UPTO_LINK_DATE="01/28/2005 09:26:04" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
<EXE NAME="libavcodec.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
<MATCHING_FILE NAME="libavcodec.dll" SIZE="3142656" CHECKSUM="0xCBA2F392" MODULE_TYPE="WIN32" PE_CHECKSUM="0x30D4EE" LINKER_VERSION="0x10000" LINK_DATE="04/13/2008 11:00:03" UPTO_LINK_DATE="04/13/2008 11:00:03" />
</EXE>
<EXE NAME="kernel32.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
<MATCHING_FILE NAME="kernel32.dll" SIZE="984576" CHECKSUM="0xF0B331F6" BIN_FILE_VERSION="5.1.2600.3119" BIN_PRODUCT_VERSION="5.1.2600.3119" PRODUCT_VERSION="5.1.2600.3119" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.3119 (xpsp_sp2_gdr.070416-1301)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xF9293" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.3119" UPTO_BIN_PRODUCT_VERSION="5.1.2600.3119" LINK_DATE="04/16/2007 15:52:53" UPTO_LINK_DATE="04/16/2007 15:52:53" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
</DATABASE>