Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Several malware that I've had for a while that I can't remove

Started by Jeremy144 , Aug 10 2008 02:08 PM

  • This topic is locked This topic is locked

#1
Jeremy144
Posted 10 August 2008 - 02:08 PM

Jeremy144

    New Member

  • Member
  • Pip
  • 4 posts
I've had some trojans/malware for a while and I can't get rid of them. I'm hoping people here can help. This is what I get when I copy/paste the files my virus remover can't remove:

detected: Trojan program Trojan.Win32.Pakes.cdw File: c:\windows\system32\agcpanelfrenc.dll
detected: malware Exploit.Java.Gimsh.b File: c:\documents and settings\ben\application data\sun\java\deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-20d03289.zip
detected: malware Exploit.Java.Gimsh.b File: c:\documents and settings\ben\application data\sun\java\deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3ad601a5-20d03289.zip/vmain.class
detected: malware Exploit.Java.Gimsh.b File: c:\documents and settings\ben\application data\sun\java\deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5efd1945-79748413.zip
detected: malware Exploit.Java.Gimsh.b File: c:\documents and settings\ben\application data\sun\java\deployment\cache\javapi\v1.0\jar\jvmimpro.jar-5efd1945-79748413.zip/vmain.class
detected: malware not-virus:Hoax.JS.Agent.a File: c:\documents and settings\rachel\local settings\temporary internet files\content.ie5\h67lxyw6\asecureboard[1].htm
detected: Trojan program Trojan-Dropper.Win32.VB.aqm File: c:\documents and settings\ben\my documents\my music\new downloads\world of warcraft keygen\keygen.exe

agcpanelfrenc.dll is a weird one, won't delete and I've had it for a while. And it's in system32 and I assume that's worse than normal problems.

But anyway here's my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:06:52 PM, on 8/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\LimeWire\LimeWire 4.0.8\LimeWire.exe
C:\Documents and Settings\Jeremy\Desktop\Firefox 3\firefox.exe
C:\Documents and Settings\Jeremy\Desktop\Everything²\Winamp²\Winamp³\winamp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =

ftp=127.0.0.1:3389;http=127.0.0.1:3389
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {1F86D33C-CF22-4B7D-885E-22754F68FBAB} - C:\WINDOWS\system32\efcbxxy.dll (file

missing)
O2 - BHO: (no name) - {27CA571B-14D3-4937-B387-BE72FA7A0F87} - C:\WINDOWS\system32\nnnlklj.dll (file

missing)
O2 - BHO: (no name) - {2948324F-2113-4639-A997-D86362849C78} - C:\WINDOWS\system32\AgCPanelFrenc.dll
O2 - BHO: (no name) - {2A8D84E0-A81B-4BB0-B75A-E370AF523776} - C:\WINDOWS\system32\nocbfxeg.dll (file

missing)
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program

Files\FlashGet\jccatch.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program

Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8324418D-95DA-4425-94F6-8B2E4390866c} - C:\WINDOWS\system32\nocbfxeg.dll (file

missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {C46BD658-90E1-45B0-A3A3-2403130CF822} - C:\WINDOWS\system32\nocbfxeg.dll (file

missing)
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\hmcxaaxp.dll (file

missing)
O2 - BHO: (no name) - {DF8B46E1-5FFB-4F2F-8A3A-3563536E2358} - C:\WINDOWS\system32\nocbfxeg.dll (file

missing)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program

Files\FlashGet\getflash.dll
O2 - BHO: (no name) - {F994E8E7-7922-4295-9A44-8753A22F467c} - C:\WINDOWS\system32\nocbfxeg.dll (file

missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt

7\SnagItIEAddin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - c:\documents and

settings\jeremy\desktop\Digital Overlay\msdxm.ocx (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program

Files\BitDefender\BitDefender 2008\IEToolbar.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Jeremy\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P

DellSupportCenter
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P

DellSupportCenter
O4 - HKCU\..\Run: [AIM] C:\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKLM\..\Policies\Explorer\Run: [dcomcfg.exe] dcomcfg.exe
O4 - Startup: MEMonitor.lnk = C:\Documents and Settings\Jeremy\Desktop\V CAST Music

Manager\MEMonitor.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture

Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\aim\aim.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program

Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program

Files\FlashGet\FlashGet.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -

http://bin.mcafee.co...84/mcinsctl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -

http://messenger.zon...O/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -

http://download.bitd...can8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.micros...b?1129229081125
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) -

http://asp.mathxl.co...nstallAsst2.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -

http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -

http://bin.mcafee.co...,21/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -

http://messenger.zon...nt.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) -

http://gamedownload....GPlugin9USA.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) -

http://asp.mathxl.co.../MathPlayer.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -

http://messenger.zon...er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) -

https://secure.gopet...v/GoPetsWeb.cab
O20 - Winlogon Notify: efcbxxy - efcbxxy.dll (file missing)
O20 - Winlogon Notify: nnnlklj - nnnlklj.dll (file missing)
O20 - Winlogon Notify: wingsa32 - wingsa32.dll (file missing)
O20 - Winlogon Notify: winpsa32 - winpsa32.dll (file missing)
O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
O21 - SSODL: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - (no file)
O22 - SharedTaskScheduler: ecosystems - {af3fd9a8-1287-4159-9212-9a5b4494af70} - (no file)
O22 - SharedTaskScheduler: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
O22 - SharedTaskScheduler: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk

Shared\Service\AdskScSrv.exe
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield

Deluxe 2008\avp.exe
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j7231130.exe

(file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\sqybsllr.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common

Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: PinnacleUpdate Service (PinnacleUpdateSvc) - Unknown owner - C:\Program

Files\KALiNKOsoft\Pinnacle Game Profiler\pinnacle_updater.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc.

- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol

Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender

2008\vsserv.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows

Live\installer\WLSetupSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common

Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 12472 bytes




Please let me know if any more info will help. Thanks to everyone who helps in advance. =)
  • 0

Advertisements

#2
Rorschach112
Posted 10 August 2008 - 03:36 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Open notepad, click Format, uncheck wordwrap


Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum.



Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

  • 0

#3
Jeremy144
Posted 11 August 2008 - 01:39 PM

Jeremy144

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
SDFix: Version 1.215
Run by Jeremy on Mon 08/11/2008 at 02:15 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Documents and Settings\Jeremy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com\settings.sol - Deleted
C:\Documents and Settings\Jeremy\Favorites\Online Security Test.url - Deleted
C:\DOCUME~1\Jeremy\LOCALS~1\Temp\removalfile.bat - Deleted
C:\WINDOWS\system32\unsvchosts.lzma - Deleted



Folder C:\Documents and Settings\Jeremy\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.redtube.com - Removed


Removing Temp Files

ADS Check :


C:\WINDOWS\system32
:{DA6227CB-326B-4B4D-9A81-04B81F1538DD} 12
Total size: 12 bytes.
system32: deleted 12 bytes in 1 streams.

Checking for remaining Streams

C:\WINDOWS\system32
No streams found.


Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-11 15:08:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:f0fbd26c
"s2"=dword:a2385d27
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:65,b7,f8,3a,d2,4b,c1,2e,3c,69,af,65,4e,2f,f1,bc,e9,bb,1b,92,19,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,e5,8d,ea,58,df,19,f5,bf,46,95,8d,58,6f,5e,cb,4c,cd,b0,5b,29,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,9f,36,ad,65,f4,38,d2,3a,63,06,05,fe,21,1e,b8,2d,c1,..
"khjeh"=hex:bd,53,44,22,b0,3f,99,b9,d6,60,60,73,73,c2,93,6a,d9,ca,4c,6c,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ad,20,51,bc,92,5e,dd,1c,4c,ce,a1,d5,3d,6f,31,74,db,4e,30,69,2e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:fe,de,7b,1d,85,30,5d,cf,7c,b9,a7,74,f7,a0,b9,38,4d,f7,14,86,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:ad,7f,3b,4c,40,45,cf,cd,76,96,dd,b9,01,8f,ab,0c,ec,2b,e9,98,14,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:21,cb,6a,10,4c,01,f1,43,93,07,6b,74,43,8a,5f,01,cf,2c,f6,21,1f,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:65,b7,f8,3a,d2,4b,c1,2e,3c,69,af,65,4e,2f,f1,bc,e9,bb,1b,92,19,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:47,e5,8d,ea,58,df,19,f5,bf,46,95,8d,58,6f,5e,cb,4c,cd,b0,5b,29,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,9f,36,ad,65,f4,38,d2,3a,63,06,05,fe,21,1e,b8,2d,c1,..
"khjeh"=hex:bd,53,44,22,b0,3f,99,b9,d6,60,60,73,73,c2,93,6a,d9,ca,4c,6c,40,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ad,20,51,bc,92,5e,dd,1c,4c,ce,a1,d5,3d,6f,31,74,db,4e,30,69,2e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:fe,de,7b,1d,85,30,5d,cf,7c,b9,a7,74,f7,a0,b9,38,4d,f7,14,86,4e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:ad,7f,3b,4c,40,45,cf,cd,76,96,dd,b9,01,8f,ab,0c,ec,2b,e9,98,14,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:21,cb,6a,10,4c,01,f1,43,93,07,6b,74,43,8a,5f,01,cf,2c,f6,21,1f,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1A2715E3-0BA5-3862-CC11-FCECBE384C48}]
"iacgldgefmfiiocipf"=hex:6a,61,70,67,62,64,6b,63,6f,68,6d,6f,70,68,64,6f,6e,62,6d,68,00,..
"hamcbgeickaapijg"=hex:6a,61,66,68,63,66,70,6c,6a,65,68,61,63,70,6a,63,6b,69,6f,69,00,..
"iaoebfffjedbidhmcb"=hex:63,61,69,68,65,67,00,00

