Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

I'm having trouble with the vundo.dll virus

Started by duckyfriends , Nov 02 2008 06:26 AM

Please log in to reply

#1
duckyfriends

Posted 02 November 2008 - 06:26 AM

New Member

Member
6 posts

I am having trouble removing the vundo.dll virus and my friend told me about this site and how helpful it is. I'm currently using windows xp. I am going to post my hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:23:55 AM, on 11/2/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B548CB2-4968-4814-B155-69CEDBE009AE} - C:\WINDOWS\System32\khfFWQKD.dll (file missing)
O2 - BHO: (no name) - {A30B575B-0E87-446B-BB58-DD22D0F61DE0} - C:\WINDOWS\system32\khfFxXpo.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BB604754-D031-4D2E-AB6C-BF3D367F6944} - C:\Documents and Settings\Owner\Application Data\redir.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: khfFxXpo - C:\WINDOWS\SYSTEM32\khfFxXpo.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 6027 bytes

#2
kahdah

Posted 02 November 2008 - 08:25 AM

GeekU Teacher

Retired Staff
15,822 posts

Hello duckyfriends

Welcome to G2Go.

=====================

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

#3
duckyfriends

Posted 02 November 2008 - 05:18 PM

New Member

Topic Starter
Member
6 posts

Thank you for starting the process in helping me. Here are the logs you requested.

log.txt:

Logfile of random's system information tool 1.04 (written by random/random)
Run by Administrator at 2008-11-02 18:17:01
Microsoft Windows XP Home Edition Service Pack 1
System drive C: has 79 GB (72%) free of 110 GB
Total RAM: 503 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:17:15 PM, on 11/2/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator.LIZZY\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B548CB2-4968-4814-B155-69CEDBE009AE} - C:\WINDOWS\System32\khfFWQKD.dll (file missing)
O2 - BHO: (no name) - {A30B575B-0E87-446B-BB58-DD22D0F61DE0} - C:\WINDOWS\system32\khfFxXpo.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BB604754-D031-4D2E-AB6C-BF3D367F6944} - C:\Documents and Settings\Owner\Application Data\redir.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: khfFxXpo - C:\WINDOWS\SYSTEM32\khfFxXpo.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 5748 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO - C:\Program Files\Yahoo!\Common\ycomp5 []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B548CB2-4968-4814-B155-69CEDBE009AE}]
C:\WINDOWS\System32\khfFWQKD.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A30B575B-0E87-446B-BB58-DD22D0F61DE0}]
C:\WINDOWS\system32\khfFxXpo.dll [2008-06-10 29824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2008-06-01 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB604754-D031-4D2E-AB6C-BF3D367F6944}]
C:\Documents and Settings\Owner\Application Data\redir.dll [2008-06-10 27648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - &Radio - C:\WINDOWS\System32\msdxm.ocx [2002-08-29 842268]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - C:\Program Files\Yahoo!\Common\ycomp5 []
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2008-06-01 2403392]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2003-03-11 114688]
"KBD"=C:\HP\KBD\KBD.EXE [2003-02-11 61440]
"StorageGuard"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-02-13 155648]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2003-04-10 151597]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-13 212992]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2003-04-03 50176]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2002-08-29 145408]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Spybot - Search & Destroy"=C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-30 4891984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe [2002-07-31 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe [2004-11-02 218240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.LIZZY^Start Menu^Programs^Startup^mod_sm.lnk]
C:\hp\bin\cloaker.exe [1999-11-07 27136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
C:\PROGRA~1\Quicken\bagent.exe [2002-09-20 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-03-11 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfFxXpo]
C:\WINDOWS\system32\khfFxXpo.dll [2008-06-10 29824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]
C:\Program Files\Softex\OmniPass\opxpgina.dll [2003-02-21 40960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{A30B575B-0E87-446B-BB58-DD22D0F61DE0}"=C:\WINDOWS\system32\khfFxXpo.dll [2008-06-10 29824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\System32\khfFWQKD

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
shell\AutoRun\command - E:\SETUP.EXE

======List of files/folders created in the last 1 months======

2008-11-02 18:17:01 ----D---- C:\rsit
2008-11-02 07:36:23 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Mozilla
2008-11-02 07:36:14 ----D---- C:\Program Files\Mozilla Firefox
2008-11-02 07:23:37 ----D---- C:\Program Files\Trend Micro
2008-11-02 07:23:29 ----A---- C:\Program Files\HJTInstall.exe
2008-11-01 22:18:38 ----D---- C:\Program Files\HijackThis
2008-11-01 20:53:33 ----A---- C:\Program Files\spybotsd160.exe
2008-11-01 20:32:55 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Sun
2008-11-01 20:31:49 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Macromedia
2008-11-01 20:30:07 ----ASH---- C:\Documents and Settings\Administrator.LIZZY\Application Data\desktop.ini
2008-11-01 20:30:04 ----SD---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Microsoft
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Symantec
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Sonic
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\SampleView
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Real
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\InterTrust
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\interMute
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Identities
2008-11-01 20:30:04 ----D---- C:\Documents and Settings\Administrator.LIZZY\Application Data\Adobe

======List of files/folders modified in the last 1 months======

2008-11-02 07:39:56 ----RASH---- C:\boot.ini
2008-11-02 07:39:56 ----A---- C:\WINDOWS\win.ini
2008-11-02 07:39:56 ----A---- C:\WINDOWS\system.ini
2008-11-02 07:39:54 ----D---- C:\WINDOWS\pss
2008-11-02 07:36:14 ----RD---- C:\Program Files
2008-11-01 22:18:54 ----SHD---- C:\RECYCLER
2008-11-01 22:11:01 ----D---- C:\WINDOWS
2008-11-01 22:10:59 ----D---- C:\WINDOWS\system32
2008-11-01 20:58:59 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-01 20:58:16 ----D---- C:\WINDOWS\Temp
2008-11-01 20:58:06 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-01 20:34:01 ----D---- C:\WINDOWS\System32\drivers
2008-11-01 20:34:01 ----D---- C:\Program Files\Internet Explorer
2008-11-01 20:30:03 ----D---- C:\Documents and Settings
2008-11-01 20:29:41 ----AC---- C:\WINDOWS\ntbtlog.txt
2008-11-01 20:28:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-01 20:26:03 ----D---- C:\WINDOWS\Prefetch
2008-11-01 20:25:01 ----SHD---- C:\WINDOWS\Installer
2008-11-01 20:24:59 ----SHD---- C:\Config.Msi
2008-11-01 20:24:58 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-11-01 20:24:40 ----SD---- C:\WINDOWS\Tasks
2008-11-01 20:24:20 ----D---- C:\Program Files\Norton AntiVirus
2008-11-01 20:24:20 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-11-01 20:24:18 ----D---- C:\WINDOWS\Help
2008-11-01 20:23:30 ----D---- C:\Program Files\Symantec
2008-11-01 20:21:41 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-01 20:20:10 ----D---- C:\Program Files\AWS
2008-11-01 19:41:35 ----A---- C:\WINDOWS\System32\PerfStringBackup.INI
2008-11-01 19:39:33 ----D---- C:\WINDOWS\System32\CatRoot2
2008-11-01 19:37:25 ----D---- C:\WINDOWS\Debug

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MxlW2k;MxlW2k; C:\WINDOWS\System32\drivers\MxlW2k.sys [2003-04-10 28276]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-10-01 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2002-07-29 23808]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2001-08-17 23070]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2002-08-29 19328]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2002-08-29 19328]
S1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2002-08-29 32512]
S2 MCSTRM;MCSTRM; C:\WINDOWS\System32\drivers\MCSTRM.sys [2006-03-18 8413]
S2 mrtRate;mrtRate; C:\WINDOWS\System32\drivers\mrtRate.sys []
S2 tmcomm;tmcomm; \??\C:\WINDOWS\System32\drivers\tmcomm.sys []
S3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-14 112288]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-14 78496]
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-04-07 719244]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2002-08-29 57344]
S3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2003-03-14 90395]
S3 ltmodem5;Lucent Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2003-03-08 624369]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2002-08-29 57984]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-03-03 1248794]
S3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2003-03-14 166528]
S3 SiS315;SiS315; C:\WINDOWS\System32\DRIVERS\sisgrp.sys [2003-02-26 260736]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2002-08-29 28160]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2002-08-29 15744]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2002-08-29 24960]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2002-08-29 4736]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-08-29 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2003-03-03 65536]
S2 omniserv;Softex OmniPass Service; C:\Program Files\Softex\OmniPass\Omniserv.exe [2003-02-21 68704]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2002-08-29 250368]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-01 138168]

-----------------EOF-----------------

info.txt:

info.txt logfile of random's system information tool 1.04 2008-11-02 18:17:17

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\System32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature
-->c:\WINDOWS\System32\\MSIEXEC.EXE /x {8214CC02-6271-4DC8-B8DD-779933450264}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 5.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player ActiveX-->C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe
Adobe Shockwave Player-->C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Blackhawk Striker from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\33A16A26-1533-4016-AE2D-89D6398D7EB2\Uninstall.exe"
Blasterball 2 from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\350CC34B-2B8E-4EE5-AE4D-F04FDF37DC39\Uninstall.exe"
BlasterBall Wild from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\31403AA7-7357-43E1-9B46-4B45847C37D5\Uninstall.exe"
Compaq Connections-->C:\WINDOWS\BWUnin-6.2.3.66L.exe -AppId 1940576
Dark Orbit from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\865917D2-33F4-4223-BDCD-C7DA958C216C\Uninstall.exe"
Disney`s Lilo and Stitch Pinball from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\67D9A48A-81E9-4863-8B55-744BAEA180E2\Uninstall.exe"
easy Internet sign-up-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{0613467F-A45E-4CB1-9ECE-1F3DD79FB927} /l1033
Excavation from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\9A8CE71F-71D5-4555-B355-85481DC99B80\Uninstall.exe"
GemMaster 3 from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\AD0E57E8-ABB1-4BF6-9AFF-0C7DDA1710CD\Uninstall.exe"
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
HP Deskjet printer preloaded drivers-->MsiExec.exe /X{48BD24F5-13DE-493A-A7CE-28A85113FF0C}
Instant Support-->C:\PROGRA~1\INSTAN~1\UNWISE.EXE C:\PROGRA~1\INSTAN~1\INSTALL.LOG
Intel® Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
IntelliMover Data Transfer Demo-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{14589F05-C658-4594-9429-D437BA688686}\Setup.exe" -l0x9
InterVideo WinDVD Player-->"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
Java™ 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
KBD-->C:\HP\KBD\KBD.EXE uninstalled
LiveReg (Symantec Corporation)-->C:\Program Files\Common Files\Symantec Shared\LiveReg\VcSetup.exe /REMOVE
Men In Black II CROSSFIRE from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\2B4B4104-7AC7-4950-8BF2-6BB5E3E61CA7\Uninstall.exe"
Microsoft .NET Framework (English) v1.0.3705-->C:\WINDOWS\Microsoft.NET\Framework\Install.exe /u /p Microsoft .NET Framework Full v1.0.3705 (1033)
Microsoft Money 2003 System Pack-->MsiExec.exe /I{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}
Microsoft Money 2003-->MsiExec.exe /I{01F9D88C-3C86-4E82-840A-101A3221F67A}
Microsoft Works 7.0-->MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MUSICMATCH® Jukebox-->C:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.exe
NVIDIA Windows 2000/XP Display Drivers-->rundll32.exe C:\WINDOWS\System32\nvinstnt.dll,NvUninstallNT4 nvhp.inf
OmniPass-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}\Setup.exe" -l0x9
PartyCasino-->"C:\Program Files\PartyGaming\PartyCasino\Uninstall.exe" "C:\Program Files\PartyGaming\PartyCasino\install.log"
PartyPoker-->"C:\Program Files\PartyGaming\PartyPoker\Uninstall.exe" "C:\Program Files\PartyGaming\PartyPoker\install.log"
PS2-->C:\WINDOWS\system32\ps2.exe uninstall
Python 2.2 combined Win32 extensions-->C:\Python22\Lib\SITE-P~1\UNWISE~1.EXE C:\Python22\Lib\SITE-P~1\w32inst.log
Python 2.2.1-->C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
Quicken 2003 New User Edition-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{F61F2821-694C-475F-99AB-6AF2EFDF40FD} anything
RealOne Player-->C:\Program Files\Common Files\Real\Update_OB\rnuninst.exe RealNetworks|RealPlayer|6.0
RecordNow-->MsiExec.exe /I{8214CC02-6271-4DC8-B8DD-779933450264}
RingMaster from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\c058d3ba-df2a-493d-9a60-9f725cc6502c\Uninstall.exe"
S3Display-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Display'
S3Gamma2-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Gamma2'
S3Info2-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Info2'
S3Overlay-->s3uninst.exe -reg 5 'HKLM\Software\S3\S3Uninst\S3Overlay'
ShowBiz DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{60E80B13-8649-4A69-85E2-1AE99E061F43}\setup.exe" -l0x9
Simple Installer - Multilanguage Version-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EEF397AC-DAEF-4C04-90A9-5B2BD31875DC}\setup.exe"
Snowboard Extreme from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\80E21EE8-007B-4C28-ADB2-5110B4401E2E\Uninstall.exe"
Sonic Update Manager-->MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3}
Space Rocks from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\27565B66-EC6D-48A9-A1C3-8886A849995F\Uninstall.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Virtual Warfare from Compaq (remove only)-->"C:\Program Files\WildTangent\Apps\GameChannel\Games\EEDAA297-DFDF-436A-B977-D95EA63C907D\Uninstall.exe"
Weblink-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4FCC384C-18EA-4E25-9281-A06AE006D219}\setup.exe" -l0x9
Windows XP Hotfix (SP2) [See q329256 for more information]-->C:\WINDOWS\$NtUninstallq329256$\spuninst\spuninst.exe
Windows XP Hotfix (SP2) Q327979-->C:\WINDOWS\$NtUninstallQ327979$\spuninst\spuninst.exe
Windows XP Hotfix (SP2) Q329909-->C:\WINDOWS\$NtUninstallQ329909$\spuninst\spuninst.exe
Windows XP Hotfix (SP2) Q331958-->C:\WINDOWS\$NtUninstallQ331958$\spuninst\spuninst.exe
Windows XP Hotfix (SP2) Q811789-->C:\WINDOWS\$NtUninstallQ811789$\spuninst\spuninst.exe
Yahoo! Companion-->regsvr32 /s /u C:\PROGRA~1\Yahoo!\Common\YCOMP5~1.DLL

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Python22
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"PCToolsDir"=C:\Documents and Settings\All Users\Start Menu\Programs\Compaq\Compaq Presario PC Tools
"SAFEBOOT_OPTION"=NETWORK

-----------------EOF-----------------

should I be doing all of these things in safemode? or using windows recovery console?

#4
kahdah

Posted 02 November 2008 - 07:46 PM

GeekU Teacher

Retired Staff
15,822 posts

Nope normal mode for all of this.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.
==============
AFter that post a new Rsit log please.

#5
duckyfriends

Posted 03 November 2008 - 12:41 PM

New Member

Topic Starter
Member
6 posts

Thank you again,

Here is the mbam log:

Malwarebytes' Anti-Malware 1.30
Database version: 1358
Windows 5.1.2600 Service Pack 1

11/3/2008 12:58:35 PM
mbam-log-2008-11-03 (12-58-23).txt

Scan type: Quick Scan
Objects scanned: 84071
Time elapsed: 16 minute(s), 3 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 14
Registry Values Infected: 2
Registry Data Items Infected: 10
Folders Infected: 2
Files Infected: 40

Memory Processes Infected:
C:\Documents and Settings\Owner\Application Data\spyguarder.exe (Rogue.Installer) -> No action taken.

Memory Modules Infected:
C:\WINDOWS\system32\khfFxXpo.dll (Trojan.Vundo.H) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a30b575b-0e87-446b-bb58-dd22d0f61de0} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khffxxpo (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a30b575b-0e87-446b-bb58-dd22d0f61de0} (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bb604754-d031-4d2e-ab6c-bf3d367f6944} (Trojan.BHO.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{bb604754-d031-4d2e-ab6c-bf3d367f6944} (Trojan.BHO.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\rtsplgob.bwpo (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\rtsplgob.toolbar.1 (Trojan.FakeAlert) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{a30b575b-0e87-446b-bb58-dd22d0f61de0} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spyguarder (Rogue.Installer) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (h:mm:ss tt) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\Program Files\dynamic toolbar (Adware.2020search) -> No action taken.
C:\Documents and Settings\Owner\Application Data\SpyGuarder (Rogue.SpyGuarder) -> No action taken.

Files Infected:
C:\WINDOWS\system32\khfFxXpo.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\ydfdmlkv.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\vklmdfdy.ini (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\Owner\Application Data\redir.dll (Trojan.BHO.H) -> No action taken.
C:\Documents and Settings\Owner\Application Data\spyguarder.exe (Rogue.Installer) -> No action taken.
C:\WINDOWS\eslf.exe (Trojan.FakeAlert) -> No action taken.
C:\RECYCLER\NPROTECT\00145667.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145668.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145670.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145672.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145673.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145674.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145675.SCR (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145676.dll (Adware.MyWeb.FunWeb) -> No action taken.
C:\RECYCLER\NPROTECT\00145677.DLL (Adware.MyWeb.FunWeb) -> No action taken.
C:\RECYCLER\NPROTECT\00145678.EXE (Adware.MyWeb.FunWeb) -> No action taken.
C:\RECYCLER\NPROTECT\00145679.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145680.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145683.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145687.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145688.EXE (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145692.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145694.DLL (Adware.MyWebSearch) -> No action taken.
C:\RECYCLER\NPROTECT\00145695.EXE (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\srvprint.exe (Trojan.Small) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IJ23MN6P\upd105320[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\Q9SBCVWF\kb456456[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Owner\Application Data\SpyGuarder\base.dat (Rogue.SpyGuarder) -> No action taken.
C:\Documents and Settings\Owner\Application Data\SpyGuarder\base2.dat (Rogue.SpyGuarder) -> No action taken.
C:\Documents and Settings\Owner\Application Data\SpyGuarder\Desc.dat (Rogue.SpyGuarder) -> No action taken.
C:\Documents and Settings\Owner\Application Data\SpyGuarder\spline.dat (Rogue.SpyGuarder) -> No action taken.
C:\Documents and Settings\Owner\Application Data\SpyGuarder\SpyGuarder.ini (Rogue.SpyGuarder) -> No action taken.
C:\WINDOWS\system32\geBuUnmK.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wvUlJDur.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BM935feef2.xml (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BM935feef2.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\pebgkxwq.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\winpole32.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Owner\Desktop\Privacy Protector.url (Rogue.Link) -> No action taken.

and here is the new rsit log:

Logfile of random's system information tool 1.04 (written by random/random)
Run by Owner at 2008-11-03 13:40:52
Microsoft Windows XP Home Edition Service Pack 1
System drive C: has 79 GB (72%) free of 110 GB
Total RAM: 503 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:41:10 PM, on 11/3/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B548CB2-4968-4814-B155-69CEDBE009AE} - C:\WINDOWS\System32\khfFWQKD.dll (file missing)
O2 - BHO: (no name) - {A30B575B-0E87-446B-BB58-DD22D0F61DE0} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 5288 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO - C:\Program Files\Yahoo!\Common\ycomp5 []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B548CB2-4968-4814-B155-69CEDBE009AE}]
C:\WINDOWS\System32\khfFWQKD.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A30B575B-0E87-446B-BB58-DD22D0F61DE0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - &Radio - C:\WINDOWS\System32\msdxm.ocx [2002-08-29 842268]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - C:\Program Files\Yahoo!\Common\ycomp5 []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2003-03-11 114688]
"KBD"=C:\HP\KBD\KBD.EXE [2003-02-11 61440]
"StorageGuard"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-02-13 155648]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2003-04-10 151597]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-13 212992]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2003-04-03 50176]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2002-08-21 1511453]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe [2002-07-31 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe [2004-11-02 218240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.LIZZY^Start Menu^Programs^Startup^mod_sm.lnk]
C:\hp\bin\cloaker.exe [1999-11-07 27136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
C:\PROGRA~1\Quicken\bagent.exe [2002-09-20 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2003-03-11 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]
C:\Program Files\Softex\OmniPass\opxpgina.dll [2003-02-21 40960]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\System32\khfFWQKD

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
"NoDispCPL"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoStartMenuMorePrograms"=0
"NoSetFolders"=0
"StartMenuLogOff"=0
"NoDrives"=0
"NoToolbarCustomize"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cca1fd2a-0a7b-11dd-89dc-806d6172696f}]
shell\AutoRun\command - D:\Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cca1fd2c-0a7b-11dd-89dc-806d6172696f}]
shell\AutoRun\command - E:\SETUP.EXE