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Valve\\Steam\\Steam.exe"="C:\\Program Files\\Valve\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Call of Duty\\CoDMP.exe"="C:\\Program Files\\Call of Duty\\CoDMP.exe:*:Enabled:CoDMP"
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\\Documents and Settings\\Jeremy\\Desktop\\Enemy Territory\\ET.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\Enemy Territory\\ET.exe:*:Enabled:ET"
"C:\\Documents and Settings\\Jeremy\\Desktop\\mIRC\\mirc.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\graal2001\\Graal3.exe"="C:\\graal2001\\Graal3.exe:*:Enabled:Graal3"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\BitTorrent\\btdownloadgui.exe"="C:\\Program Files\\BitTorrent\\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\\Program Files\\LimeWire\\LimeWire 4.0.8\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire 4.0.8\\LimeWire.exe:*:Enabled:LimeWire: The most advanced file sharing program on the planet."
"C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Enabled:Halo"
"C:\\Program Files\\softnyx\\GunBound\\GunBound.exe"="C:\\Program Files\\softnyx\\GunBound\\GunBound.exe:*:Enabled:GunBound Startup Application"
"C:\\Program Files\\softnyx\\GunBound\\GunBound.gme"="C:\\Program Files\\softnyx\\GunBound\\GunBound.gme:*:Enabled:GunBound"
"C:\\Documents and Settings\\Jeremy\\Local Settings\\Temp\\Rar$EX00.437\\ListServer_Log_Hack.exe"="C:\\Documents and Settings\\Jeremy\\Local Settings\\Temp\\Rar$EX00.437\\ListServer_Log_Hack.exe:*:Disabled:ListServer"
"C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\survivalproject.exe"="C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\survivalproject.exe:*:Enabled:survivalproject"
"C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\sp.exe"="C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\sp.exe:*:Enabled:sp"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\NowWAP\\wap3gxs.exe"="C:\\Program Files\\NowWAP\\wap3gxs.exe:*:Enabled:wap3gxs"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Rockstar Games\\Grand Theft Auto\\WINO\\Grand Theft Auto.exe"="C:\\Program Files\\Rockstar Games\\Grand Theft Auto\\WINO\\Grand Theft Auto.exe:*:Enabled:Grand Theft Auto"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\dedicated server\\hlds.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\dedicated server\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\day of defeat\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\team fortress classic\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\team fortress classic\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\UPDATE.EXE"="C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\UPDATE.EXE:*:Enabled:UPDATE"
"C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\DFBHD.EXE"="C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\DFBHD.EXE:*:Enabled:DFBHD"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windowsr NetMeetingr"
"C:\\UT2003Demo\\System\\UT2003.exe"="C:\\UT2003Demo\\System\\UT2003.exe:*:Enabled:UT2003"
"C:\\Program Files\\GameSpy Arcade\\Services\\gspoker\\Poker-GS.exe"="C:\\Program Files\\GameSpy Arcade\\Services\\gspoker\\Poker-GS.exe:*:Enabled:GameSpy Poker by Jeff Anderson"
"C:\\Program Files\\GameSpy Arcade\\Services\\gsyarn\\YARN-GS.exe"="C:\\Program Files\\GameSpy Arcade\\Services\\gsyarn\\YARN-GS.exe:*:Enabled:GameSpy YARN - The multiplayer network story game! By Jeff Anderson"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2\\hl2.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\condition zero\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike source\\hl2.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\source dedicated server\\srcds.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\source dedicated server\\srcds.exe:*:Enabled:srcds"
"C:\\UT2004Demo\\System\\UT2004.exe"="C:\\UT2004Demo\\System\\UT2004.exe:*:Enabled:UT2004"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\DAP\\DAP.exe"="C:\\Program Files\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus"
"C:\\Program Files\\EA GAMES\\Battlefield 1942 Multiplayer Demo\\BF1942Demo.exe"="C:\\Program Files\\EA GAMES\\Battlefield 1942 Multiplayer Demo\\BF1942Demo.exe:*:Enabled:BF1942Demo"
"C:\\Documents and Settings\\Jeremy\\Desktop\\Flashget Downloads\\GraalControl\\Graal Control Server.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\Flashget Downloads\\GraalControl\\Graal Control Server.exe:*:Enabled:Graal Control Server"
"C:\\Documents and Settings\\Ben\\My Documents\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Ben\\My Documents\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Jeremy\\Desktop\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Jeremy\\Desktop\\BLOCKLAND\\blockland0002\\blockLand.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\BLOCKLAND\\blockland0002\\blockLand.exe:*:Enabled:blockLand"
"C:\\graal2001\\Graal.exe"="C:\\graal2001\\Graal.exe:*:Enabled:RPG online game"
"C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\SmartFTP\\SmartFTP.exe"="C:\\Program Files\\SmartFTP\\SmartFTP.exe:*:Enabled:SmartFTP Client"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services"
"C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe"="C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Documents and Settings\\Jeremy\\Desktop\\BitLord\\BitLord.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"C:\\Documents and Settings\\Jeremy\\Desktop\\superscan4\\SuperScan4.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\superscan4\\SuperScan4.exe:*:Enabled:SuperScan 4 Beta 1"
"C:\\Program Files\\Xfire\\Xfire.exe"="C:\\Program Files\\Xfire\\Xfire.exe:*:Enabled:Xfire"
"C:\\Documents and Settings\\Jeremy\\Desktop\\roboclient\\robosrv.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\roboclient\\robosrv.exe:*:Enabled:robosrv"
"C:\\Documents and Settings\\Jeremy\\Desktop\\tsgrinder-2.03\\tsgrinder.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\tsgrinder-2.03\\tsgrinder.exe:*:Enabled:tsgrinder"
"C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-enUS-downloader.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jeremy\\Desktop\\freeSSHd\\FreeSSHDService.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\freeSSHd\\FreeSSHDService.exe:*:Enabled:FreeSSHDService Module"
"C:\\Program Files\\Sierra Online\\FreeStyle Street Basketball™\\FreeStyle.exe"="C:\\Program Files\\Sierra Online\\FreeStyle Street Basketball™\\FreeStyle.exe:*:Enabled:FreeStyle"
"C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\BackgroundDownloader.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\World of Warcraft\\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Documents and Settings\\Jeremy\\My Documents\\firefox.exe"="C:\\Documents and Settings\\Jeremy\\My Documents\\firefox.exe:*:Enabled:Firefox"
"C:\\aim\\aim.exe"="C:\\aim\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Steam\\steamapps\\p3rf3ct_pl4y3r\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\steamapps\\p3rf3ct_pl4y3r\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\WINDOWS\\system32\\sqybsllr.exe"="C:\\WINDOWS\\system32\\sqy"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"
"C:\\Documents and Settings\\Jeremy\\Desktop\\AIM6\\aim6.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\AIM6\\aim6.exe:*:Enabled:AIM"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Documents and Settings\\Jeremy\\Desktop\\Face of Mankind\\Lithtech.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\Face of Mankind\\Lithtech.exe:*:Enabled:Client"
"C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Documents and Settings\\Jeremy\\iTunes\\iTunes.exe"="C:\\Documents and Settings\\Jeremy\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe"="C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\aim\\aim.exe"="C:\\aim\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 8 Jun 2005 56 ..SHR --- "C:\WINDOWS\system32\6135811CA6.sys"
Sat 13 Jan 2007 11,690 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Tue 11 Sep 2007 2,042,434 ..SH. --- "C:\WINDOWS\system32\rrutv.bak1"
Mon 5 Nov 2007 379,598 ..SH. --- "C:\WINDOWS\system32\rrutv.bak2"
Sun 2 Dec 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\19f74l02.TMP"
Fri 11 Jan 2008 616,448 A.SH. --- "C:\WINDOWS\Temp\376epsr1.TMP"
Sun 13 Jan 2008 616,448 A.SH. --- "C:\WINDOWS\Temp\6ar3dml5.TMP"
Sun 13 Jan 2008 616,448 A.SH. --- "C:\WINDOWS\Temp\6v7hts8i.TMP"
Sun 2 Dec 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\e1ypcjgh.TMP"
Sun 2 Dec 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\i7tnq4mu.TMP"
Sat 1 Dec 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\jeddchdk.TMP"
Sun 9 Dec 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\mfnzui7f.TMP"
Mon 3 Dec 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\y90plsas.TMP"
Fri 30 Nov 2007 616,448 A.SH. --- "C:\WINDOWS\Temp\ypr297wq.TMP"
Wed 22 Sep 2004 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 22 Sep 2004 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv19.bak"
Sun 21 Jan 2007 19,968 ...H. --- "C:\Documents and Settings\Jeremy\My Documents\~WRL1862.tmp"
Sat 15 Oct 2005 72 A..H. --- "C:\Program Files\ATI Multimedia\RemCtrl\x10prod.sys"
Mon 6 Nov 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 27 Feb 2004 233,472 A..H. --- "C:\Documents and Settings\Jeremy\Desktop\FL Studio 7\REX Shared Library.dll"
Sat 3 May 2008 45,116 ...H. --- "C:\Documents and Settings\Owner\Local Settings\Temp\[email protected]"
Sat 3 May 2008 1,409 ...H. --- "C:\Documents and Settings\Owner\Local Settings\Temp\[email protected]"
Wed 10 Aug 2005 444 ...HR --- "C:\Documents and Settings\Jeremy\Application Data\SecuROM\UserData\securom_v7_01.bak"
Sun 15 Apr 2007 8 A..H. --- "C:\Documents and Settings\Dad\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"
Wed 7 Nov 2007 8 A..H. --- "C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp"
Wed 7 Nov 2007 8 A..H. --- "C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp"
Wed 7 Nov 2007 8 A..H. --- "C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp"
Wed 7 Nov 2007 8 A..H. --- "C:\Documents and Settings\Owner\Application Data\GTek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp"

Finished!

I'll post the next two logs in a few minutes

Edit: I guess I won't be. That link isn't working..

Edited by Jeremy144, 11 August 2008 - 01:40 PM.

  • 0

#4
Rorschach112
Posted 11 August 2008 - 02:24 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
The link works fine for me.


Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\WINDOWS\system32\rrutv.bak1
C:\WINDOWS\system32\rrutv.bak2
purity 
EmptyTemp
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
  • 0

#5
Jeremy144
Posted 12 August 2008 - 12:20 PM

Jeremy144

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Explorer killed successfully
C:\WINDOWS\system32\rrutv.bak1 moved successfully.
C:\WINDOWS\system32\rrutv.bak2 moved successfully.
< purity >
< EmptyTemp >
File delete failed. C:\DOCUME~1\Jeremy\LOCALS~1\Temp\qacjyslc.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Jeremy\LOCALS~1\Temp\hsperfdata_Jeremy\3244 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\32x32_ale.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\32x32_upd.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\ci.dll scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\cires_en.dll scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\desktop.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\earth.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\empty.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\eula.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdater.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterAdminPrefs.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterInstallMgr.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterService.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterSetup.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\gtfirstboot.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\history.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\installer.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\lm.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\localized_eula.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\maintainer.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\minus.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\msg_error.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\npCIDetect11.dll scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\pack.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\pack_large.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\pack_logo.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\picasa.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\plus.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\preferences.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\proxy.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\roundl_g.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\roundr_g.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\shield.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\sort_down.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\sort_up.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\talk.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\toolbar.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\ui.css scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\ui.js scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\ul.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\updates.htm scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\ur.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\waiting.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\gis7966feb7\waiting32.gif scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\IXP000.TMP\BACKUP~1.EXE scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\NDP20-KB917283-X86\NDP20-KB917283-X86-msi.0.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\NDP20-KB917283-X86\NDP20-KB917283-X86-wrapper.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\NDP20-KB922770-X86\NDP20-KB922770-X86-wrapper.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\NDP20-KB928365-v2-X86\NDP20-KB928365-v2-X86-msi.0.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\NDP20-KB928365-v2-X86\NDP20-KB928365-v2-X86-wrapper.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000006b\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000098\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000166\tmp00006479 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000268\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000290\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000002dc\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000032f\tmp00000b19 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000032f\tmp00002b9d scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000528\tmp000035c7 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000064f\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000655\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000091b\tmp000008eb scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000a8e\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000a9e\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000bed\tmp00004ef7 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000c2a\tmp000033b0 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000dd3\tmp000111c5 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000edd\tmp0000067c scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00000edd\tmp00004599 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001086\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000012a3\tmp00005e66 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000012a9\tmp00000b18 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000012f7\tmp00002ec7 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000012f7\tmp00002ecd scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000012f7\tmp00003d40 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000137e\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000014ba\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000014be\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000015c9\tmp0000aa84 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000016ec\tmp000003b0 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000018df\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000019a2\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001acf\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001aff\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001c0e\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001c6b\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001ead\tmp00007f56 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00001fb3\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002007\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002055\tmp00000ec9 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002160\tmp000074c2 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000021ec\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000227f\tmp0000a533 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000227f\tmp0000aa3d scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000227f\tmp0000ef8e scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000227f\tmp0000f28b scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000227f\tmp00016ac3 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000023c8\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000248a\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000024c5\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000275d\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002a7e\tmp000000c2 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002a7e\tmp000027ef scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002adf\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002b45\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002c7f\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002d17\tmp000050ab scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002ed4\tmp0000015e scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002ed4\tmp00001820 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002ee3\tmp00006ff2 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00002f55\tmp00002831 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003118\tmp00000bf0 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000031d3\tmp000003d3 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000031d3\tmp00002033 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000321e\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000336a\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000344e\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000352c\tmp00002c6a scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000379f\tmp00000875 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000038ad\tmp00000231 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000038ad\tmp00000d0a scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000038ae\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000038dc\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000039b8\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003a14\tmp00002086 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003a65\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003a74\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003bc0\tmp00005a6d scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003c1d\tmp00003e4c scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003dac\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003dc7\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003e56\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003f3c\tmp00002332 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003f3c\tmp00002333 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00003fb1\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000040fb\tmp00002b96 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000041b9\tmp00004e8d scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000420b\tmp000049bf scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000420b\tmp0001000f scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000042c7\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000452a\tmp00000b25 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000047a2\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000047e7\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004856\tmp00003740 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000048be\tmp0000608d scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000497c\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004c1b\tmp00000624 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004cf8\tmp00006388 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004d46\tmp00000093 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004d5e\tmp000061ba scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004e6e\tmp000013e1 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004e6e\tmp00001a98 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004e88\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004ee4\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004f26\tmp00000082 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004f26\tmp000066ba scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00004f31\tmp00000bf7 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005056\tmp00000046 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005056\tmp00007cec scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005175\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005279\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000052d5\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005439\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005450\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005651\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000056cc\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005731\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005833\tmp00007264 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000583f\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005878\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000059ab\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005afb\tmp00000c28 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005bae\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005bc6\tmp00008c99 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005c86\tmp0000676b scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005ca7\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005cc0\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005d23\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005db1\tmp0000467b scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005f23\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00005f9b\tmp00003568 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000607f\tmp00007866 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00006258\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000626f\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000066b7\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000688b\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000068ea\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00006bf6\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00006c1b\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007264\tmp00001a9f scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007264\tmp00003ced scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000072ec\tmp00000a39 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000753b\tmp00000d48 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp0000765a\tmp000078c8 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007690\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000076c1\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp000078cd\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007ab3\tmp00000929 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007ab3\tmp00000bb8 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007bfc\tmp0000095f scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007bfc\tmp00007a26 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007d68\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007e37\tmp000054a4 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007eb6\tmp00000000 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007f06\tmp0000e1d4 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\tmp00007f06\tmp0000e2fb scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZNW2BA\manifest.ini scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZNW2BA\NDP20-KB928365-v2-X86.msp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZNW41B\manifest.ini scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\ZNW41B\NDP20-KB917283-X86.msp scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08112008_212950