======List of files/folders created in the last 1 months======

2008-11-03 13:40:39 ----A---- C:\RSIT.exe
2008-11-03 13:34:57 ----A---- C:\install_flash_player.exe
2008-11-03 07:42:06 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-11-03 07:41:57 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-03 07:41:57 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-03 07:36:39 ----D---- C:\Documents and Settings\Owner\Application Data\Mozilla
2008-11-02 18:17:01 ----D---- C:\rsit
2008-11-02 07:36:14 ----D---- C:\Program Files\Mozilla Firefox
2008-11-02 07:23:37 ----D---- C:\Program Files\Trend Micro
2008-11-02 07:23:29 ----A---- C:\Program Files\HJTInstall.exe
2008-11-01 22:18:38 ----D---- C:\Program Files\HijackThis
2008-11-01 20:53:33 ----A---- C:\Program Files\spybotsd160.exe

======List of files/folders modified in the last 1 months======

2008-11-03 13:41:01 ----D---- C:\WINDOWS\Prefetch
2008-11-03 13:29:33 ----D---- C:\WINDOWS\Temp
2008-11-03 13:29:23 ----D---- C:\WINDOWS\Debug
2008-11-03 13:28:38 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-03 13:28:10 ----RASH---- C:\boot.ini
2008-11-03 13:28:10 ----A---- C:\WINDOWS\win.ini
2008-11-03 13:28:10 ----A---- C:\WINDOWS\system.ini
2008-11-03 13:26:56 ----D---- C:\WINDOWS\System32\CatRoot2
2008-11-03 13:08:18 ----RD---- C:\Program Files
2008-11-03 13:00:50 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-11-03 13:00:21 ----D---- C:\WINDOWS\System32\drivers
2008-11-03 13:00:21 ----D---- C:\WINDOWS\system32
2008-11-03 12:59:06 ----D---- C:\WINDOWS
2008-11-03 07:35:39 ----A---- C:\WINDOWS\System32\PerfStringBackup.INI
2008-11-03 07:33:18 ----SHD---- C:\WINDOWS\Installer
2008-11-03 07:33:18 ----D---- C:\Program Files\Easy Internet signup
2008-11-03 07:33:12 ----SHD---- C:\Config.Msi
2008-11-03 07:32:19 ----D---- C:\Program Files\Google
2008-11-03 07:32:19 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2008-11-03 07:27:02 ----AC---- C:\WINDOWS\ntbtlog.txt
2008-11-02 07:39:54 ----D---- C:\WINDOWS\pss
2008-11-01 22:18:54 ----SHD---- C:\RECYCLER
2008-11-01 20:58:59 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-01 20:58:06 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-01 20:34:01 ----D---- C:\Program Files\Internet Explorer
2008-11-01 20:30:03 ----D---- C:\Documents and Settings
2008-11-01 20:25:42 ----D---- C:\Documents and Settings\Owner\Application Data\interMute
2008-11-01 20:24:40 ----SD---- C:\WINDOWS\Tasks
2008-11-01 20:24:20 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-11-01 20:24:18 ----D---- C:\WINDOWS\Help
2008-11-01 20:23:30 ----D---- C:\Program Files\Symantec
2008-11-01 20:21:41 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-01 20:20:10 ----D---- C:\Program Files\AWS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MCSTRM;MCSTRM; C:\WINDOWS\System32\drivers\MCSTRM.sys [2006-03-18 8413]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\System32\drivers\tmcomm.sys []
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-14 112288]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-14 78496]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-04-07 719244]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2002-08-29 57344]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2003-03-14 90395]
R3 ltmodem5;Lucent Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2003-03-08 624369]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 MxlW2k;MxlW2k; C:\WINDOWS\System32\drivers\MxlW2k.sys [2003-04-10 28276]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2002-08-29 57984]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-10-01 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2002-07-29 23808]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2001-08-17 23070]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2002-08-29 19328]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2002-08-29 51968]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2002-08-29 19328]
S1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2002-08-29 32512]
S2 mrtRate;mrtRate; C:\WINDOWS\System32\drivers\mrtRate.sys []
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-03-03 1248794]
S3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2003-03-14 166528]
S3 SiS315;SiS315; C:\WINDOWS\System32\DRIVERS\sisgrp.sys [2003-02-26 260736]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2002-08-29 28160]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2002-08-29 15744]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2002-08-29 24960]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2002-08-29 4736]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-08-29 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 omniserv;Softex OmniPass Service; C:\Program Files\Softex\OmniPass\Omniserv.exe [2003-02-21 68704]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2003-03-03 65536]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2002-08-29 250368]

-----------------EOF-----------------

thank you again kahdah

yours,

duckyfriends

#6
kahdah

Posted 04 November 2008 - 04:24 AM

GeekU Teacher

Retired Staff
15,822 posts

You are welcome

==============
All of the files found by MalwareBytes have this behind them > No action taken that means it found some threats but they were nit removed so.
Please re-run Malwarebytes again and make sure to choose Remove Selected after that scan is over then post that log please.

#7
duckyfriends

Posted 04 November 2008 - 02:54 PM

New Member

Topic Starter
Member
6 posts

Hello Kahdah,

I ran maywarebytes again and this is the log file it gave me:

Malwarebytes' Anti-Malware 1.30
Database version: 1358
Windows 5.1.2600 Service Pack 2

11/4/2008 3:51:18 PM
mbam-log-2008-11-04 (15-51-18).txt

Scan type: Quick Scan
Objects scanned: 85053
Time elapsed: 33 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I did the quick scan as you instructed the first time.

Yours,

Duckyfriends

#8
kahdah

Posted 04 November 2008 - 10:01 PM

GeekU Teacher

Retired Staff
15,822 posts

Great can you post a new Rsit log?

#9
duckyfriends

Posted 05 November 2008 - 03:58 PM

New Member

Topic Starter
Member
6 posts

Hello,

here is the new rsit log:

Logfile of random's system information tool 1.04 (written by random/random)
Run by Owner at 2008-11-05 16:56:36
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 79 GB (72%) free of 110 GB
Total RAM: 503 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:56:52 PM, on 11/5/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\rsit\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B548CB2-4968-4814-B155-69CEDBE009AE} - C:\WINDOWS\System32\khfFWQKD.dll (file missing)
O2 - BHO: (no name) - {A30B575B-0E87-446B-BB58-DD22D0F61DE0} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1225738257875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1225738692546
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 6253 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-11-03 455960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B548CB2-4968-4814-B155-69CEDBE009AE}]
C:\WINDOWS\System32\khfFWQKD.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A30B575B-0E87-446B-BB58-DD22D0F61DE0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2004-08-20 118784]
"KBD"=C:\HP\KBD\KBD.EXE [2003-02-11 61440]
"StorageGuard"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-02-13 155648]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2003-04-10 151597]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-13 212992]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344]
"IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2004-08-20 155648]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-03 1234712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\MSMSGS.EXE [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe [2002-07-31 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe [2004-11-02 218240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.LIZZY^Start Menu^Programs^Startup^mod_sm.lnk]
C:\hp\bin\cloaker.exe [1999-11-07 27136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
C:\PROGRA~1\Quicken\bagent.exe [2002-09-20 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-08-20 344064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]
C:\Program Files\Softex\OmniPass\opxpgina.dll [2003-02-21 40960]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\System32\khfFWQKD

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
"NoDispCPL"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoStartMenuMorePrograms"=0
"NoSetFolders"=0
"StartMenuLogOff"=0
"NoDrives"=0
"NoToolbarCustomize"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2008-11-05 16:12:22 ----D---- C:\WINDOWS\Prefetch
2008-11-05 15:54:58 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-05 15:54:52 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-05 15:54:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-05 15:54:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-05 15:54:22 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-11-05 15:54:09 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-05 15:53:59 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-05 15:53:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-05 15:53:46 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-05 15:53:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-05 15:53:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-05 15:53:22 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-05 15:53:11 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-05 15:53:00 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-05 15:52:47 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-05 15:52:43 ----D---- C:\WINDOWS\LastGood.Tmp
2008-11-05 15:39:06 ----D---- C:\WINDOWS\system32\scripting
2008-11-05 15:39:03 ----D---- C:\WINDOWS\l2schemas
2008-11-05 15:39:02 ----D---- C:\WINDOWS\system32\en
2008-11-04 14:45:28 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2008-11-04 14:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2008-11-04 14:44:59 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2008-11-04 14:44:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-11-04 14:44:00 ----HDC---- C:\WINDOWS\$NtUninstallKB923723$
2008-11-04 14:36:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-11-04 14:36:24 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-11-04 14:36:03 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2008-11-04 14:35:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951698_0$
2008-11-04 14:35:05 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-11-04 14:32:56 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-11-04 14:31:48 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2008-11-04 14:31:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-11-04 14:31:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2008-11-04 14:29:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2008-11-04 14:25:18 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2008-11-04 14:25:10 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2008-11-04 14:24:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956390_0$
2008-11-04 14:24:15 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-11-04 14:23:40 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2008-11-04 09:28:12 ----N---- C:\WINDOWS\system32\wmphoto.dll
2008-11-04 09:28:07 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-11-04 09:28:05 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2008-11-04 09:28:04 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2008-11-04 09:27:56 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-11-04 09:27:56 ----N---- C:\WINDOWS\system32\tsgqec.dll
2008-11-04 09:27:41 ----N---- C:\WINDOWS\system32\setupn.exe
2008-11-04 09:27:37 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2008-11-04 09:27:35 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-11-04 09:27:34 ----N---- C:\WINDOWS\system32\qutil.dll
2008-11-04 09:27:32 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-11-04 09:27:32 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-11-04 09:27:32 ----N---- C:\WINDOWS\system32\qagent.dll
2008-11-04 09:27:30 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2008-11-04 09:27:27 ----N---- C:\WINDOWS\system32\onex.dll
2008-11-04 09:27:16 ----N---- C:\WINDOWS\system32\napstat.exe
2008-11-04 09:27:16 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-11-04 09:27:15 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-11-04 09:27:14 ----N---- C:\WINDOWS\system32\msxml6r.dll
2008-11-04 09:27:14 ----N---- C:\WINDOWS\system32\msxml6.dll
2008-11-04 09:27:10 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-11-04 09:27:10 ----N---- C:\WINDOWS\system32\mssha.dll
2008-11-04 09:26:51 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-11-04 09:26:51 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-11-04 09:26:51 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-11-04 09:26:50 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-11-04 09:26:40 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-11-04 09:26:30 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-11-04 09:26:01 ----A---- C:\WINDOWS\005345_.tmp
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-11-04 09:25:52 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-11-04 09:25:52 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-11-04 09:25:51 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-11-04 09:25:47 ----N---- C:\WINDOWS\system32\credssp.dll
2008-11-04 09:25:40 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-11-04 09:25:39 ----N---- C:\WINDOWS\system32\azroles.dll
2008-11-04 09:25:29 ----N---- C:\WINDOWS\system32\aaclient.dll
2008-11-03 16:27:07 ----HD---- C:\$AVG8.VAULT$
2008-11-03 16:01:44 ----A---- C:\WINDOWS\system32\avgrsstx.dll
2008-11-03 16:01:13 ----D---- C:\Program Files\AVG
2008-11-03 16:01:12 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
2008-11-03 15:57:13 ----A---- C:\Program Files\avg_free_stf_en_8_173a1373.exe
2008-11-03 15:50:00 ----HDC---- C:\WINDOWS\$NtUninstallKB924496$
2008-11-03 15:49:24 ----HDC---- C:\WINDOWS\$NtUninstallKB924191$
2008-11-03 15:48:50 ----HDC---- C:\WINDOWS\$NtUninstallKB923414$
2008-11-03 15:48:14 ----HDC---- C:\WINDOWS\$NtUninstallKB923191$
2008-11-03 15:47:38 ----HDC---- C:\WINDOWS\$NtUninstallKB922819$
2008-11-03 15:47:01 ----HDC---- C:\WINDOWS\$NtUninstallKB922616$
2008-11-03 15:46:25 ----HDC---- C:\WINDOWS\$NtUninstallKB921883$
2008-11-03 15:45:46 ----HDC---- C:\WINDOWS\$NtUninstallKB921398$
2008-11-03 15:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB920685$
2008-11-03 15:44:36 ----HDC---- C:\WINDOWS\$NtUninstallKB920683$
2008-11-03 15:44:00 ----HDC---- C:\WINDOWS\$NtUninstallKB920670$
2008-11-03 15:43:31 ----HDC---- C:\WINDOWS\$NtUninstallKB919007$
2008-11-03 15:42:57 ----HDC---- C:\WINDOWS\$NtUninstallKB917953$
2008-11-03 15:42:22 ----HDC---- C:\WINDOWS\$NtUninstallKB917422$
2008-11-03 15:41:45 ----HDC---- C:\WINDOWS\$NtUninstallKB917344$
2008-11-03 15:41:10 ----HDC---- C:\WINDOWS\$NtUninstallKB914389$
2008-11-03 15:40:32 ----HDC---- C:\WINDOWS\$NtUninstallKB914388$
2008-11-03 15:39:53 ----HDC---- C:\WINDOWS\$NtUninstallKB913580$
2008-11-03 15:39:16 ----HDC---- C:\WINDOWS\$NtUninstallKB912919$
2008-11-03 15:38:40 ----HDC---- C:\WINDOWS\$NtUninstallKB911927$
2008-11-03 15:38:05 ----HDC---- C:\WINDOWS\$NtUninstallKB911562$
2008-11-03 15:37:32 ----HDC---- C:\WINDOWS\$NtUninstallKB911280$
2008-11-03 15:36:58 ----HDC---- C:\WINDOWS\$NtUninstallKB910437$
2008-11-03 15:36:23 ----HDC---- C:\WINDOWS\$NtUninstallKB908531$
2008-11-03 15:35:51 ----HDC---- C:\WINDOWS\$NtUninstallKB908519$
2008-11-03 15:35:20 ----HDC---- C:\WINDOWS\$NtUninstallKB905749$
2008-11-03 15:34:49 ----HDC---- C:\WINDOWS\$NtUninstallKB905414$
2008-11-03 15:34:09 ----HDC---- C:\WINDOWS\$NtUninstallKB902400$
2008-11-03 15:33:32 ----HDC---- C:\WINDOWS\$NtUninstallKB901214$
2008-11-03 15:32:55 ----HDC---- C:\WINDOWS\$NtUninstallKB901017$
2008-11-03 15:32:13 ----HDC---- C:\WINDOWS\$NtUninstallKB900725$
2008-11-03 15:31:39 ----HDC---- C:\WINDOWS\$NtUninstallKB899591$
2008-11-03 15:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB899587$
2008-11-03 15:30:18 ----HDC---- C:\WINDOWS\$NtUninstallKB896428$
2008-11-03 15:29:44 ----HDC---- C:\WINDOWS\$NtUninstallKB896424$
2008-11-03 15:29:08 ----HDC---- C:\WINDOWS\$NtUninstallKB896423$
2008-11-03 15:28:32 ----HDC---- C:\WINDOWS\$NtUninstallKB896358$
2008-11-03 15:27:57 ----HDC---- C:\WINDOWS\$NtUninstallKB893756$
2008-11-03 15:27:24 ----HDC---- C:\WINDOWS\$NtUninstallKB891781$
2008-11-03 15:26:50 ----HDC---- C:\WINDOWS\$NtUninstallKB890859$
2008-11-03 15:26:14 ----HDC---- C:\WINDOWS\$NtUninstallKB890046$
2008-11-03 15:25:43 ----HDC---- C:\WINDOWS\$NtUninstallKB888302$
2008-11-03 15:25:11 ----HDC---- C:\WINDOWS\$NtUninstallKB885836$
2008-11-03 15:24:40 ----HDC---- C:\WINDOWS\$NtUninstallKB885835$
2008-11-03 15:24:02 ----HDC---- C:\WINDOWS\$NtUninstallKB873339$
2008-11-03 15:09:38 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-11-03 14:59:51 ----A---- C:\WINDOWS\system32\igfxres.dll
2008-11-03 14:57:52 ----HDC---- C:\WINDOWS\$NtUninstallKB899587_0$
2008-11-03 14:57:19 ----HDC---- C:\WINDOWS\$NtUninstallKB924191_0$
2008-11-03 14:54:43 ----HDC---- C:\WINDOWS\$NtUninstallKB922819_0$
2008-11-03 14:54:06 ----HDC---- C:\WINDOWS\$NtUninstallKB885835_0$
2008-11-03 14:53:34 ----HDC---- C:\WINDOWS\$NtUninstallKB885836_0$
2008-11-03 14:53:03 ----HDC---- C:\WINDOWS\$NtUninstallKB923414_0$
2008-11-03 14:52:32 ----HDC---- C:\WINDOWS\$NtUninstallKB921883_0$
2008-11-03 14:52:02 ----HDC---- C:\WINDOWS\$NtUninstallKB917734_WMP9$
2008-11-03 14:51:28 ----HDC---- C:\WINDOWS\$NtUninstallKB911927_0$
2008-11-03 14:50:56 ----HDC---- C:\WINDOWS\$NtUninstallKB922616_0$
2008-11-03 14:50:24 ----HDC---- C:\WINDOWS\$NtUninstallKB901017_0$
2008-11-03 14:49:54 ----HDC---- C:\WINDOWS\$NtUninstallKB899591_0$
2008-11-03 14:49:22 ----HDC---- C:\WINDOWS\$NtUninstallKB920685_0$
2008-11-03 14:48:47 ----HDC---- C:\WINDOWS\$NtUninstallKB896424_0$
2008-11-03 14:48:13 ----HDC---- C:\WINDOWS\$NtUninstallKB893756_0$
2008-11-03 14:47:40 ----HDC---- C:\WINDOWS\$NtUninstallKB911280_0$
2008-11-03 14:47:08 ----HDC---- C:\WINDOWS\$NtUninstallKB911562_0$
2008-11-03 14:46:36 ----HDC---- C:\WINDOWS\$NtUninstallKB896423_0$
2008-11-03 14:46:09 ----HDC---- C:\WINDOWS\$NtUninstallKB873339_0$
2008-11-03 14:45:12 ----HDC---- C:\WINDOWS\$NtUninstallKB924496_0$
2008-11-03 14:44:46 ----HDC---- C:\WINDOWS\$NtUninstallKB925486-IE6SP1-20060918.120000$
2008-11-03 14:44:22 ----HDC---- C:\WINDOWS\$NtUninstallKB921398_0$
2008-11-03 14:43:56 ----HDC---- C:\WINDOWS\$NtUninstallKB918439-IE6SP1-20060530.145346$
2008-11-03 14:43:33 ----HDC---- C:\WINDOWS\$NtUninstallKB896358_0$
2008-11-03 14:42:45 ----HDC---- C:\WINDOWS\$NtUninstallKB910437_0$
2008-11-03 14:42:18 ----HDC---- C:\WINDOWS\$NtUninstallKB898458$
2008-11-03 14:41:57 ----HDC---- C:\WINDOWS\$NtUninstallKB905495$
2008-11-03 14:40:23 ----HDC---- C:\WINDOWS\$NtUninstallKB911564$
2008-11-03 14:39:45 ----HDC---- C:\WINDOWS\$NtUninstallKB902400_0$
2008-11-03 14:39:19 ----HDC---- C:\WINDOWS\$NtUninstallKB920670_0$
2008-11-03 14:38:54 ----HDC---- C:\WINDOWS\$NtUninstallKB891781_0$
2008-11-03 14:38:43 ----A---- C:\WINDOWS\system32\jit.dll
2008-11-03 14:38:43 ----A---- C:\WINDOWS\setdebug.exe
2008-11-03 14:38:42 ----A---- C:\WINDOWS\system32\dx3j.dll
2008-11-03 14:38:36 ----A---- C:\WINDOWS\system32\wjview.exe
2008-11-03 14:38:36 ----A---- C:\WINDOWS\system32\vmhelper.dll
2008-11-03 14:38:35 ----A---- C:\WINDOWS\system32\msjdbc10.dll
2008-11-03 14:38:35 ----A---- C:\WINDOWS\system32\msjava.dll
2008-11-03 14:38:34 ----A---- C:\WINDOWS\system32\msawt.dll
2008-11-03 14:38:34 ----A---- C:\WINDOWS\system32\jview.exe
2008-11-03 14:38:34 ----A---- C:\WINDOWS\system32\jdbgmgr.exe
2008-11-03 14:38:33 ----A---- C:\WINDOWS\system32\javart.dll
2008-11-03 14:38:33 ----A---- C:\WINDOWS\system32\javaprxy.dll
2008-11-03 14:38:33 ----A---- C:\WINDOWS\system32\javacypt.dll
2008-11-03 14:38:32 ----A---- C:\WINDOWS\system32\clspack.exe
2008-11-03 14:38:15 ----HDC---- C:\WINDOWS\$NtUninstallKB890046_0$
2008-11-03 14:37:52 ----HDC---- C:\WINDOWS\$NtUninstallKB919007_0$
2008-11-03 14:37:26 ----HDC---- C:\WINDOWS\$NtUninstallKB914388_0$
2008-11-03 14:37:06 ----HDC---- C:\WINDOWS\$NtUninstallKB904706$
2008-11-03 14:36:36 ----HDC---- C:\WINDOWS\$NtUninstallKB917344_0$
2008-11-03 14:36:15 ----HDC---- C:\WINDOWS\$NtUninstallKB905414_0$
2008-11-03 14:35:55 ----HDC---- C:\WINDOWS\$NtUninstallKB917953_0$
2008-11-03 14:35:33 ----HDC---- C:\WINDOWS\$NtUninstallKB901214_0$
2008-11-03 14:35:07 ----HDC---- C:\WINDOWS\$NtUninstallKB923191_0$
2008-11-03 14:34:44 ----HDC---- C:\WINDOWS\$NtUninstallKB917422_0$
2008-11-03 14:34:23 ----HDC---- C:\WINDOWS\$NtUninstallKB888302_0$
2008-11-03 14:34:02 ----HDC---- C:\WINDOWS\$NtUninstallKB900725_0$
2008-11-03 14:33:19 ----HDC---- C:\WINDOWS\$NtUninstallKB912919_0$
2008-11-03 14:32:47 ----HDC---- C:\WINDOWS\$NtUninstallKB918899-IE6SP1-20060725.123917$
2008-11-03 14:32:26 ----HDC---- C:\WINDOWS\$NtUninstallKB911567-OE6SP1-20060316.165634$
2008-11-03 14:32:05 ----HDC---- C:\WINDOWS\$NtUninstallKB908531_0$
2008-11-03 14:31:45 ----HDC---- C:\WINDOWS\$NtUninstallKB905749_0$
2008-11-03 14:31:27 ----HDC---- C:\WINDOWS\$NtUninstallKB913580_0$
2008-11-03 14:31:11 ----HDC---- C:\WINDOWS\$NtUninstallKB896428_0$
2008-11-03 14:30:55 ----HDC---- C:\WINDOWS\$NtUninstallKB835409$
2008-11-03 14:30:36 ----HDC---- C:\WINDOWS\$NtUninstallKB908519_0$
2008-11-03 14:30:22 ----HDC---- C:\WINDOWS\$NtUninstallKB920683_0$
2008-11-03 14:30:06 ----HDC---- C:\WINDOWS\$NtUninstallKB914389_0$
2008-11-03 14:29:29 ----HDC---- C:\WINDOWS\$NtUninstallKB890859_0$
2008-11-03 14:26:09 ----A---- C:\WINDOWS\002314_.tmp
2008-11-03 14:12:15 ----A---- C:\WINDOWS\system32\esent.dll
2008-11-03 14:03:32 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2008-11-03 14:02:57 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2008-11-03 14:02:17 ----HDC---- C:\WINDOWS\$NtUninstallKB842773$
2008-11-03 14:01:48 ----A---- C:\WINDOWS\system32\winhttp.dll
2008-11-03 14:01:48 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-11-03 13:59:23 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-11-03 13:59:22 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-11-03 13:45:21 ----D---- C:\setups
2008-11-03 07:42:06 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-11-03 07:41:57 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-03 07:41:57 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-03 07:36:39 ----D---- C:\Documents and Settings\Owner\Application Data\Mozilla
2008-11-02 18:17:01 ----D---- C:\rsit
2008-11-02 07:36:14 ----D---- C:\Program Files\Mozilla Firefox
2008-11-02 07:23:37 ----D---- C:\Program Files\Trend Micro
2008-11-02 07:23:29 ----A---- C:\Program Files\HJTInstall.exe
2008-11-01 22:18:38 ----D---- C:\Program Files\HijackThis
2008-11-01 20:53:33 ----A---- C:\Program Files\spybotsd160.exe