Files moved on Reboot...
File C:\DOCUME~1\Jeremy\LOCALS~1\Temp\qacjyslc.dat not found!
File C:\DOCUME~1\Jeremy\LOCALS~1\Temp\hsperfdata_Jeremy\3244 not found!
File move failed. C:\WINDOWS\temp\gis7966feb7\32x32_ale.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\32x32_upd.gif scheduled to be moved on reboot.
C:\WINDOWS\temp\gis7966feb7\ci.dll unregistered successfully.
File move failed. C:\WINDOWS\temp\gis7966feb7\ci.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\temp\gis7966feb7\cires_en.dll
C:\WINDOWS\temp\gis7966feb7\cires_en.dll NOT unregistered.
File move failed. C:\WINDOWS\temp\gis7966feb7\cires_en.dll scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\desktop.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\earth.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\empty.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\eula.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdater.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterAdminPrefs.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterInstallMgr.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterService.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\GoogleUpdaterSetup.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\gtfirstboot.exe scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\history.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\installer.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\lm.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\localized_eula.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\maintainer.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\minus.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\msg_error.gif scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\WINDOWS\temp\gis7966feb7\npCIDetect11.dll
C:\WINDOWS\temp\gis7966feb7\npCIDetect11.dll NOT unregistered.
File move failed. C:\WINDOWS\temp\gis7966feb7\npCIDetect11.dll scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\pack.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\pack_large.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\pack_logo.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\picasa.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\plus.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\preferences.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\proxy.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\roundl_g.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\roundr_g.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\shield.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\sort_down.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\sort_up.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\talk.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\toolbar.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\ui.css scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\ui.js scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\ul.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\updates.htm scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\ur.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\waiting.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\gis7966feb7\waiting32.gif scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\IXP000.TMP\BACKUP~1.EXE scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\NDP20-KB917283-X86\NDP20-KB917283-X86-msi.0.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\NDP20-KB917283-X86\NDP20-KB917283-X86-wrapper.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\NDP20-KB922770-X86\NDP20-KB922770-X86-msi.0.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\NDP20-KB922770-X86\NDP20-KB922770-X86-wrapper.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\NDP20-KB928365-v2-X86\NDP20-KB928365-v2-X86-msi.0.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\NDP20-KB928365-v2-X86\NDP20-KB928365-v2-X86-wrapper.log scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000006b\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000098\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000166\tmp00006479 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000268\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000290\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000002dc\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000032f\tmp00000b19 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000032f\tmp00002b9d scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000528\tmp000035c7 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000064f\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000655\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000091b\tmp000008eb scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000a8e\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000a9e\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000bed\tmp00004ef7 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000c2a\tmp000033b0 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000dd3\tmp000111c5 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000edd\tmp0000067c scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00000edd\tmp00004599 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001086\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000012a3\tmp00005e66 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000012a9\tmp00000b18 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000012f7\tmp00002ec7 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000012f7\tmp00002ecd scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000012f7\tmp00003d40 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000137e\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000014ba\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000014be\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000015c9\tmp0000aa84 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000016ec\tmp000003b0 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000018df\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000019a2\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001acf\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001aff\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001c0e\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001c6b\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001ead\tmp00007f56 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00001fb3\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002007\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002055\tmp00000ec9 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002160\tmp000074c2 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000021ec\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000227f\tmp0000a533 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000227f\tmp0000aa3d scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000227f\tmp0000ef8e scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000227f\tmp0000f28b scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000227f\tmp00016ac3 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000023c8\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000248a\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000024c5\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000275d\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002a7e\tmp000000c2 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002a7e\tmp000027ef scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002adf\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002b45\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002c7f\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002d17\tmp000050ab scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002ed4\tmp0000015e scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002ed4\tmp00001820 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002ee3\tmp00006ff2 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00002f55\tmp00002831 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003118\tmp00000bf0 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000031d3\tmp000003d3 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000031d3\tmp00002033 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000321e\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000336a\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000344e\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000352c\tmp00002c6a scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000379f\tmp00000875 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000038ad\tmp00000231 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000038ad\tmp00000d0a scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000038ae\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000038dc\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000039b8\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003a14\tmp00002086 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003a65\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003a74\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003bc0\tmp00005a6d scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003c1d\tmp00003e4c scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003dac\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003dc7\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003e56\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003f3c\tmp00002332 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003f3c\tmp00002333 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00003fb1\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000040fb\tmp00002b96 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000041b9\tmp00004e8d scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000420b\tmp000049bf scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000420b\tmp0001000f scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000042c7\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000452a\tmp00000b25 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000047a2\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000047e7\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004856\tmp00003740 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000048be\tmp0000608d scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000497c\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004c1b\tmp00000624 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004cf8\tmp00006388 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004d46\tmp00000093 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004d5e\tmp000061ba scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004e6e\tmp000013e1 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004e6e\tmp00001a98 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004e88\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004ee4\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004f26\tmp00000082 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004f26\tmp000066ba scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00004f31\tmp00000bf7 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005056\tmp00000046 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005056\tmp00007cec scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005175\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005279\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000052d5\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005439\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005450\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005651\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000056cc\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005731\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005833\tmp00007264 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000583f\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005878\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000059ab\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005afb\tmp00000c28 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005bae\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005bc6\tmp00008c99 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005c86\tmp0000676b scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005ca7\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005cc0\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005d23\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005db1\tmp0000467b scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005f23\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00005f9b\tmp00003568 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000607f\tmp00007866 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00006258\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000626f\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000066b7\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000688b\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000068ea\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00006bf6\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00006c1b\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007264\tmp00001a9f scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007264\tmp00003ced scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000072ec\tmp00000a39 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000753b\tmp00000d48 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp0000765a\tmp000078c8 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007690\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000076c1\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp000078cd\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007ab3\tmp00000929 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007ab3\tmp00000bb8 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007bfc\tmp0000095f scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007bfc\tmp00007a26 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007d68\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007e37\tmp000054a4 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007eb6\tmp00000000 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007f06\tmp0000e1d4 scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\tmp00007f06\tmp0000e2fb scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\ZNW2BA\manifest.ini scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\ZNW2BA\NDP20-KB928365-v2-X86.msp scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\ZNW41B\manifest.ini scheduled to be moved on reboot.
File move failed. C:\WINDOWS\temp\ZNW41B\NDP20-KB917283-X86.msp scheduled to be moved on reboot.

I'll do the combofix thing in a few minutes
  • 0

#6
Rorschach112
Posted 12 August 2008 - 02:23 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Leave ComboFix, do this instead, one of the links will work

We need to create a Deckard's System Scanner (DSS) Log
Please download Deckard's System Scanner (DSS) from one of the links below and save to your Desktop.

Primary Mirror
Secondary Mirror

DSS will do the following:
  • Create a new System Restore point in Windows XP and Vista.
  • Clean your Temporary Files, Downloaded Program Files, Internet Cache Files, and empty the Recycle Bin on all drives.
  • Check some important areas of your system and produce a report for an analyst to review.
  • Automatically run HijackThis. It will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed. So if HijackThis is not installed and DSS prompts you to download it, please answer yes.
Note: You must be logged onto an account with administrator privileges when using Deckard's System Scanner.
  • Close all applications and windows.
  • Double-click on dss.exe to run it and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
  • When the scan is complete, two text files will open in Notepad:
    • main.txt <-- Will be maximized
    • extra.txt <-- Will be minimized
  • If not, they both can be found in the C:\Deckard\System Scanner folder.
  • Please copy (<Control>+C) and paste (<Control>+V) the contents of main.txt and extra.txt in your next reply.
Note: When running DSS, some firewalls may warn that DSS is trying to access the Internet; especially if you are asked to download the most current version of HijackThis. Please ensure that DSS is given permission to access the internet.
Note: If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful.
  • 0

#7
Jeremy144
Posted 12 August 2008 - 03:26 PM

Jeremy144

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
0Deckard's System Scanner v20071014.68
Run by Jeremy on 2008-08-12 16:57:19
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 3 Restore Point(s) --
3: 2008-08-12 20:57:32 UTC - RP1621 - Deckard's System Scanner Restore Point
2: 2008-08-12 18:13:40 UTC - RP1620 - System Checkpoint
1: 2008-08-11 02:54:28 UTC - RP1619 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

System Drive C: has 2.27 GiB (less than 15%) free.