======List of files/folders modified in the last 1 months======

2008-11-05 16:56:52 ----D---- C:\WINDOWS\Temp
2008-11-05 16:15:23 ----D---- C:\WINDOWS\system32
2008-11-05 16:15:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-05 16:14:11 ----SHD---- C:\WINDOWS\Installer
2008-11-05 16:14:11 ----SHD---- C:\Config.Msi
2008-11-05 16:13:58 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-05 16:13:04 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-05 16:12:47 ----A---- C:\WINDOWS\setuplog.txt
2008-11-05 16:12:46 ----D---- C:\WINDOWS
2008-11-05 16:11:36 ----D---- C:\WINDOWS\system32\wbem
2008-11-05 16:11:36 ----D---- C:\WINDOWS\system32\Setup
2008-11-05 16:11:36 ----D---- C:\WINDOWS\AppPatch
2008-11-05 16:11:34 ----RSD---- C:\WINDOWS\Fonts
2008-11-05 16:11:23 ----D---- C:\WINDOWS\system32\drivers
2008-11-05 16:10:40 ----D---- C:\WINDOWS\security
2008-11-05 16:10:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-05 15:55:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-05 15:55:00 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-05 15:54:58 ----HD---- C:\WINDOWS\inf
2008-11-05 15:53:02 ----D---- C:\Program Files\Messenger
2008-11-05 15:40:01 ----D---- C:\WINDOWS\WinSxS
2008-11-05 15:39:50 ----D---- C:\Program Files\Windows Media Player
2008-11-05 15:39:49 ----D---- C:\WINDOWS\Help
2008-11-05 15:39:29 ----D---- C:\WINDOWS\network diagnostic
2008-11-05 15:39:28 ----D---- C:\WINDOWS\ime
2008-11-05 15:39:07 ----D---- C:\WINDOWS\system32\usmt
2008-11-05 15:39:07 ----D---- C:\WINDOWS\system32\en-US
2008-11-05 15:39:02 ----D---- C:\WINDOWS\system32\bits
2008-11-05 15:39:02 ----D---- C:\WINDOWS\peernet
2008-11-05 15:39:01 ----D---- C:\Program Files\Movie Maker
2008-11-05 15:34:39 ----D---- C:\Program Files\Internet Explorer
2008-11-05 15:34:38 ----D---- C:\WINDOWS\system32\Restore
2008-11-05 15:34:38 ----D---- C:\WINDOWS\system32\npp
2008-11-05 15:34:36 ----D---- C:\WINDOWS\msagent
2008-11-05 15:34:34 ----D---- C:\WINDOWS\srchasst
2008-11-05 15:34:33 ----D---- C:\Program Files\NetMeeting
2008-11-05 15:34:32 ----D---- C:\WINDOWS\system32\Com
2008-11-05 15:34:28 ----D---- C:\Program Files\Windows NT
2008-11-05 15:34:28 ----D---- C:\Program Files\Outlook Express
2008-11-05 15:34:24 ----D---- C:\Program Files\Common Files\System
2008-11-05 15:34:05 ----D---- C:\WINDOWS\system32\oobe
2008-11-05 15:34:03 ----D---- C:\WINDOWS\system
2008-11-05 15:22:44 ----D---- C:\WINDOWS\EHome
2008-11-04 14:45:26 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-04 09:02:35 ----D---- C:\WINDOWS\Debug
2008-11-03 16:19:14 ----RD---- C:\Program Files
2008-11-03 16:13:24 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-03 16:07:02 ----RASH---- C:\boot.ini
2008-11-03 16:07:02 ----A---- C:\WINDOWS\win.ini
2008-11-03 16:07:02 ----A---- C:\WINDOWS\system.ini
2008-11-03 16:01:04 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-03 15:15:04 ----RD---- C:\WINDOWS\Web
2008-11-03 15:14:48 ----RASH---- C:\NTDETECT.COM
2008-11-03 15:13:27 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-03 14:56:48 ----D---- C:\WINDOWS\Registration
2008-11-03 14:38:47 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-03 13:58:54 ----D---- C:\WINDOWS\SoftwareDistribution
2008-11-03 13:51:15 ----HD---- C:\Program Files\WindowsUpdate
2008-11-03 13:00:50 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-11-03 07:32:19 ----D---- C:\Program Files\Google
2008-11-03 07:32:19 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2008-11-03 07:27:02 ----AC---- C:\WINDOWS\ntbtlog.txt
2008-11-02 07:39:54 ----D---- C:\WINDOWS\pss
2008-11-01 22:18:54 ----SHD---- C:\RECYCLER
2008-11-01 20:58:59 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-01 20:58:06 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-01 20:30:03 ----D---- C:\Documents and Settings
2008-11-01 20:25:42 ----D---- C:\Documents and Settings\Owner\Application Data\interMute
2008-11-01 20:24:40 ----SD---- C:\WINDOWS\Tasks
2008-11-01 20:24:20 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-11-01 20:23:30 ----D---- C:\Program Files\Symantec
2008-11-01 20:20:10 ----D---- C:\Program Files\AWS
2008-10-15 11:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-07 12:19:42 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-11-03 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-11-03 26824]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-08-29 12032]
R2 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-11-03 76040]
R2 MCSTRM;MCSTRM; C:\WINDOWS\system32\drivers\MCSTRM.sys [2006-03-18 8413]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\System32\drivers\tmcomm.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2004-08-20 737874]
R3 ltmodem5;Lucent Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2003-03-08 624369]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-10-01 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2002-07-29 23808]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-13 37760]
S2 mrtRate;mrtRate; C:\WINDOWS\system32\drivers\mrtRate.sys []
S3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-14 112288]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-14 78496]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2004-08-04 166912]
S3 SiS315;SiS315; C:\WINDOWS\System32\DRIVERS\sisgrp.sys [2003-02-26 260736]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-11-03 875288]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-11-03 231704]
R2 omniserv;Softex OmniPass Service; C:\Program Files\Softex\OmniPass\Omniserv.exe [2003-02-21 68704]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2003-03-03 65536]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]

-----------------EOF-----------------

Yours,

Duckyfriends

#10
kahdah

Posted 05 November 2008 - 08:36 PM

GeekU Teacher

Retired Staff
15,822 posts

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

First, we need to backup your registry:
Please go to Start > Run
Paste in the following line:regedit /e c:\registrybackup.reg
Click OK.
It won't appear to be doing anything, that's normal.
Your mouse pointer may turn to an hour glass for a minute.
Please continue when it no longer has the hour glass.

Please open up Notepad and copy all of the items in the code box below.
Change the "Save As Type" to "All Files". Save it as fixthis.reg on your Desktop.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B548CB2-4968-4814-B155-69CEDBE009AE}]

[-HKEY_CLASSES_ROOT\CLSID\{7B548CB2-4968-4814-B155-69CEDBE009AE}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A30B575B-0E87-446B-BB58-DD22D0F61DE0}]

[-HKEY_CLASSES_ROOT\CLSID\{A30B575B-0E87-446B-BB58-DD22D0F61DE0}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[-HKEY_CLASSES_ROOT\CLSID\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Now double-click fixthis.reg.
A window will come up asking if you want to let it merge with the registry.
Click yes.
Reboot for the changes to take place and let me know how things are running and post one more Rsit log.

#11
duckyfriends

Posted 06 November 2008 - 12:38 PM

New Member

Topic Starter
Member
6 posts

Hello Kahdah,

My computer seems to be running okay everything is booting nice and smooth. I'm not receiving any popups or anything like that which I am loving.

here is the new rsit log:

Logfile of random's system information tool 1.04 (written by random/random)
Run by Owner at 2008-11-06 13:35:19
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 79 GB (72%) free of 110 GB
Total RAM: 503 MB (46% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:35:50 PM, on 11/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\rsit\RSIT.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus8.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8.hpwis.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7B548CB2-4968-4814-B155-69CEDBE009AE} - (no file)
O2 - BHO: (no name) - {A30B575B-0E87-446B-BB58-DD22D0F61DE0} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1225738257875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1225738692546
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

--
End of file - 6344 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\McDefragTask.job
C:\WINDOWS\tasks\McQcTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-03-02 37808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
C:\Program Files\Microsoft Money\System\mnyside.dll [2002-07-17 163906]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-11-03 455960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B548CB2-4968-4814-B155-69CEDBE009AE}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A30B575B-0E87-446B-BB58-DD22D0F61DE0}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"HotKeysCmds"=C:\WINDOWS\System32\hkcmd.exe [2004-08-20 118784]
"KBD"=C:\HP\KBD\KBD.EXE [2003-02-11 61440]
"StorageGuard"=C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe [2003-02-13 155648]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2003-04-10 151597]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2002-09-13 212992]
"AlcxMonitor"=C:\WINDOWS\ALCXMNTR.EXE [2004-09-07 57344]
"IgfxTray"=C:\WINDOWS\System32\igfxtray.exe [2004-08-20 155648]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-03 1234712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\MSMSGS.EXE [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
C:\WINDOWS\system32\ps2.exe [2002-07-31 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe [2004-11-02 218240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe [2008-02-22 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrator.LIZZY^Start Menu^Programs^Startup^mod_sm.lnk]
C:\hp\bin\cloaker.exe [1999-11-07 27136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
C:\PROGRA~1\Quicken\bagent.exe [2002-09-20 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-08-20 344064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]
C:\Program Files\Softex\OmniPass\opxpgina.dll [2003-02-21 40960]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0
"NoDispCPL"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoStartMenuMorePrograms"=0
"NoSetFolders"=0
"StartMenuLogOff"=0
"NoDrives"=0
"NoToolbarCustomize"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2008-11-06 03:24:16 ----D---- C:\WINDOWS\LastGood
2008-11-05 16:12:22 ----D---- C:\WINDOWS\Prefetch
2008-11-05 15:54:58 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-11-05 15:54:52 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-11-05 15:54:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-11-05 15:54:34 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-11-05 15:54:22 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-11-05 15:54:09 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-11-05 15:53:59 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-11-05 15:53:53 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-11-05 15:53:46 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-11-05 15:53:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-11-05 15:53:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-11-05 15:53:22 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-11-05 15:53:11 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-11-05 15:53:00 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-11-05 15:52:47 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-11-05 15:39:06 ----D---- C:\WINDOWS\system32\scripting
2008-11-05 15:39:03 ----D---- C:\WINDOWS\l2schemas
2008-11-05 15:39:02 ----D---- C:\WINDOWS\system32\en
2008-11-04 14:45:28 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2008-11-04 14:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2008-11-04 14:44:59 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2008-11-04 14:44:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-11-04 14:44:00 ----HDC---- C:\WINDOWS\$NtUninstallKB923723$
2008-11-04 14:36:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-11-04 14:36:24 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-11-04 14:36:03 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2008-11-04 14:35:42 ----HDC---- C:\WINDOWS\$NtUninstallKB951698_0$
2008-11-04 14:35:05 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-11-04 14:32:56 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-11-04 14:31:48 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2008-11-04 14:31:27 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-11-04 14:31:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2008-11-04 14:29:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2008-11-04 14:25:18 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$
2008-11-04 14:25:10 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2008-11-04 14:24:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956390_0$
2008-11-04 14:24:15 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2008-11-04 14:23:40 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2008-11-04 09:28:12 ----N---- C:\WINDOWS\system32\wmphoto.dll
2008-11-04 09:28:07 ----N---- C:\WINDOWS\system32\wlanapi.dll
2008-11-04 09:28:05 ----N---- C:\WINDOWS\system32\windowscodecsext.dll
2008-11-04 09:28:04 ----N---- C:\WINDOWS\system32\windowscodecs.dll
2008-11-04 09:27:56 ----N---- C:\WINDOWS\system32\tspkg.dll
2008-11-04 09:27:56 ----N---- C:\WINDOWS\system32\tsgqec.dll
2008-11-04 09:27:41 ----N---- C:\WINDOWS\system32\setupn.exe
2008-11-04 09:27:37 ----N---- C:\WINDOWS\system32\rhttpaa.dll
2008-11-04 09:27:35 ----N---- C:\WINDOWS\system32\rasqec.dll
2008-11-04 09:27:34 ----N---- C:\WINDOWS\system32\qutil.dll
2008-11-04 09:27:32 ----N---- C:\WINDOWS\system32\qcliprov.dll
2008-11-04 09:27:32 ----N---- C:\WINDOWS\system32\qagentrt.dll
2008-11-04 09:27:32 ----N---- C:\WINDOWS\system32\qagent.dll
2008-11-04 09:27:30 ----N---- C:\WINDOWS\system32\photometadatahandler.dll
2008-11-04 09:27:27 ----N---- C:\WINDOWS\system32\onex.dll
2008-11-04 09:27:16 ----N---- C:\WINDOWS\system32\napstat.exe
2008-11-04 09:27:16 ----N---- C:\WINDOWS\system32\napmontr.dll
2008-11-04 09:27:15 ----N---- C:\WINDOWS\system32\napipsec.dll
2008-11-04 09:27:14 ----N---- C:\WINDOWS\system32\msxml6r.dll
2008-11-04 09:27:14 ----N---- C:\WINDOWS\system32\msxml6.dll
2008-11-04 09:27:10 ----N---- C:\WINDOWS\system32\msshavmsg.dll
2008-11-04 09:27:10 ----N---- C:\WINDOWS\system32\mssha.dll
2008-11-04 09:26:51 ----N---- C:\WINDOWS\system32\mmcperf.exe
2008-11-04 09:26:51 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll
2008-11-04 09:26:51 ----N---- C:\WINDOWS\system32\mmcex.dll
2008-11-04 09:26:50 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-11-04 09:26:40 ----N---- C:\WINDOWS\system32\l2gpstore.dll
2008-11-04 09:26:30 ----N---- C:\WINDOWS\system32\kmsvc.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdpash.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdnepr.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdiultn.dll
2008-11-04 09:26:29 ----N---- C:\WINDOWS\system32\kbdbhc.dll
2008-11-04 09:26:01 ----A---- C:\WINDOWS\005345_.tmp
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapsvc.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapqec.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eappprxy.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapphost.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eappgnui.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eappcfg.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapp3hst.dll
2008-11-04 09:25:59 ----N---- C:\WINDOWS\system32\eapolqec.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3ui.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3svc.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3msm.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3dlg.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3cfg.dll
2008-11-04 09:25:54 ----N---- C:\WINDOWS\system32\dot3api.dll
2008-11-04 09:25:52 ----N---- C:\WINDOWS\system32\dimsroam.dll
2008-11-04 09:25:52 ----N---- C:\WINDOWS\system32\dimsntfy.dll
2008-11-04 09:25:51 ----N---- C:\WINDOWS\system32\dhcpqec.dll
2008-11-04 09:25:47 ----N---- C:\WINDOWS\system32\credssp.dll
2008-11-04 09:25:40 ----N---- C:\WINDOWS\system32\bitsprx4.dll
2008-11-04 09:25:39 ----N---- C:\WINDOWS\system32\azroles.dll
2008-11-04 09:25:29 ----N---- C:\WINDOWS\system32\aaclient.dll
2008-11-03 16:27:07 ----HD---- C:\$AVG8.VAULT$
2008-11-03 16:01:44 ----A---- C:\WINDOWS\system32\avgrsstx.dll
2008-11-03 16:01:13 ----D---- C:\Program Files\AVG
2008-11-03 16:01:12 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
2008-11-03 15:57:13 ----A---- C:\Program Files\avg_free_stf_en_8_173a1373.exe
2008-11-03 15:50:00 ----HDC---- C:\WINDOWS\$NtUninstallKB924496$
2008-11-03 15:49:24 ----HDC---- C:\WINDOWS\$NtUninstallKB924191$
2008-11-03 15:48:50 ----HDC---- C:\WINDOWS\$NtUninstallKB923414$
2008-11-03 15:48:14 ----HDC---- C:\WINDOWS\$NtUninstallKB923191$
2008-11-03 15:47:38 ----HDC---- C:\WINDOWS\$NtUninstallKB922819$
2008-11-03 15:47:01 ----HDC---- C:\WINDOWS\$NtUninstallKB922616$
2008-11-03 15:46:25 ----HDC---- C:\WINDOWS\$NtUninstallKB921883$
2008-11-03 15:45:46 ----HDC---- C:\WINDOWS\$NtUninstallKB921398$
2008-11-03 15:45:13 ----HDC---- C:\WINDOWS\$NtUninstallKB920685$
2008-11-03 15:44:36 ----HDC---- C:\WINDOWS\$NtUninstallKB920683$
2008-11-03 15:44:00 ----HDC---- C:\WINDOWS\$NtUninstallKB920670$
2008-11-03 15:43:31 ----HDC---- C:\WINDOWS\$NtUninstallKB919007$
2008-11-03 15:42:57 ----HDC---- C:\WINDOWS\$NtUninstallKB917953$
2008-11-03 15:42:22 ----HDC---- C:\WINDOWS\$NtUninstallKB917422$
2008-11-03 15:41:45 ----HDC---- C:\WINDOWS\$NtUninstallKB917344$
2008-11-03 15:41:10 ----HDC---- C:\WINDOWS\$NtUninstallKB914389$
2008-11-03 15:40:32 ----HDC---- C:\WINDOWS\$NtUninstallKB914388$
2008-11-03 15:39:53 ----HDC---- C:\WINDOWS\$NtUninstallKB913580$
2008-11-03 15:39:16 ----HDC---- C:\WINDOWS\$NtUninstallKB912919$
2008-11-03 15:38:40 ----HDC---- C:\WINDOWS\$NtUninstallKB911927$
2008-11-03 15:38:05 ----HDC---- C:\WINDOWS\$NtUninstallKB911562$
2008-11-03 15:37:32 ----HDC---- C:\WINDOWS\$NtUninstallKB911280$
2008-11-03 15:36:58 ----HDC---- C:\WINDOWS\$NtUninstallKB910437$
2008-11-03 15:36:23 ----HDC---- C:\WINDOWS\$NtUninstallKB908531$
2008-11-03 15:35:51 ----HDC---- C:\WINDOWS\$NtUninstallKB908519$
2008-11-03 15:35:20 ----HDC---- C:\WINDOWS\$NtUninstallKB905749$
2008-11-03 15:34:49 ----HDC---- C:\WINDOWS\$NtUninstallKB905414$
2008-11-03 15:34:09 ----HDC---- C:\WINDOWS\$NtUninstallKB902400$
2008-11-03 15:33:32 ----HDC---- C:\WINDOWS\$NtUninstallKB901214$
2008-11-03 15:32:55 ----HDC---- C:\WINDOWS\$NtUninstallKB901017$
2008-11-03 15:32:13 ----HDC---- C:\WINDOWS\$NtUninstallKB900725$
2008-11-03 15:31:39 ----HDC---- C:\WINDOWS\$NtUninstallKB899591$
2008-11-03 15:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB899587$
2008-11-03 15:30:18 ----HDC---- C:\WINDOWS\$NtUninstallKB896428$
2008-11-03 15:29:44 ----HDC---- C:\WINDOWS\$NtUninstallKB896424$
2008-11-03 15:29:08 ----HDC---- C:\WINDOWS\$NtUninstallKB896423$
2008-11-03 15:28:32 ----HDC---- C:\WINDOWS\$NtUninstallKB896358$
2008-11-03 15:27:57 ----HDC---- C:\WINDOWS\$NtUninstallKB893756$
2008-11-03 15:27:24 ----HDC---- C:\WINDOWS\$NtUninstallKB891781$
2008-11-03 15:26:50 ----HDC---- C:\WINDOWS\$NtUninstallKB890859$
2008-11-03 15:26:14 ----HDC---- C:\WINDOWS\$NtUninstallKB890046$
2008-11-03 15:25:43 ----HDC---- C:\WINDOWS\$NtUninstallKB888302$
2008-11-03 15:25:11 ----HDC---- C:\WINDOWS\$NtUninstallKB885836$
2008-11-03 15:24:40 ----HDC---- C:\WINDOWS\$NtUninstallKB885835$
2008-11-03 15:24:02 ----HDC---- C:\WINDOWS\$NtUninstallKB873339$
2008-11-03 15:09:38 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-11-03 14:59:51 ----A---- C:\WINDOWS\system32\igfxres.dll
2008-11-03 14:57:52 ----HDC---- C:\WINDOWS\$NtUninstallKB899587_0$
2008-11-03 14:57:19 ----HDC---- C:\WINDOWS\$NtUninstallKB924191_0$
2008-11-03 14:54:43 ----HDC---- C:\WINDOWS\$NtUninstallKB922819_0$
2008-11-03 14:54:06 ----HDC---- C:\WINDOWS\$NtUninstallKB885835_0$
2008-11-03 14:53:34 ----HDC---- C:\WINDOWS\$NtUninstallKB885836_0$
2008-11-03 14:53:03 ----HDC---- C:\WINDOWS\$NtUninstallKB923414_0$
2008-11-03 14:52:32 ----HDC---- C:\WINDOWS\$NtUninstallKB921883_0$
2008-11-03 14:52:02 ----HDC---- C:\WINDOWS\$NtUninstallKB917734_WMP9$
2008-11-03 14:51:28 ----HDC---- C:\WINDOWS\$NtUninstallKB911927_0$
2008-11-03 14:50:56 ----HDC---- C:\WINDOWS\$NtUninstallKB922616_0$
2008-11-03 14:50:24 ----HDC---- C:\WINDOWS\$NtUninstallKB901017_0$
2008-11-03 14:49:54 ----HDC---- C:\WINDOWS\$NtUninstallKB899591_0$
2008-11-03 14:49:22 ----HDC---- C:\WINDOWS\$NtUninstallKB920685_0$
2008-11-03 14:48:47 ----HDC---- C:\WINDOWS\$NtUninstallKB896424_0$
2008-11-03 14:48:13 ----HDC---- C:\WINDOWS\$NtUninstallKB893756_0$
2008-11-03 14:47:40 ----HDC---- C:\WINDOWS\$NtUninstallKB911280_0$
2008-11-03 14:47:08 ----HDC---- C:\WINDOWS\$NtUninstallKB911562_0$
2008-11-03 14:46:36 ----HDC---- C:\WINDOWS\$NtUninstallKB896423_0$
2008-11-03 14:46:09 ----HDC---- C:\WINDOWS\$NtUninstallKB873339_0$
2008-11-03 14:45:12 ----HDC---- C:\WINDOWS\$NtUninstallKB924496_0$
2008-11-03 14:44:46 ----HDC---- C:\WINDOWS\$NtUninstallKB925486-IE6SP1-20060918.120000$
2008-11-03 14:44:22 ----HDC---- C:\WINDOWS\$NtUninstallKB921398_0$
2008-11-03 14:43:56 ----HDC---- C:\WINDOWS\$NtUninstallKB918439-IE6SP1-20060530.145346$
2008-11-03 14:43:33 ----HDC---- C:\WINDOWS\$NtUninstallKB896358_0$
2008-11-03 14:42:45 ----HDC---- C:\WINDOWS\$NtUninstallKB910437_0$
2008-11-03 14:42:18 ----HDC---- C:\WINDOWS\$NtUninstallKB898458$
2008-11-03 14:41:57 ----HDC---- C:\WINDOWS\$NtUninstallKB905495$
2008-11-03 14:40:23 ----HDC---- C:\WINDOWS\$NtUninstallKB911564$
2008-11-03 14:39:45 ----HDC---- C:\WINDOWS\$NtUninstallKB902400_0$
2008-11-03 14:39:19 ----HDC---- C:\WINDOWS\$NtUninstallKB920670_0$
2008-11-03 14:38:54 ----HDC---- C:\WINDOWS\$NtUninstallKB891781_0$
2008-11-03 14:38:43 ----A---- C:\WINDOWS\system32\jit.dll
2008-11-03 14:38:43 ----A---- C:\WINDOWS\setdebug.exe
2008-11-03 14:38:42 ----A---- C:\WINDOWS\system32\dx3j.dll
2008-11-03 14:38:36 ----A---- C:\WINDOWS\system32\wjview.exe
2008-11-03 14:38:36 ----A---- C:\WINDOWS\system32\vmhelper.dll
2008-11-03 14:38:35 ----A---- C:\WINDOWS\system32\msjdbc10.dll
2008-11-03 14:38:35 ----A---- C:\WINDOWS\system32\msjava.dll
2008-11-03 14:38:34 ----A---- C:\WINDOWS\system32\msawt.dll
2008-11-03 14:38:34 ----A---- C:\WINDOWS\system32\jview.exe
2008-11-03 14:38:34 ----A---- C:\WINDOWS\system32\jdbgmgr.exe
2008-11-03 14:38:33 ----A---- C:\WINDOWS\system32\javart.dll
2008-11-03 14:38:33 ----A---- C:\WINDOWS\system32\javaprxy.dll
2008-11-03 14:38:33 ----A---- C:\WINDOWS\system32\javacypt.dll
2008-11-03 14:38:32 ----A---- C:\WINDOWS\system32\clspack.exe
2008-11-03 14:38:15 ----HDC---- C:\WINDOWS\$NtUninstallKB890046_0$
2008-11-03 14:37:52 ----HDC---- C:\WINDOWS\$NtUninstallKB919007_0$
2008-11-03 14:37:26 ----HDC---- C:\WINDOWS\$NtUninstallKB914388_0$
2008-11-03 14:37:06 ----HDC---- C:\WINDOWS\$NtUninstallKB904706$
2008-11-03 14:36:36 ----HDC---- C:\WINDOWS\$NtUninstallKB917344_0$
2008-11-03 14:36:15 ----HDC---- C:\WINDOWS\$NtUninstallKB905414_0$
2008-11-03 14:35:55 ----HDC---- C:\WINDOWS\$NtUninstallKB917953_0$
2008-11-03 14:35:33 ----HDC---- C:\WINDOWS\$NtUninstallKB901214_0$
2008-11-03 14:35:07 ----HDC---- C:\WINDOWS\$NtUninstallKB923191_0$
2008-11-03 14:34:44 ----HDC---- C:\WINDOWS\$NtUninstallKB917422_0$
2008-11-03 14:34:23 ----HDC---- C:\WINDOWS\$NtUninstallKB888302_0$
2008-11-03 14:34:02 ----HDC---- C:\WINDOWS\$NtUninstallKB900725_0$
2008-11-03 14:33:19 ----HDC---- C:\WINDOWS\$NtUninstallKB912919_0$
2008-11-03 14:32:47 ----HDC---- C:\WINDOWS\$NtUninstallKB918899-IE6SP1-20060725.123917$
2008-11-03 14:32:26 ----HDC---- C:\WINDOWS\$NtUninstallKB911567-OE6SP1-20060316.165634$
2008-11-03 14:32:05 ----HDC---- C:\WINDOWS\$NtUninstallKB908531_0$
2008-11-03 14:31:45 ----HDC---- C:\WINDOWS\$NtUninstallKB905749_0$
2008-11-03 14:31:27 ----HDC---- C:\WINDOWS\$NtUninstallKB913580_0$
2008-11-03 14:31:11 ----HDC---- C:\WINDOWS\$NtUninstallKB896428_0$
2008-11-03 14:30:55 ----HDC---- C:\WINDOWS\$NtUninstallKB835409$
2008-11-03 14:30:36 ----HDC---- C:\WINDOWS\$NtUninstallKB908519_0$
2008-11-03 14:30:22 ----HDC---- C:\WINDOWS\$NtUninstallKB920683_0$
2008-11-03 14:30:06 ----HDC---- C:\WINDOWS\$NtUninstallKB914389_0$
2008-11-03 14:29:29 ----HDC---- C:\WINDOWS\$NtUninstallKB890859_0$
2008-11-03 14:26:09 ----A---- C:\WINDOWS\002314_.tmp
2008-11-03 14:12:15 ----A---- C:\WINDOWS\system32\esent.dll
2008-11-03 14:03:32 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2008-11-03 14:02:57 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2008-11-03 14:02:17 ----HDC---- C:\WINDOWS\$NtUninstallKB842773$
2008-11-03 14:01:48 ----A---- C:\WINDOWS\system32\winhttp.dll
2008-11-03 14:01:48 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-11-03 13:59:23 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2008-11-03 13:59:22 ----A---- C:\WINDOWS\system32\mucltui.dll
2008-11-03 13:45:21 ----D---- C:\setups
2008-11-03 07:42:06 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-11-03 07:41:57 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-03 07:41:57 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-03 07:36:39 ----D---- C:\Documents and Settings\Owner\Application Data\Mozilla
2008-11-02 18:17:01 ----D---- C:\rsit
2008-11-02 07:36:14 ----D---- C:\Program Files\Mozilla Firefox
2008-11-02 07:23:37 ----D---- C:\Program Files\Trend Micro
2008-11-02 07:23:29 ----A---- C:\Program Files\HJTInstall.exe
2008-11-01 22:18:38 ----D---- C:\Program Files\HijackThis
2008-11-01 20:53:33 ----A---- C:\Program Files\spybotsd160.exe

======List of files/folders modified in the last 1 months======

2008-11-06 13:35:50 ----D---- C:\WINDOWS\Temp
2008-11-06 13:33:42 ----D---- C:\WINDOWS
2008-11-06 13:32:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-06 03:24:27 ----HD---- C:\WINDOWS\inf
2008-11-06 03:24:17 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-05 16:15:23 ----D---- C:\WINDOWS\system32
2008-11-05 16:15:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-05 16:14:11 ----SHD---- C:\WINDOWS\Installer
2008-11-05 16:14:11 ----SHD---- C:\Config.Msi
2008-11-05 16:13:58 ----A---- C:\WINDOWS\OEWABLog.txt
2008-11-05 16:13:04 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-05 16:12:47 ----A---- C:\WINDOWS\setuplog.txt
2008-11-05 16:11:36 ----D---- C:\WINDOWS\system32\wbem
2008-11-05 16:11:36 ----D---- C:\WINDOWS\system32\Setup
2008-11-05 16:11:36 ----D---- C:\WINDOWS\AppPatch
2008-11-05 16:11:34 ----RSD---- C:\WINDOWS\Fonts
2008-11-05 16:11:23 ----D---- C:\WINDOWS\system32\drivers
2008-11-05 16:10:40 ----D---- C:\WINDOWS\security
2008-11-05 15:55:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-05 15:55:00 ----D---- C:\WINDOWS\system32\CatRoot
2008-11-05 15:53:02 ----D---- C:\Program Files\Messenger
2008-11-05 15:40:01 ----D---- C:\WINDOWS\WinSxS
2008-11-05 15:39:52 ----D---- C:\WINDOWS\ServicePackFiles
2008-11-05 15:39:50 ----D---- C:\Program Files\Windows Media Player
2008-11-05 15:39:49 ----D---- C:\WINDOWS\Help
2008-11-05 15:39:29 ----D---- C:\WINDOWS\network diagnostic
2008-11-05 15:39:28 ----D---- C:\WINDOWS\ime
2008-11-05 15:39:07 ----D---- C:\WINDOWS\system32\usmt
2008-11-05 15:39:07 ----D---- C:\WINDOWS\system32\en-US
2008-11-05 15:39:02 ----D---- C:\WINDOWS\system32\bits
2008-11-05 15:39:02 ----D---- C:\WINDOWS\peernet
2008-11-05 15:39:01 ----D---- C:\Program Files\Movie Maker
2008-11-05 15:34:39 ----D---- C:\Program Files\Internet Explorer
2008-11-05 15:34:38 ----D---- C:\WINDOWS\system32\Restore
2008-11-05 15:34:38 ----D---- C:\WINDOWS\system32\npp
2008-11-05 15:34:36 ----D---- C:\WINDOWS\msagent
2008-11-05 15:34:34 ----D---- C:\WINDOWS\srchasst
2008-11-05 15:34:33 ----D---- C:\Program Files\NetMeeting
2008-11-05 15:34:32 ----D---- C:\WINDOWS\system32\Com
2008-11-05 15:34:28 ----D---- C:\Program Files\Windows NT
2008-11-05 15:34:28 ----D---- C:\Program Files\Outlook Express
2008-11-05 15:34:24 ----D---- C:\Program Files\Common Files\System
2008-11-05 15:34:05 ----D---- C:\WINDOWS\system32\oobe
2008-11-05 15:34:03 ----D---- C:\WINDOWS\system
2008-11-05 15:27:50 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-11-05 15:22:44 ----D---- C:\WINDOWS\EHome
2008-11-04 09:02:35 ----D---- C:\WINDOWS\Debug
2008-11-03 16:19:14 ----RD---- C:\Program Files
2008-11-03 16:13:24 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-03 16:07:02 ----RASH---- C:\boot.ini
2008-11-03 16:07:02 ----N---- C:\WINDOWS\system.ini
2008-11-03 16:07:02 ----A---- C:\WINDOWS\win.ini
2008-11-03 16:01:04 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-03 15:15:04 ----RD---- C:\WINDOWS\Web
2008-11-03 15:14:48 ----RASH---- C:\NTDETECT.COM
2008-11-03 14:56:48 ----D---- C:\WINDOWS\Registration
2008-11-03 14:38:47 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-03 13:58:54 ----D---- C:\WINDOWS\SoftwareDistribution
2008-11-03 13:51:15 ----HD---- C:\Program Files\WindowsUpdate
2008-11-03 13:00:50 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-11-03 07:32:19 ----D---- C:\Program Files\Google
2008-11-03 07:32:19 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2008-11-03 07:27:02 ----AC---- C:\WINDOWS\ntbtlog.txt
2008-11-02 07:39:54 ----D---- C:\WINDOWS\pss
2008-11-01 22:18:54 ----SHD---- C:\RECYCLER
2008-11-01 20:58:59 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-01 20:58:06 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-01 20:30:03 ----D---- C:\Documents and Settings
2008-11-01 20:25:42 ----D---- C:\Documents and Settings\Owner\Application Data\interMute
2008-11-01 20:24:40 ----SD---- C:\WINDOWS\Tasks
2008-11-01 20:24:20 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-11-01 20:23:30 ----D---- C:\Program Files\Symantec
2008-11-01 20:20:10 ----D---- C:\Program Files\AWS
2008-10-15 11:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-07 12:19:42 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-11-03 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-11-03 26824]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-08-29 12032]
R2 AvgTdiX;AVG Free8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-11-03 76040]
R2 MCSTRM;MCSTRM; C:\WINDOWS\system32\drivers\MCSTRM.sys [2006-03-18 8413]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\System32\drivers\tmcomm.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-10-01 2279424]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 ialm;ialm; C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [2004-08-20 737874]
R3 ltmodem5;Lucent Modem Driver; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [2003-03-08 624369]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2002-10-01 9856]
R3 Ps2;PS2; C:\WINDOWS\System32\DRIVERS\PS2.sys [2002-07-29 23808]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 AmdK7;AMD K7 Processor Driver; C:\WINDOWS\System32\DRIVERS\amdk7.sys [2008-04-13 37760]
S2 mrtRate;mrtRate; C:\WINDOWS\system32\drivers\mrtRate.sys []
S3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel® Graphics Platform (SoftBIOS) Driver; C:\WINDOWS\system32\drivers\ialmsbw.sys [2003-03-14 112288]
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel® Graphics Chipset (KCH) Driver; C:\WINDOWS\system32\drivers\ialmkchw.sys [2003-03-14 78496]
S3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 S3Psddr;S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [2004-08-04 166912]
S3 SiS315;SiS315; C:\WINDOWS\System32\DRIVERS\sisgrp.sys [2003-02-26 260736]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\DRIVERS\intelide.sys [2008-04-13 5504]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avg8emc;AVG Free8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-11-03 875288]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-11-03 231704]
R2 omniserv;Softex OmniPass Service; C:\Program Files\Softex\OmniPass\Omniserv.exe [2003-02-21 68704]
S2 NVSvc;NVIDIA Driver Helper Service; C:\WINDOWS\System32\nvsvc32.exe [2003-03-03 65536]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]

-----------------EOF-----------------

thank you,

Duckyfriends

#12
kahdah

Posted 07 November 2008 - 04:59 AM

GeekU Teacher

Retired Staff
15,822 posts

Please re-open Hijackthis and click on "Do a system scan only"
Then place a check mark next to these entries below:

O2 - BHO: (no name) - {7B548CB2-4968-4814-B155-69CEDBE009AE} - (no file)
O2 - BHO: (no name) - {A30B575B-0E87-446B-BB58-DD22D0F61DE0} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Now click on Fix Checked and then close Hijackthis.
==================================
Cleanup:

Please download OT CLeanit from Here save it to your desktop.
Double click on OT Clean it to run it.
Then click on Clean up.
Restart your computer when prompted.
This will remove what tools we used.
===============
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 10...allows end-users to run Java applications".
Click the "Download" button to the right.
Select your Platform: "Windows".
Select your Language: "Multi-language".
Read the License Agreement, and then check the box that says: "Accept License Agreement".
Click Continue and the page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u10-windows-i586-p.exe to install the newest version.

======================
Use a Firewall:

Install and use a firewall with outbound protection
While the firewall built into Windows XP is adequate to protect you from incoming attacks, it will not be much help in alerting you to programs already on your PC attempting to connect to remote servers
I therefore strongly recommend that you install one of the following free firewalls: Sunbelt Free Firewall or Zonealarm
See Bleepingcomputer's excellent tutorial to help using and understanding a firewall here
Note: You should only have one firewall installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as seriously impairing the performance of your PC.

=============================
Delete\uninstall anything else that we have used.

System Restore
Then I will need you to reset your System Restore points.
The link below shows how to create a clean restore point.
How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us

If you are using Vista then see this link > http://www.bleepingc...143.html#manual
=====================================
After that your log is clean.

The following is a list of tools and utilities that I like to suggest to people.
You do not have to have all or any of them they are only suggestions.
This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

Spybot Search & Destroy-Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

Spyware Blaster - Great prevention tool to keep nasties from installing on your system.

Spywareguard-Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.