-- HijackThis (run as Jeremy.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:02:46 PM, on 8/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Documents and Settings\Jeremy\iTunes\iTunesHelper.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\FlashGet\flashget.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\mdm.exe
C:\Documents and Settings\Jeremy\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Jeremy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=127.0.0.1:3389;http=127.0.0.1:3389
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {2948324F-2113-4639-A997-D86362849C78} - C:\WINDOWS\system32\AgCPanelFrenc.dll
O2 - BHO: (no name) - {2A8D84E0-A81B-4BB0-B75A-E370AF523776} - C:\WINDOWS\system32\nocbfxeg.dll (file missing)
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8324418D-95DA-4425-94F6-8B2E4390866c} - C:\WINDOWS\system32\nocbfxeg.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {C46BD658-90E1-45B0-A3A3-2403130CF822} - C:\WINDOWS\system32\nocbfxeg.dll (file missing)
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\hmcxaaxp.dll (file missing)
O2 - BHO: (no name) - {DF8B46E1-5FFB-4F2F-8A3A-3563536E2358} - C:\WINDOWS\system32\nocbfxeg.dll (file missing)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O2 - BHO: (no name) - {F994E8E7-7922-4295-9A44-8753A22F467c} - C:\WINDOWS\system32\nocbfxeg.dll (file missing)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - c:\documents and settings\jeremy\desktop\Digital Overlay\msdxm.ocx (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Jeremy\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [AIM] C:\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: MEMonitor.lnk = C:\Documents and Settings\Jeremy\Desktop\V CAST Music Manager\MEMonitor.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\aim\aim.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.co...84/mcinsctl.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zon...O/GAME_UNO1.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1129229081125
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.co...nstallAsst2.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.co...,21/mcgdmgr.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload....GPlugin9USA.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.co.../MathPlayer.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zon...er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopet...v/GoPetsWeb.cab
O20 - Winlogon Notify: wingsa32 - wingsa32.dll (file missing)
O20 - Winlogon Notify: winpsa32 - winpsa32.dll (file missing)
O21 - SSODL: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
O21 - SSODL: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - (no file)
O22 - SharedTaskScheduler: ecosystems - {af3fd9a8-1287-4159-9212-9a5b4494af70} - (no file)
O22 - SharedTaskScheduler: carbinyl - {8d8c2387-7f80-4022-9be6-43630a969558} - (no file)
O22 - SharedTaskScheduler: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j7231130.exe (file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\sqybsllr.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: PinnacleUpdate Service (PinnacleUpdateSvc) - Unknown owner - C:\Program Files\KALiNKOsoft\Pinnacle Game Profiler\pinnacle_updater.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe (file missing)
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 11955 bytes

-- File Associations -----------------------------------------------------------

.bat - batfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-153
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\hh.exe,0
.inf - inffile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151
.ini - inifile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151
.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
.txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,-152


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 Achernar (Achernar - SCSI Command Filters) - c:\windows\system32\drivers\achernar.sys <Not Verified; An Chen Computer Co., Ltd.; Achernar>
R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 Teefer (Teefer for NT) - c:\windows\system32\drivers\teefer.sys <Not Verified; Sygate Technologies, Inc.; Sygate Teefer Driver>
R0 ykofahie - c:\windows\system32\drivers\aliymqbd.dat
R1 OMCI - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver>
R1 wpsdrvnt - c:\windows\system32\drivers\wpsdrvnt.sys <Not Verified; Sygate Technologies, Inc.; wpsdrvnt>
R2 MCSTRM - c:\windows\system32\drivers\mcstrm.sys <Not Verified; RealNetworks, Inc.; RealNetworks Virtual Path Manager® (32-bit)>
R2 SVKP - c:\windows\system32\svkp.sys <Not Verified; AntiCracking; SVKP driver for NT>
R2 XPROTECTOR - c:\windows\system32\drivers\xprotector.sys
R3 Aldebaran (Aldebaran - SCSI Command Filters) - c:\windows\system32\drivers\aldebaran.sys <Not Verified; An Chen Computer Co., Ltd.; Aldebaran>
R3 RadProbe (Radeon Probe Driver) - c:\windows\system32\drivers\radprobe.sys <Not Verified; ; RadProbe>

S2 Ca533av (Dual Mode Video Camera Device) - c:\windows\system32\drivers\ca533av.sys <Not Verified; Digital Camera; Digital Camera Driver>
S3 BDSelfPr - c:\program files\bitdefender\bitdefender 2008\bdselfpr.sys (file missing)
S3 bvrp_pci - c:\windows\system32\drivers\bvrp_pci.sys
S3 catchme - c:\docume~1\jeremy\locals~1\temp\catchme.sys (file missing)
S3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt>
S3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys (file missing)
S3 SDDMI2 - c:\windows\system32\ddmi2.sys (file missing)
S3 TIEHDUSB - c:\windows\system32\drivers\tiehdusb.sys <Not Verified; Texas Instruments Incorporated; Texas Instruments Incorporated Educational Handheld Device>
S3 USBCamera (Dual Mode Still Camera Device) - c:\windows\system32\drivers\bulk533.sys <Not Verified; USB BULK; Platform SDK Sample Code>
S3 xbreader (MaxDrive XBox Driver (xbreader.sys)) - c:\windows\system32\drivers\xbreader.sys <Not Verified; Thesycon GmbH, Germany; Universal USB Device Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Autodesk Licensing Service - "c:\program files\common files\autodesk shared\service\adskscsrv.exe"
R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter

S2 DCSUserProt (DiamondCS Usermode Aspect) -
S2 DNSCacheReader (dns cache reader) - c:\windows\system32\j7231130.exe (file missing)
S2 DomainService - c:\windows\system32\sqybsllr.exe /service (file missing)
S2 PinnacleUpdateSvc (PinnacleUpdate Service) - c:\program files\kalinkosoft\pinnacle game profiler\pinnacle_updater.exe (file missing)
S2 RadClock - c:\windows\system32\radclock.exe <Not Verified; ; RadClock Module>
S2 VSSERV (BitDefender Virus Shield) - "c:\program files\bitdefender\bitdefender 2008\vsserv.exe" /service (file missing)
S3 x10nets (X10 Device Network Service) -


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Simple Communications Controller
Device ID: PCI\VEN_14F1&DEV_2702&SUBSYS_8D881028&REV_01\4&3B1CAF2B&0&28F0
Manufacturer:
Name: PCI Simple Communications Controller
PNP Device ID: PCI\VEN_14F1&DEV_2702&SUBSYS_8D881028&REV_01\4&3B1CAF2B&0&28F0
Service:

Class GUID: {FD02DFAC-6A7C-4391-97DA-F81FEF1FC9D3}
Description: Radeon Probe Driver
Device ID: ROOT\PROBES\0000
Manufacturer: ChrisW
Name: Radeon Probe Driver
PNP Device ID: ROOT\PROBES\0000
Service: RadProbe


-- Scheduled Tasks -------------------------------------------------------------

2008-08-12 13:43:07 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2008-08-12 03:00:00 390 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (GTA-Ben).job
2008-08-08 02:00:00 394 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (GTA-Owner).job
2008-07-19 22:57:00 340 --a------ C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1095659603.job
2006-12-23 04:39:31 396 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (GTA-Jeremy).job


-- Files created between 2008-07-12 and 2008-08-12 -----------------------------

2008-08-11 14:04:53 0 d-------- C:\WINDOWS\ERUNT
2008-08-10 16:05:49 0 d-------- C:\Program Files\Trend Micro
2008-08-05 16:55:15 0 d-------- C:\Program Files\Pistachio Productions
2008-08-01 15:40:22 0 d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-28 15:11:34 0 d-------- C:\Program Files\Common Files\xing shared
2008-07-28 15:11:19 0 d-------- C:\WINDOWS\aod
2008-07-25 04:34:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-07-25 04:34:52 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-07-25 04:34:42 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-07-25 04:34:40 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-07-25 04:34:40 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-07-25 04:34:40 815104 --a------ C:\WINDOWS\system32\divx_xx0a.dll <Not Verified; DivX, Inc.; DivX®>
2008-07-25 04:34:36 683520 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-07-23 12:46:38 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-15 21:00:17 0 d-------- C:\Program Files\LG Electronics
2008-07-15 20:59:18 0 d-------- C:\Documents and Settings\Jeremy\Application Data\Sony Corporation
2008-07-12 15:51:47 0 d-------- C:\Documents and Settings\Owner\Application Data\Sony Corporation


-- Find3M Report ---------------------------------------------------------------

2008-08-12 17:01:45 0 d-------- C:\Program Files\FlashGet
2008-08-11 13:10:06 0 d-------- C:\Program Files\Viewpoint
2008-08-07 14:25:17 0 d-------- C:\Program Files\DivX
2008-08-06 18:30:56 0 d-------- C:\Program Files\Google
2008-07-31 17:31:18 0 d-------- C:\Program Files\Common Files\Adobe
2008-07-31 17:26:03 0 d-------- C:\Documents and Settings\Jeremy\Application Data\AdobeUM
2008-07-28 16:13:27 0 d-------- C:\Documents and Settings\Jeremy\Application Data\Real
2008-07-28 16:07:19 0 d-------- C:\Documents and Settings\Jeremy\Application Data\Adobe
2008-07-28 15:11:34 0 d-a------ C:\Program Files\Common Files
2008-07-28 15:11:30 723 --a------ C:\Program Files\INSTALL.LOG
2008-07-28 15:11:30 0 d-------- C:\Program Files\AOD
2008-07-28 15:11:01 0 d-------- C:\Program Files\Common Files\Real
2008-07-23 17:06:34 0 d-------- C:\Program Files\Microsoft AntiSpyware
2008-07-23 12:50:52 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-07-22 10:08:43 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-22 10:08:41 0 d-------- C:\Program Files\Phoenix Dynasty Online
2008-07-09 03:18:09 0 d-------- C:\Program Files\Microsoft SQL Server
2008-07-04 03:16:24 0 d-------- C:\Program Files\JFK Reloaded
2008-07-03 15:35:51 0 d-------- C:\Program Files\Deer Park Alpha 1
2008-06-23 19:06:43 37036 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-06-22 20:25:18 9414328 --a------ C:\WINDOWS\system32\SNAGIT7
2008-06-20 00:27:31 21818 --a----c- C:\WINDOWS\mozver.dat
2008-06-19 13:48:02 0 d-------- C:\Documents and Settings\Jeremy\Application Data\SPORE Creature Creator
2008-06-19 13:44:27 2030 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-06-17 22:54:18 0 d-------- C:\Program Files\Core Design
2008-06-14 13:28:23 0 d-------- C:\Documents and Settings\Jeremy\Application Data\Aim
2008-05-18 20:52:43 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2948324F-2113-4639-A997-D86362849C78}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A8D84E0-A81B-4BB0-B75A-E370AF523776}]
C:\WINDOWS\system32\nocbfxeg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8324418D-95DA-4425-94F6-8B2E4390866c}]
C:\WINDOWS\system32\nocbfxeg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C46BD658-90E1-45B0-A3A3-2403130CF822}]
C:\WINDOWS\system32\nocbfxeg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1}]
C:\WINDOWS\system32\hmcxaaxp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DF8B46E1-5FFB-4F2F-8A3A-3563536E2358}]
C:\WINDOWS\system32\nocbfxeg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F994E8E7-7922-4295-9A44-8753A22F467c}]
C:\WINDOWS\system32\nocbfxeg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [10/19/2005 08:59 AM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [10/19/2005 08:59 AM]
"ATIPTA"="atiptaxx.exe" [11/30/2004 08:10 PM C:\WINDOWS\system32\atiptaxx.exe]
"AVP"="C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe" [08/23/2007 03:16 PM]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [11/15/2007 10:24 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]
"iTunesHelper"="C:\Documents and Settings\Jeremy\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [11/15/2007 10:23 AM]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [09/25/2007 04:10 AM]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [07/28/2008 03:09 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]
"Steam"="C:\Program Files\Steam\Steam.exe" []
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [11/15/2007 10:23 AM]
"AIM"="C:\aim\aim.exe" [08/01/2006 03:35 PM]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [10/18/2006 10:05 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= C:\WINDOWS\system32\RadExe.dll [02/02/2005 04:58 AM 212992]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingsa32]
wingsa32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32]
winpsa32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LimeWire 4.0.8.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PalStart.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalStart.lnk
backup=C:\WINDOWS\pss\PalStart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMStart.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SMStart.lnk
backup=C:\WINDOWS\pss\SMStart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jeremy^Start Menu^Programs^Startup^Adobe Gamma.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jeremy^Start Menu^Programs^Startup^Registration Brothers In Arms EiB Demo.LNK]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jeremy^Start Menu^Programs^Startup^Shortcut to 360Tracker.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jeremy^Start Menu^Programs^Startup^SpywareGuard.lnk]
path=C:\Documents and Settings\Jeremy\Start Menu\Programs\Startup\SpywareGuard.lnk
backup=C:\WINDOWS\pss\SpywareGuard.lnkStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
"C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect]
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
"C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDSwitchAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BySoft StayAlive Pro]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
"C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeadAIM]
rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files\Google\Google Talk\googletalk.exe /autostart

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"C:\Program Files\HP\HP Software Update\HPWuSchd.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPPDetect]
IPP4Detect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Documents and Settings\Jeremy\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\DOCUME~1\Ben\MYDOCU~1\MUSICM~2\mimboot.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]
C:\Program Files\McAfee.com\VSO\oasclnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pwdir]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\secure]
C:\WINDOWS\system32\Hwmdbz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smart Start UP]
C:\Program Files\NewSoft\Smart Start UP\PnPDetect.exe /Automation

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmcService]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StarSkin]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
C:\Program Files\McAfee.com\VSO\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
"C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx scan




-- End of Deckard's System Scanner: finished at 2008-08-12 17:23:03 ------------












Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.20GHz
Percentage of Memory in Use: 45%
Physical Memory (total/avail): 1022 MiB / 557.77 MiB
Pagefile Memory (total/avail): 1692.27 MiB / 1271.56 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1935.16 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 74.5 GiB total, 2.33 GiB free.
D: is CDROM (No Media)
E: is CDROM (No Media)
F: is CDROM (No Media)
G: is Removable (No Media)
H: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - WDC WD800BB-75CAA0 - 74.5 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 74.5 GiB - C:

\\.\PHYSICALDRIVE1 - HP USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FW: Bitdefender Firewall v8.0 (BitDefender)
AV: Bitdefender Antivirus v8.0 (BitDefender)
AV: The Shield Deluxe 2008 v6.0.2.621 ()

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe"="C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\aim\\aim.exe"="C:\\aim\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Valve\\Steam\\Steam.exe"="C:\\Program Files\\Valve\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Call of Duty\\CoDMP.exe"="C:\\Program Files\\Call of Duty\\CoDMP.exe:*:Enabled:CoDMP"
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\\Documents and Settings\\Jeremy\\Desktop\\Enemy Territory\\ET.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\Enemy Territory\\ET.exe:*:Enabled:ET"
"C:\\Documents and Settings\\Jeremy\\Desktop\\mIRC\\mirc.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\graal2001\\Graal3.exe"="C:\\graal2001\\Graal3.exe:*:Enabled:Graal3"
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\BitTorrent\\btdownloadgui.exe"="C:\\Program Files\\BitTorrent\\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\\Program Files\\LimeWire\\LimeWire 4.0.8\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire 4.0.8\\LimeWire.exe:*:Enabled:LimeWire: The most advanced file sharing program on the planet."
"C:\\Program Files\\Microsoft Games\\Halo\\halo.exe"="C:\\Program Files\\Microsoft Games\\Halo\\halo.exe:*:Enabled:Halo"
"C:\\Program Files\\softnyx\\GunBound\\GunBound.exe"="C:\\Program Files\\softnyx\\GunBound\\GunBound.exe:*:Enabled:GunBound Startup Application"
"C:\\Program Files\\softnyx\\GunBound\\GunBound.gme"="C:\\Program Files\\softnyx\\GunBound\\GunBound.gme:*:Enabled:GunBound"
"C:\\Documents and Settings\\Jeremy\\Local Settings\\Temp\\Rar$EX00.437\\ListServer_Log_Hack.exe"="C:\\Documents and Settings\\Jeremy\\Local Settings\\Temp\\Rar$EX00.437\\ListServer_Log_Hack.exe:*:Disabled:ListServer"
"C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\survivalproject.exe"="C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\survivalproject.exe:*:Enabled:survivalproject"
"C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\sp.exe"="C:\\Documents and Settings\\Ben\\My Documents\\egames\\Survival Project\\sp.exe:*:Enabled:sp"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\NowWAP\\wap3gxs.exe"="C:\\Program Files\\NowWAP\\wap3gxs.exe:*:Enabled:wap3gxs"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Rockstar Games\\Grand Theft Auto\\WINO\\Grand Theft Auto.exe"="C:\\Program Files\\Rockstar Games\\Grand Theft Auto\\WINO\\Grand Theft Auto.exe:*:Enabled:Grand Theft Auto"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\dedicated server\\hlds.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\dedicated server\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\day of defeat\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\team fortress classic\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\team fortress classic\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\UPDATE.EXE"="C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\UPDATE.EXE:*:Enabled:UPDATE"
"C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\DFBHD.EXE"="C:\\Program Files\\NovaLogic\\Delta Force Black Hawk Down\\DFBHD.EXE:*:Enabled:DFBHD"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows® NetMeeting®"
"C:\\UT2003Demo\\System\\UT2003.exe"="C:\\UT2003Demo\\System\\UT2003.exe:*:Enabled:UT2003"
"C:\\Program Files\\GameSpy Arcade\\Services\\gspoker\\Poker-GS.exe"="C:\\Program Files\\GameSpy Arcade\\Services\\gspoker\\Poker-GS.exe:*:Enabled:GameSpy Poker by Jeff Anderson"
"C:\\Program Files\\GameSpy Arcade\\Services\\gsyarn\\YARN-GS.exe"="C:\\Program Files\\GameSpy Arcade\\Services\\gsyarn\\YARN-GS.exe:*:Enabled:GameSpy YARN - The multiplayer network story game! By Jeff Anderson"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2\\hl2.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\condition zero\\hl.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2 deathmatch\\hl2.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike source\\hl2.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\source dedicated server\\srcds.exe"="C:\\Program Files\\Valve\\Steam\\SteamApps\\[email protected]\\source dedicated server\\srcds.exe:*:Enabled:srcds"
"C:\\UT2004Demo\\System\\UT2004.exe"="C:\\UT2004Demo\\System\\UT2004.exe:*:Enabled:UT2004"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\DAP\\DAP.exe"="C:\\Program Files\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus"
"C:\\Program Files\\EA GAMES\\Battlefield 1942 Multiplayer Demo\\BF1942Demo.exe"="C:\\Program Files\\EA GAMES\\Battlefield 1942 Multiplayer Demo\\BF1942Demo.exe:*:Enabled:BF1942Demo"
"C:\\Documents and Settings\\Jeremy\\Desktop\\Flashget Downloads\\GraalControl\\Graal Control Server.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\Flashget Downloads\\GraalControl\\Graal Control Server.exe:*:Enabled:Graal Control Server"
"C:\\Documents and Settings\\Ben\\My Documents\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Ben\\My Documents\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Jeremy\\Desktop\\LimeWire\\LimeWire.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Jeremy\\Desktop\\BLOCKLAND\\blockland0002\\blockLand.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\BLOCKLAND\\blockland0002\\blockLand.exe:*:Enabled:blockLand"
"C:\\graal2001\\Graal.exe"="C:\\graal2001\\Graal.exe:*:Enabled:RPG online game"
"C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\SmartFTP\\SmartFTP.exe"="C:\\Program Files\\SmartFTP\\SmartFTP.exe:*:Enabled:SmartFTP Client"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1148619574\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services"
"C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe"="C:\\Documents and Settings\\Ben\\My Documents\\AIM\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Documents and Settings\\Jeremy\\Desktop\\BitLord\\BitLord.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\BitLord\\BitLord.exe:*:Enabled:BitLord"
"C:\\Documents and Settings\\Jeremy\\Desktop\\superscan4\\SuperScan4.exe"="C:\\Documents and Settings\\Jeremy\\Desktop\\superscan4\\SuperScan4.exe:*:Enabled:SuperScan 4 Beta 1"
"C:\\Program Files\\Xfire\\Xfire.exe"="C:\\Program Files\\Xfire\\Xfire.exe:*:Enabled:Xfire"
"C:\\Documents and Settings\\Jeremy\\Desktop\\roboclient\\robosrv.exe"="C:\&
  • 0

#8
Rorschach112
Posted 13 August 2008 - 02:11 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Hello

You have two firewalls and two anti-virus programs, you need to remove one from each


Windows Internal Firewall is enabled.

FW: Bitdefender Firewall v8.0 (BitDefender)
AV: Bitdefender Antivirus v8.0 (BitDefender)
AV: The Shield Deluxe 2008 v6.0.2.621 ()




Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
  • 0

#9
Rorschach112
Posted 17 August 2008 - 05:14 PM

Rorschach112

    Ralphie

  • Retired Staff
  • 47,710 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP