fifiyigi.dll is not a valid Windows image. [RESOLVED] - Geeks to Go Forums

Jump to content

Log in Register Register Malware removal guide How it works

fifiyigi.dll is not a valid Windows image. [RESOLVED] Bad Image Errors

#1 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 12 November 2008 - 04:45 AM

Hello,

I'm having similar problems to this post: http://www.geekstogo.com/forum/hsaczx-dll-...ge-t216024.html

Just like them, a message window pops up every time I run a program/.exe file. Specifically it says the following:

"program i'm trying to run".exe - Bad Image

The Application or DLL C:\WINDOWS\system32\fifiyigi.dll is not a valid Windows image. Please check this against your installation diskette.


Another thing that seems a little odd is that two of these messages occur during startup before I even choose the Administrator log in option. These 2 .exe files are Services.exe and lsass.exe.

Can someone please help?!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:23:04 AM, on 11/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\PokerOffice\bin\javaw.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe
C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {ae54c9ef-926d-44c4-8086-9d9e9309ac04} - C:\WINDOWS\system32\ratagasu.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] "c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe"
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [SpywareBot] C:\Program Files\SpywareBot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe"
O4 - HKLM\..\Run: [POEngine] "C:\Program Files\PokerOffice\POEngine.exe" C:\Program Files\PokerOffice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IUpd721] "C:\Documents and Settings\HP_Administrator\Application Data\NI.GSCNS\IUpd721.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Walgreens PhotoShow Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [Universal Installer] "C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe" /fromrun /starthidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2009] "C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe" /S
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...IOS/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1131208051437
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv.view22.c...p/view22rte.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.gsu.edu/activex/AMC.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\fifiyigi.dll,C:\WINDOWS\system32\bewisape.dll
O20 - Winlogon Notify: yayyYQIA - yayyYQIA.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

#2 Rorschach112

  • Group: Retired Staff
  • Posts: 47,710
  • Joined: 23-March 07

Posted 12 November 2008 - 08:00 AM

Hello

Disable resident protections (Antivirus...); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)

#3 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 12 November 2008 - 03:16 PM

Done.

I also had the error message window pop up 3 times or so for every file scanned. Took ~15 mins so wasn't too bad, but maybe there is a better way.


--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )
BIOS : BIOS Date: 04/29/05 17:55:16 Ver: 08.00.10
USER : HP_Administrator ( Administrator )
BOOT : Normal boot
Antivirus : Norton Internet Security 2005 (Not Activated)
Firewall : Norton Internet Security 2005 (Not Activated)
C:\ (Local Disk) - NTFS - Total:179 Go (Free:28 Go)
D:\ (Local Disk) - FAT32 - Total:6 Go (Free:0 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
K:\ (USB)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Wed 11/12/2008|16:00 )

--------------------\\ Listing folders in APPLIC~1

[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Apple Computer
[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Identities
[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> InterMute
[08/21/2006|08:12] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Lavasoft
[08/22/2006|08:46] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Microsoft
[11/11/2008|05:00] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Mozilla
[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Real
[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> SampleView
[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Sun
[04/21/2005|02:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Symantec
[08/21/2006|07:58] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Webroot

[08/06/2007|03:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe
[09/18/2007|05:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple
[09/18/2007|05:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer
[03/03/2007|09:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> avg7
[11/11/2008|03:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Google Updater
[08/22/2006|08:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Grisoft
[04/21/2005|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Hewlett-Packard
[04/21/2005|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> InstallShield
[03/26/2006|10:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Intuit
[10/03/2008|11:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Lavasoft
[11/12/2008|12:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes
[08/15/2008|05:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft
[04/21/2005|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Motive
[11/07/2006|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> MSN6
[08/27/2005|12:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime
[04/21/2005|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SBSI
[07/10/2007|10:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> ScanSoft
[09/24/2008|02:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Soulseek
[07/10/2007|11:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SSScanAppDataDir
[07/10/2007|11:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SSScanWizard
[11/05/2005|01:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Symantec
[12/29/2006|09:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> TEMP
[11/07/2006|01:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Verizon
[03/21/2007|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Viewpoint
[07/13/2006|07:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Webroot
[11/05/2005|11:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage
[08/15/2008|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> WLInstaller
[09/07/2005|12:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> yahoo!

[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Apple Computer
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Identities
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> InterMute
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Real
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> SampleView
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Sun
[04/21/2005|02:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Symantec

[07/21/2008|07:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Adobe
[08/06/2007|03:25] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> AdobeUM
[08/28/2005|05:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Aim
[01/18/2008|11:36] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Apple Computer
[03/07/2006|07:52] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> ArcSoft
[11/12/2008|01:35] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> AVG7
[11/03/2008|05:06] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> BitTorrent
[07/11/2007|06:29] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Canon
[12/25/2006|05:38] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> DivX
[09/07/2008|03:40] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> DNA
[02/11/2006|08:41] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> G-Force
[11/17/2005|07:34] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Google
[09/06/2005|10:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Help
[04/21/2005|02:45] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Identities
[04/13/2007|10:22] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> InstallShield
[04/21/2005|02:45] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> InterMute
[05/20/2006|08:55] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> InterVideo
[03/26/2006|10:11] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Intuit
[11/10/2008|05:58] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> IUpd721
[09/16/2007|03:49] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Lavasoft
[10/15/2005|09:47] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Leadertech
[08/10/2005|07:19] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Macromedia
[11/12/2008|12:12] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Malwarebytes
[08/15/2008|05:24] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Microsoft
[02/17/2006|03:11] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Motive
[09/01/2008|11:00] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Mozilla
[11/07/2006|12:57] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> MSNInstaller
[12/29/2006|09:14] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> PC Tools
[03/26/2008|06:51] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Real
[04/21/2005|02:45] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> SampleView
[03/04/2006|01:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> ScanSoft
[07/15/2007|08:05] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Simple Star
[12/14/2007|01:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Snapfish
[10/15/2005|09:48] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Sonic
[04/21/2005|02:45] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Sun
[08/11/2005|05:45] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Symantec
[11/11/2008|12:20] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Uniblue
[10/10/2007|02:09] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> uTorrent
[11/07/2006|12:44] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Verizon
[03/21/2007|11:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Viewpoint
[11/08/2008|10:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Walgreens
[11/19/2005|10:03] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> Webroot
[09/07/2005|12:37] C:\DOCUME~1\HP_ADM~1\APPLIC~1\<DIR> yahoo!

[11/12/2008|10:48] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> AVG7
[08/22/2006|08:46] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft
[03/22/2008|08:39] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Mozilla
[11/19/2005|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Webroot

[08/22/2006|08:46] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft
[08/21/2006|07:56] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Webroot

[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> Apple Computer
[08/26/2006|03:49] C:\DOCUME~1\temp\APPLIC~1\<DIR> AVG7
[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> Identities
[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> InterMute
[12/17/2006|09:21] C:\DOCUME~1\temp\APPLIC~1\<DIR> Macromedia
[09/06/2006|07:34] C:\DOCUME~1\temp\APPLIC~1\<DIR> Microsoft
[05/24/2008|11:37] C:\DOCUME~1\temp\APPLIC~1\<DIR> Mozilla
[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> Real
[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> SampleView
[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> Sun
[04/21/2005|02:45] C:\DOCUME~1\temp\APPLIC~1\<DIR> Symantec
[12/17/2006|09:11] C:\DOCUME~1\temp\APPLIC~1\<DIR> Verizon
[08/26/2006|03:49] C:\DOCUME~1\temp\APPLIC~1\<DIR> Webroot

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/12/2008 06:00 AM][--a------] C:\WINDOWS\tasks\qdkjuglh.job
[11/08/2008 10:53 PM][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/12/2008 03:58 PM][--a------] C:\WINDOWS\tasks\Symantec NetDetect.job
[11/12/2008 02:00 AM][--a------] C:\WINDOWS\tasks\wrSpySweeper20060213233234.job
[11/10/2008 02:10 PM][--a------] C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - HP_Administrator.job
[11/12/2008 05:08 AM][--ah-----] C:\WINDOWS\tasks\SA.DAT
[08/10/2004 06:00 AM][-rah-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[08/06/2007|03:42] C:\Program Files\<DIR> Adobe
[02/23/2006|08:23] C:\Program Files\<DIR> AIM
[08/28/2005|05:44] C:\Program Files\<DIR> AOD
[08/13/2008|05:01] C:\Program Files\<DIR> Apple Software Update
[03/04/2006|01:33] C:\Program Files\<DIR> ArcSoft
[11/18/2007|09:57] C:\Program Files\<DIR> Ares Lite Edition
[04/23/2006|08:58] C:\Program Files\<DIR> AWS
[05/23/2006|08:10] C:\Program Files\<DIR> Axis Communications
[04/21/2005|02:47] C:\Program Files\<DIR> BackWeb
[07/22/2008|04:10] C:\Program Files\<DIR> BitTorrent
[05/20/2006|03:52] C:\Program Files\<DIR> Canon
[05/21/2008|01:22] C:\Program Files\<DIR> ComcastUI
[11/12/2008|05:10] C:\Program Files\<DIR> Common Files
[04/21/2005|02:49] C:\Program Files\<DIR> ComPlus Applications
[09/06/2005|06:40] C:\Program Files\<DIR> directx
[05/31/2008|11:40] C:\Program Files\<DIR> DivX
[08/30/2008|12:47] C:\Program Files\<DIR> DNA
[09/09/2005|07:15] C:\Program Files\<DIR> Easy Internet signup
[04/21/2005|02:49] C:\Program Files\<DIR> EnglishOtto
[11/11/2008|11:51] C:\Program Files\<DIR> ERUNT
[04/21/2005|02:49] C:\Program Files\<DIR> GemMaster
[08/05/2008|03:22] C:\Program Files\<DIR> Google
[08/22/2006|08:47] C:\Program Files\<DIR> Grisoft
[04/21/2005|02:49] C:\Program Files\<DIR> Help and Support Additions
[04/21/2005|02:49] C:\Program Files\<DIR> Hewlett-Packard
[04/21/2005|02:49] C:\Program Files\<DIR> HP
[11/07/2006|01:55] C:\Program Files\<DIR> InstallShield Installation Information
[04/21/2005|02:51] C:\Program Files\<DIR> IntelliMover Data Transfer Demo
[04/21/2005|02:51] C:\Program Files\<DIR> InterMute
[10/15/2008|02:11] C:\Program Files\<DIR> Internet Explorer
[04/21/2005|02:52] C:\Program Files\<DIR> InterVideo
[09/18/2007|05:24] C:\Program Files\<DIR> iPod
[05/09/2006|09:14] C:\Program Files\<DIR> IrfanView
[09/18/2007|05:24] C:\Program Files\<DIR> iTunes
[11/12/2008|01:30] C:\Program Files\<DIR> Java
[10/03/2008|11:10] C:\Program Files\<DIR> Lavasoft
[04/21/2005|02:53] C:\Program Files\<DIR> Macrovision Corp
[11/12/2008|12:12] C:\Program Files\<DIR> Malwarebytes' Anti-Malware
[09/10/2008|01:28] C:\Program Files\<DIR> Messenger
[04/21/2005|02:53] C:\Program Files\<DIR> Microsoft ActiveSync
[05/10/2007|02:05] C:\Program Files\<DIR> Microsoft CAPICOM 2.1.0.2
[04/21/2005|02:53] C:\Program Files\<DIR> microsoft frontpage
[09/16/2005|09:07] C:\Program Files\<DIR> Microsoft Office
[04/21/2005|02:53] C:\Program Files\<DIR> Microsoft Plus! Dancer LE
[04/21/2005|02:53] C:\Program Files\<DIR> Microsoft Plus! Digital Media Edition
[04/21/2005|02:53] C:\Program Files\<DIR> Microsoft Plus! Photo Story 2 LE
[04/21/2005|02:53] C:\Program Files\<DIR> Microsoft Visual Studio
[04/21/2005|02:54] C:\Program Files\<DIR> Microsoft Works
[04/21/2005|02:53] C:\Program Files\<DIR> Microsoft.NET
[09/10/2008|01:15] C:\Program Files\<DIR> Movie Maker
[11/12/2008|03:30] C:\Program Files\<DIR> Mozilla Firefox
[08/23/2005|11:39] C:\Program Files\<DIR> MSN
[04/21/2005|02:54] C:\Program Files\<DIR> MSN Encarta Standard
[04/21/2005|02:54] C:\Program Files\<DIR> MSN Gaming Zone
[10/17/2006|02:01] C:\Program Files\<DIR> MSXML 4.0
[04/21/2005|02:54] C:\Program Files\<DIR> muvee Technologies
[08/16/2007|09:00] C:\Program Files\<DIR> Netflix
[09/10/2008|01:04] C:\Program Files\<DIR> NetMeeting
[11/06/2006|07:58] C:\Program Files\<DIR> Norton Internet Security
[04/21/2005|02:54] C:\Program Files\<DIR> Online Services
[09/10/2008|01:03] C:\Program Files\<DIR> Outlook Express
[12/22/2006|09:25] C:\Program Files\<DIR> PartyGaming
[04/21/2005|02:56] C:\Program Files\<DIR> PC-Doctor for DOS
[04/21/2005|02:55] C:\Program Files\<DIR> PC-Doctor for Windows
[09/08/2007|09:03] C:\Program Files\<DIR> PFConfig
[11/07/2006|12:45] C:\Program Files\<DIR> PlayLinc
[03/30/2007|10:23] C:\Program Files\<DIR> PokerOffice
[11/12/2008|03:17] C:\Program Files\<DIR> PokerStars
[09/18/2007|05:22] C:\Program Files\<DIR> QuickTime
[04/21/2005|02:56] C:\Program Files\<DIR> Real
[03/04/2006|01:37] C:\Program Files\<DIR> ScanSoft
[04/21/2005|02:56] C:\Program Files\<DIR> Sonic
[04/21/2005|02:56] C:\Program Files\<DIR> Sonic RecordNow!
[09/24/2008|02:08] C:\Program Files\<DIR> Soulseek
[09/24/2008|02:08] C:\Program Files\<DIR> SoulseekNS
[02/11/2006|08:40] C:\Program Files\<DIR> SoundSpectrum
[12/29/2006|09:38] C:\Program Files\<DIR> Spyware Doctor
[11/05/2005|01:35] C:\Program Files\<DIR> Symantec
[11/05/2005|01:35] C:\Program Files\<DIR> SymNetDrv
[11/12/2008|05:22] C:\Program Files\<DIR> Trend Micro
[04/13/2007|10:22] C:\Program Files\<DIR> TurboTax
[04/21/2005|02:56] C:\Program Files\<DIR> Uninstall Information
[04/21/2005|02:56] C:\Program Files\<DIR> Updates from HP
[09/08/2007|08:46] C:\Program Files\<DIR> uTorrent
[11/07/2006|01:54] C:\Program Files\<DIR> Verizon
[04/30/2007|10:11] C:\Program Files\<DIR> View22
[01/11/2007|11:03] C:\Program Files\<DIR> Viewpoint
[11/07/2006|12:44] C:\Program Files\<DIR> VZBB Toolbar
[07/13/2007|09:40] C:\Program Files\<DIR> Walgreens
[08/22/2006|09:33] C:\Program Files\<DIR> Webroot
[12/22/2006|09:23] C:\Program Files\<DIR> WildTangent
[08/15/2008|05:22] C:\Program Files\<DIR> Windows Live
[09/10/2008|01:03] C:\Program Files\<DIR> Windows Media Player
[09/10/2008|01:03] C:\Program Files\<DIR> Windows NT
[04/21/2005|02:57] C:\Program Files\<DIR> Windows Plus
[04/21/2005|02:57] C:\Program Files\<DIR> WindowsUpdate
[04/21/2005|02:57] C:\Program Files\<DIR> xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[08/06/2007|03:43] C:\Program Files\Common Files\<DIR> Adobe
[03/26/2006|10:10] C:\Program Files\Common Files\<DIR> AnswerWorks 4.0
[09/23/2005|08:18] C:\Program Files\Common Files\<DIR> AOL
[09/18/2007|05:19] C:\Program Files\Common Files\<DIR> Apple
[11/07/2006|01:54] C:\Program Files\Common Files\<DIR> Command Software
[04/21/2005|02:47] C:\Program Files\Common Files\<DIR> DESIGNER
[04/21/2005|02:47] C:\Program Files\Common Files\<DIR> Hewlett-Packard
[04/21/2005|02:47] C:\Program Files\Common Files\<DIR> HP
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> InstallShield
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> InterVideo
[03/26/2006|10:09] C:\Program Files\Common Files\<DIR> Intuit
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> Java
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> L&H
[08/09/2005|09:52] C:\Program Files\Common Files\<DIR> LightScribe
[11/12/2008|12:19] C:\Program Files\Common Files\<DIR> Microsoft Shared
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> MSSoap
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> muvee Technologies
[09/28/2005|06:24] C:\Program Files\Common Files\<DIR> NSV
[09/28/2005|06:23] C:\Program Files\Common Files\<DIR> Nullsoft
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> ODBC
[11/07/2006|01:54] C:\Program Files\Common Files\<DIR> PestPatrol
[12/11/2005|07:10] C:\Program Files\Common Files\<DIR> Real
[03/04/2006|01:37] C:\Program Files\Common Files\<DIR> ScanSoft Shared
[04/21/2005|02:49] C:\Program Files\Common Files\<DIR> Services
[07/13/2007|09:40] C:\Program Files\Common Files\<DIR> Simple Star Shared
[04/21/2005|02:48] C:\Program Files\Common Files\<DIR> SpeechEngines
[05/21/2008|01:22] C:\Program Files\Common Files\<DIR> SupportSoft
[04/21/2005|02:49] C:\Program Files\Common Files\<DIR> SureThing Shared
[12/29/2006|09:11] C:\Program Files\Common Files\<DIR> Symantec Shared
[09/10/2008|01:03] C:\Program Files\Common Files\<DIR> System
[08/15/2008|05:21] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller
[10/03/2008|11:09] C:\Program Files\Common Files\<DIR> Wise Installation Wizard
[12/11/2005|07:10] C:\Program Files\Common Files\<DIR> xing shared

--------------------\\ Process

( 80 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrator@advertising[1].txt
C:\DOCUME~1\HP_ADM~1\Cookies\hp_administrator@adopt.euroclick[2].txt

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN


--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-12 16:06:15
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections

C:\WINDOWS\system32\oqtss.bak2
==> VUNDO <==

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\HP_ADM~1\My Documents\My Music\iTunes\iTunes Music\The Dogs\The Dogs\10 Crack Rock.m4p
C:\DOCUME~1\HP_ADM~1\My Documents\My Music\soulseek files\Push Button Objects - 2000 - Dirty Dozen\05 - Chewbacca On Crack.mp3


[F:470][D:73]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp
[F:202][D:0]-> C:\DOCUME~1\HP_ADM~1\Cookies
[F:32105][D:75]-> C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Wed 11/12/2008|16:13 - Option : [1]

--------------------\\ Scan completed at 16:13:21

#4 Rorschach112

  • Group: Retired Staff
  • Posts: 47,710
  • Joined: 23-March 07

Posted 12 November 2008 - 03:32 PM

Hello

Please download the OTMoveIt3 by OldTimer or from here.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services

:Reg

:Files
C:\WINDOWS\tasks\qdkjuglh.job
C:\WINDOWS\system32\oqtss.bak2

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]


  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.

  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.




Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.
  • Open the OTScanIt2 folder and double-click on OTScanIt.exe to start the program.
  • Under File Age at the top, change it from 30 days to 90 days
  • Under Additional Scans check the boxes beside Reg - ColumnHandlers, Reg - Desktop Components, Reg - Disabled MS Config Items, Reg - File Associations, Reg - NetSvcs, Reg - Protocol Filters, Reg - Protocol Handlers, Reg - Session Manager Settings, Reg - Winsock2 Catalogs, File - Lop Check, File - Purity Scan, Files - Signature Check, and Evnt - EventViewer Logs ( Last 10 Errors).
  • Under Rootkit Search change it to Yes
  • Now click the Run Scan button on the toolbar.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.


Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way

#5 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 12 November 2008 - 06:12 PM

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\WINDOWS\tasks\qdkjuglh.job moved successfully.
C:\WINDOWS\system32\oqtss.bak2 moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator\2748 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\etilqs_v3RbfkuX1lPnkPIcnbah scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\JETC665.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11122008_182147

Files moved on Reboot...
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator\2748 not found!
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\etilqs_v3RbfkuX1lPnkPIcnbah not found!
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll moved successfully.
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\JETC665.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\XUL.mfl moved successfully.

Attached File(s)


#6 Rorschach112

  • Group: Retired Staff
  • Posts: 47,710
  • Joined: 23-March 07

Posted 12 November 2008 - 06:37 PM

You have two anti-virus programs, AVG and Norton, you need to remove one of these

Start OTScanIt2. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Quote

[Kill Explorer]
[Unregister Dlls]
[Processes - Safe List]
YN -> aawservice.exe -> %ProgramFiles%\Lavasoft\Ad-Aware\aawservice.exe
YN -> spysweeper.exe -> %ProgramFiles%\Webroot\Spy Sweeper\SpySweeper.exe
YN -> alcmtr.exe -> %SystemRoot%\ALCMTR.EXE
YN -> ssu.exe -> %ProgramFiles%\Webroot\Spy Sweeper\ssu.exe
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {7E853D72-626A-48EC-A868-BA8D5E23E045} [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
YN -> {ae54c9ef-926d-44c4-8086-9d9e9309ac04} [HKLM] -> %SystemRoot%\system32\ratagasu.dll [Reg Error: Value does not exist or could not be read.]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "" [HKLM] -> Reg Error: Key does not exist or could not be opened. [ScriptInocUI Class]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Alcmtr" -> %SystemRoot%\ALCMTR.EXE [ALCMTR.EXE]
YN -> "ccApp" -> %CommonProgramFiles%\Symantec Shared\ccApp.exe ["C:\Program Files\Common Files\Symantec Shared\ccApp.exe"]
YN -> "IUpd721" -> %AppData%\NI.GSCNS\IUpd721.exe ["C:\Documents and Settings\HP_Administrator\Application Data\NI.GSCNS\IUpd721.exe"]
YN -> "SpywareBot" -> %ProgramFiles%\SpywareBot\SpywareBot.exe [C:\Program Files\SpywareBot\SpywareBot.exe -boot]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Uniblue RegistryBooster 2009" -> %ProgramFiles%\Uniblue\RegistryBooster\RegistryBooster.exe ["C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe" /S]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\"{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}" [HKLM] -> [Reg Error: Key does not exist or could not be opened.]
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
*AppInit_DLLs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls
YY -> C:\WINDOWS\system32\fifiyigi.dll -> %SystemRoot%\system32\fifiyigi.dll
YY -> C:\WINDOWS\system32\bewisape.dll -> %SystemRoot%\system32\bewisape.dll
< AppInit_DLLs [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YN -> yayyYQIA ->
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
YN -> "{9F8BEE99-CECA-4E03-8159-1112F26F06DB}" [HKLM] -> %SystemRoot%\system32\yayyYQIA.dll []
YN -> "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [SpySubtract Shell Extension]
[Files/Folders - Created Within 90 Days]
NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
NY -> 3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
NY -> _OTMoveIt -> %SystemDrive%\_OTMoveIt
NY -> OTMoveIt3.exe -> %UserProfile%\Desktop\OTMoveIt3.exe
NY -> Lop SD -> %SystemDrive%\Lop SD
NY -> LopSD.exe -> %UserProfile%\Desktop\LopSD.exe
NY -> HJTInstall.exe -> %UserProfile%\Desktop\HJTInstall.exe
NY -> erunt_setup.exe -> %UserProfile%\Desktop\erunt_setup.exe
NY -> SysRestorePoint_v13 -> %UserProfile%\Desktop\SysRestorePoint_v13
NY -> SysRestorePoint_v13.zip -> %UserProfile%\Desktop\SysRestorePoint_v13.zip
NY -> SDFix -> %SystemDrive%\SDFix
NY -> SDFix.exe -> %UserProfile%\Desktop\SDFix.exe
NY -> IUpd721 -> %AppData%\IUpd721
NY -> AX5 -> %SystemRoot%\System32\AX5
NY -> uvm -> %SystemRoot%\System32\uvm
NY -> db -> %SystemRoot%\System32\db
NY -> u2 -> %SystemRoot%\System32\u2
NY -> sX3i19 -> %SystemRoot%\System32\sX3i19
[File - Lop Check]
NY -> Viewpoint -> C:\Documents and Settings\All Users\Application Data\Viewpoint
[Empty Temp Folders]
[Start Explorer]
[Reboot]


The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here

I will review the information when it comes back in.



Also post a new HJT log

#7 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 12 November 2008 - 07:07 PM

Which one do you recommend I remove, and how? Can I just disable one? If you don't have a recommendation I would lean towards removing Norton, since it seemed to cause it's own problems with my system in the past. But, I'm not sure exactly how to remove it.

Should I remove it before I run the OTScanIt2?

#8 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 12 November 2008 - 08:21 PM

I went ahead with the Fix & Scan. The respective logfiles are shown below:

Explorer killed successfully
[Processes - Safe List]
Unable to kill process aawservice.exe .
Unable to kill process spysweeper.exe .
Process alcmtr.exe killed successfully.
Unable to kill process ssu.exe .
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae54c9ef-926d-44c4-8086-9d9e9309ac04}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae54c9ef-926d-44c4-8086-9d9e9309ac04}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\ccApp deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\IUpd721 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SpywareBot deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Uniblue RegistryBooster 2009 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2D663D1A-8670-49D9-A1A5-4C56B4E14E84}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\WINDOWS\system32\fifiyigi.dll deleted successfully.
LoadLibrary failed for C:\WINDOWS\system32\fifiyigi.dll
C:\WINDOWS\system32\fifiyigi.dll NOT unregistered.
C:\WINDOWS\system32\fifiyigi.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\WINDOWS\system32\bewisape.dll deleted successfully.
File C:\WINDOWS\system32\bewisape.dll not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyYQIA\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{9F8BEE99-CECA-4E03-8159-1112F26F06DB} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F8BEE99-CECA-4E03-8159-1112F26F06DB}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{FA010552-4A27-4cb1-A1BB-3E2D697F1639} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA010552-4A27-4cb1-A1BB-3E2D697F1639}\ not found.
[Files/Folders - Created Within 90 Days]
C:\_OTMoveIt\MovedFiles\11122008_182147\WINDOWS\tasks folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\WINDOWS\system32 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\WINDOWS folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\DOCUME~1\HP_ADM~1\LOCALS~1\Temp folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\DOCUME~1\HP_ADM~1\LOCALS~1 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\DOCUME~1\HP_ADM~1 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\DOCUME~1 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temporary Internet Files folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5 folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temp\History folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temp\Cookies folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings\Temp folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService\Local Settings folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\LocalService folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings\Application Data folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator\Local Settings folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings\HP_Administrator folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147\Documents and Settings folder moved successfully.
C:\_OTMoveIt\MovedFiles\11122008_182147 folder moved successfully.
C:\_OTMoveIt\MovedFiles folder moved successfully.
C:\_OTMoveIt folder moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\OTMoveIt3.exe moved successfully.
C:\Lop SD folder moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\LopSD.exe moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\HJTInstall.exe moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\erunt_setup.exe moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\SysRestorePoint_v13 folder moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\SysRestorePoint_v13.zip moved successfully.
C:\SDFix\backups folder moved successfully.
C:\SDFix\apps\Replace\xp folder moved successfully.
C:\SDFix\apps\Replace\w2k folder moved successfully.
C:\SDFix\apps\Replace folder moved successfully.
C:\SDFix\apps folder moved successfully.
C:\SDFix folder moved successfully.
C:\Documents and Settings\HP_Administrator\Desktop\SDFix.exe moved successfully.
C:\Documents and Settings\HP_Administrator\Application Data\IUpd721\Logs folder moved successfully.
C:\Documents and Settings\HP_Administrator\Application Data\IUpd721 folder moved successfully.
C:\WINDOWS\System32\AX5 folder moved successfully.
C:\WINDOWS\System32\uvm folder moved successfully.
C:\WINDOWS\System32\db folder moved successfully.
C:\WINDOWS\System32\u2 folder moved successfully.
C:\WINDOWS\System32\sX3i19 folder moved successfully.
[File - Lop Check]
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9Plus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Media Player folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\hsperfdata_HP_Administrator\1764 scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\etilqs_4c5ootbupZkhsa3CK6lr scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\IadHide5.dll scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Temp\JET5BA4.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
RecycleBin -> emptied.
Explorer started successfully
< End of fix log >
OTScanIt2 by OldTimer - Version 1.0.0.33b fix logfile created on 11122008_210214

Files moved on Reboot...
File C:\Documents and Settings\HP_Administrator\Local Settings\Temp\hsperfdata_HP_Administrator\1764 not found!
File C:\Documents and Settings\HP_Administrator\Local Settings\Temp\etilqs_4c5ootbupZkhsa3CK6lr not found!
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\hpodvd09.log moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\IadHide5.dll moved successfully.
File C:\Documents and Settings\HP_Administrator\Local Settings\Temp\JET5BA4.tmp not found!
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\XUL.mfl moved successfully.

hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:40 PM, on 11/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\PokerOffice\bin\javaw.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe
C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] "c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe"
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe"
O4 - HKLM\..\Run: [POEngine] "C:\Program Files\PokerOffice\POEngine.exe" C:\Program Files\PokerOffice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Walgreens PhotoShow Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [Universal Installer] "C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe" /fromrun /starthidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...IOS/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1131208051437
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv.view22.c...p/view22rte.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.gsu.edu/activex/AMC.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 14406 bytes

this fix did stop the bad image error windows from popping up. it seems like the random website pop ups ended some time ago, with exception of one. A trendmicro website still pops up just after startup only. what's next?

#9 Rorschach112

  • Group: Retired Staff
  • Posts: 47,710
  • Joined: 23-March 07

Posted 13 November 2008 - 07:21 AM

Download and run the norton removal tool

http://service1.symantec.com/Support/tsgen...005033108162039



Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.



Go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases

  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

#10 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 13 November 2008 - 02:21 PM

I've noticed two new things happening that I haven't seen before. When I try to open Norton to determine what version I have a window pops up saying: Please wait while windows configures ccCommon. This process never seems to be able to finish and after waiting about a minute a new window pops up saying: The feature you are trying to use is on a CD-ROM or other removable disk that is not available. Insert the 'ccCommon disk and click OK. When I cancel that out it says: Error 1706. No Valid source could be found for product ccCommon. Windows Installer cannot continue. Oddly enough if I cancel out the initial window another pops up and then if i cancel that out the Norton Security Center opens like normal.

Also when I right click on a picture a window pops up saying: Please wait while Windows configures OmniPage SE. Again this process isn't able to finish and the same 2nd window pops up saying the same as above. And, just like the previous if I quickly cancel out the initial window the right-click options come up like normal.

That being said, I did open Norton and it just says I'm using AVG as my antivirus protection. I can't find anywhere that says I also have Norton antivirus enabled. Please advise.

I'm going to go ahead with the other steps you mentioned.

#11 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 13 November 2008 - 07:29 PM

Malwarebytes' Anti-Malware 1.30
Database version: 1395
Windows 5.1.2600 Service Pack 3

11/13/2008 3:34:57 PM
mbam-log-2008-11-13 (15-34-57).txt

Scan type: Quick Scan
Objects scanned: 88969
Time elapsed: 36 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Kaspersky results attached.

Attached File(s)


#12 Rorschach112

  • Group: Retired Staff
  • Posts: 47,710
  • Joined: 23-March 07

Posted 13 November 2008 - 07:32 PM

Did you run the norton removal tool like I said ?

Please download the OTMoveIt3 by OldTimer or from here.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services

:Reg

:Files
C:\Documents and Settings\HP_Administrator\My Documents\My Music\soulseek files\Conor Oberst - Conor Oberst\03 Get-Well-Cards.mp3	
C:\temp\cnsP744.exe	
C:\temp\cnsP744.exe	
C:\temp\cnsP744.exe	
C:\temp\cnsP744.exe	
C:\WINDOWS\Downloaded Program Files\vzbb.dll	
C:\WINDOWS\zwinvite.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]


  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.

  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.




  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

#13 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 13 November 2008 - 07:42 PM

No, I did not run the removal tool. I can't find the product key, so what should I do? Do I have to remove it? What do I gain?

I will move on to your next instructions and await your response on the Norton issues.

#14 Rorschach112

  • Group: Retired Staff
  • Posts: 47,710
  • Joined: 23-March 07

Posted 13 November 2008 - 07:45 PM

You said you wanted to remove it I thought ? You don't need the product key as far as I know

You have to remove AVG or norton, my preference is to remove Norton

#15 eebrew

  • Group: Member
  • Posts: 11
  • Joined: 12-November 08

Posted 13 November 2008 - 08:03 PM

Alright I will skip those steps in the removal process and try to remove Norton.

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Documents and Settings\HP_Administrator\My Documents\My Music\soulseek files\Conor Oberst - Conor Oberst\03 Get-Well-Cards.mp3 moved successfully.
C:\temp\cnsP744.exe moved successfully.
File/Folder C:\temp\cnsP744.exe not found.
File/Folder C:\temp\cnsP744.exe not found.
File/Folder C:\temp\cnsP744.exe not found.
C:\WINDOWS\Downloaded Program Files\vzbb.dll unregistered successfully.
C:\WINDOWS\Downloaded Program Files\vzbb.dll moved successfully.
C:\WINDOWS\zwinvite.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Arj.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\avlib.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Avp1.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\AvpMgr.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\btimages.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\CAB.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\dmap.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\dtreg.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\FsDrvPlg.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\FSSync.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\HashCont.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\HashMD5.PPL scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\HCCMP.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\ichk2.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\iChkSA.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Inflate.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\IWGen.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kave.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kosglue-7.0.25.0.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\lha.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\L_llio.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\mdb.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MDMAP.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MemModSc.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MemScan.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\minizip.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MKavIO.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\msoe.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\nfio.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\NTFSstrm.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prKernel.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prLoader.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prseqio.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\PrUtil.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Quantum.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\rar.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\ScanningProcess.exe scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\sfdb.PPL scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\TempFile.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\thpimpl.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\UniArc.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\UnLZX.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\UnStored.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\WDiskIO.ppl scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator\276 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator\5616 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\etilqs_7hzbjbnYeukUruZa3vhd scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\JET7D7.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\14\757e808e-674412a9 scheduled to be deleted on reboot.
Java cache emptied.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11132008_204412

Files moved on Reboot...
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Arj.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\avlib.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Avp1.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\AvpMgr.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\btimages.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\CAB.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\dmap.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\dtreg.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\FsDrvPlg.ppl moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\FSSync.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\FSSync.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\FSSync.dll moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\HashCont.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\HashMD5.PPL moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\HCCMP.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\ichk2.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\iChkSA.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Inflate.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\IWGen.ppl moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kave.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kave.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kave.dll moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kosglue-7.0.25.0.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kosglue-7.0.25.0.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\kosglue-7.0.25.0.dll moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\lha.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\L_llio.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\mdb.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MDMAP.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MemModSc.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MemScan.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\minizip.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\MKavIO.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\msoe.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\nfio.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\NTFSstrm.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prKernel.ppl moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prLoader.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prLoader.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prLoader.dll moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\prseqio.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\PrUtil.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\Quantum.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\rar.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\ScanningProcess.exe moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\sfdb.PPL moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\TempFile.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\thpimpl.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\UniArc.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\UnLZX.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\UnStored.ppl moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\jkos-HP_Administrator\binaries\WDiskIO.ppl moved successfully.
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator\276 not found!
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hsperfdata_HP_Administrator\5616 not found!
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\etilqs_7hzbjbnYeukUruZa3vhd not found!
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll moved successfully.
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\JET7D7.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be moved on reboot.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\14\757e808e-674412a9 moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\dj8g4qkz.default\urlclassifier3.sqlite moved successfully.



Logfile of random's system information tool 1.04 (written by random/random)
Run by HP_Administrator at 2008-11-13 21:02:26
Microsoft Windows XP Professional Service Pack 3
System drive C: has 30 GB (16%) free of 184 GB
Total RAM: 1015 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:02:41 PM, on 11/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe
C:\Program Files\PokerOffice\bin\javaw.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe
C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\HP_Administrator\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\HP_Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [HPHUPD06] "c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe"
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe"
O4 - HKLM\..\Run: [POEngine] "C:\Program Files\PokerOffice\POEngine.exe" C:\Program Files\PokerOffice
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Walgreens PhotoShow Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKCU\..\Run: [Universal Installer] "C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe" /fromrun /starthidden
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...IOS/tgctlcm.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1131208051437
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv.view22.c...p/view22rte.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://webcam.gsu.edu/activex/AMC.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 14249 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - HP_Administrator.job
C:\WINDOWS\tasks\Symantec NetDetect.job
C:\WINDOWS\tasks\wrSpySweeper20060213233234.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
CNisExtBho Class - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll [2004-08-30 103568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - HP view - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll [2003-11-21 98304]
{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - Norton Internet Security - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll [2004-08-30 103568]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2005-10-19 218736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2004-08-10 59392]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"hpsysdrv"=c:\windows\system\hpsysdrv.exe [1998-05-07 52736]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAudPropShortcut.exe [2004-03-17 61952]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2004-12-01 126976]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2004-06-29 88363]
"HPHUPD06"=c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe [2004-06-07 49152]
"HPHmon06"=C:\WINDOWS\system32\hphmon06.exe [2004-06-07 659456]
"KBD"=C:\HP\KBD\KBD.EXE [2003-02-11 61440]
"Recguard"=C:\WINDOWS\SMINST\RECGUARD.EXE [2004-04-14 233472]
"PS2"=C:\WINDOWS\system32\ps2.exe [2004-10-25 90112]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-10-13 77824]
"AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2004-10-13 2742272]
"LSBWatcher"=c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe [2004-10-14 253952]
"Reminder"=C:\Windows\Creator\Remind_XP.exe [2004-12-13 663552]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe [2005-11-05 100056]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2005-12-11 180269]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"=C:\Program Files\Google\Gmail Notifier\gnotify.exe [2005-07-15 479232]
"OpwareSE2"=C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [2003-05-08 49152]
"AVG7_CC"=C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe [2008-10-25 590848]
"VerizonServicepoint.exe"=C:\Program Files\Verizon\Servicepoint\VerizonServicepoint.exe [2006-02-01 1880064]
"POEngine"=C:\Program Files\PokerOffice\POEngine.exe [2005-07-13 18944]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-05-11 40048]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2007-06-29 286720]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2007-09-14 267064]
"SpySweeper"=C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 5367664]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"Walgreens PhotoShow Media Manager"=C:\PROGRA~1\WALGRE~1\WALGRE~1\data\xtras\mssysmgr.exe [2006-04-20 237568]
"AdobeUpdater"=C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [2007-03-01 2321600]
"Universal Installer"=C:\Program Files\ComcastUI\Universal Installer\uinstaller.exe [2008-03-18 984616]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
SpySubtract.lnk - C:\Program Files\InterMute\SpySubtract\sslaunch.exe
Updates from HP.lnk - C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxsrvc.dll [2004-12-01 348160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
C:\WINDOWS\system32\WRLogonNTF.dll [2008-01-04 219504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-13 239616]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\WINDOWS\system32\fifiyigi.dll
C:\WINDOWS\system32\bewisape.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\svcWRSSSDK]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WebrootSpySweeperService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe"="C:\Program Files\Updates from HP\309731\Program\Updates from HP.exe:*:Enabled:BackWeb for Pavilion"
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"="C:\Program Files\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\Program Files\Grisoft\AVG Free\avginet.exe"="C:\Program Files\Grisoft\AVG Free\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG Free\avgemc.exe"="C:\Program Files\Grisoft\AVG Free\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\Grisoft\AVG Free\avgcc.exe"="C:\Program Files\Grisoft\AVG Free\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\Grisoft\AVG Free\avgamsvr.exe"="C:\Program Files\Grisoft\AVG Free\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%ProgramFiles%\iTunes\iTunes.exe"="%ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480


======List of files/folders created in the last 1 months======

2008-11-13 21:02:26 ----D---- C:\rsit
2008-11-13 20:44:12 ----D---- C:\_OTMoveIt
2008-11-12 21:07:15 ----D---- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-11-12 21:02:14 ----D---- C:\_OTScanIt
2008-11-12 16:00:00 ----A---- C:\lopR.txt
2008-11-12 15:42:44 ----A---- C:\WINDOWS\system32\MRT.exe
2008-11-12 15:42:12 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-11-12 15:39:48 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-11-12 15:37:25 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-11-12 05:22:30 ----D---- C:\Program Files\Trend Micro
2008-11-12 01:32:27 ----A---- C:\WINDOWS\system32\javaws.exe
2008-11-12 01:32:27 ----A---- C:\WINDOWS\system32\javaw.exe
2008-11-12 01:32:27 ----A---- C:\WINDOWS\system32\java.exe
2008-11-12 00:12:54 ----D---- C:\Documents and Settings\HP_Administrator\Application Data\Malwarebytes
2008-11-12 00:12:27 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-12 00:12:27 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-11 23:51:59 ----D---- C:\WINDOWS\ERDNT
2008-11-11 23:50:28 ----D---- C:\Program Files\ERUNT
2008-11-11 17:05:18 ----D---- C:\WINDOWS\ERUNT
2008-11-11 00:20:51 ----D---- C:\Documents and Settings\HP_Administrator\Application Data\Uniblue
2008-10-24 02:00:38 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-15 02:12:18 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-15 02:12:03 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-15 02:11:46 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-15 02:05:45 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-15 02:05:21 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$

======List of files/folders modified in the last 1 months======

2008-11-13 21:02:34 ----D---- C:\WINDOWS\Prefetch
2008-11-13 21:00:27 ----D---- C:\WINDOWS\Temp
2008-11-13 20:57:24 ----D---- C:\Program Files\Mozilla Firefox
2008-11-13 20:54:45 ----D---- C:\WINDOWS
2008-11-13 20:51:39 ----D---- C:\Program Files\Common Files
2008-11-13 20:51:39 ----D---- C:\Program Files
2008-11-13 20:50:04 ----D---- C:\WINDOWS\Registration
2008-11-13 20:47:21 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-13 20:47:16 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-13 20:44:15 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-13 20:44:13 ----D---- C:\temp
2008-11-13 19:14:57 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-11-13 14:54:46 ----SHD---- C:\WINDOWS\Installer
2008-11-13 14:54:02 ----HD---- C:\Config.Msi
2008-11-13 14:24:12 ----RSHD---- C:\WINDOWS\system32\dllcache
2008-11-13 14:24:05 ----D---- C:\WINDOWS\system32
2008-11-13 14:24:04 ----HD---- C:\WINDOWS\inf
2008-11-13 14:24:04 ----D---- C:\WINDOWS\Help
2008-11-13 00:44:56 ----D---- C:\Documents and Settings\HP_Administrator\Application Data\BitTorrent
2008-11-12 20:29:49 ----D---- C:\Program Files\PokerStars
2008-11-12 18:55:37 ----RHD---- C:\$VAULT$.AVG
2008-11-12 18:21:47 ----SD---- C:\WINDOWS\Tasks
2008-11-12 15:42:15 ----D---- C:\WINDOWS\system32\drivers
2008-11-12 15:42:06 ----HD---- C:\WINDOWS\$hf_mig$
2008-11-12 15:40:03 ----A---- C:\WINDOWS\imsins.BAK
2008-11-12 15:36:19 ----D---- C:\WINDOWS\WinSxS
2008-11-12 01:35:51 ----D---- C:\Documents and Settings\HP_Administrator\Application Data\AVG7
2008-11-12 01:30:39 ----D---- C:\Program Files\Java
2008-11-12 00:19:24 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-12 00:08:12 ----RASH---- C:\boot.ini
2008-11-12 00:08:12 ----A---- C:\WINDOWS\win.ini
2008-11-12 00:08:11 ----A---- C:\WINDOWS\system.ini
2008-11-11 19:53:43 ----SHD---- C:\System Volume Information
2008-11-11 19:53:43 ----D---- C:\WINDOWS\system32\Restore
2008-11-11 17:23:28 ----A---- C:\WINDOWS\ntbtlog.txt
2008-11-11 15:40:14 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-08 22:37:44 ----D---- C:\Documents and Settings\HP_Administrator\Application Data\Walgreens
2008-10-15 11:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-15 02:11:16 ----D---- C:\Program Files\Internet Explorer
2008-10-15 02:10:53 ----D---- C:\WINDOWS\ie7updates

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Avg7Core;AVG7 Kernel; C:\WINDOWS\System32\Drivers\avg7core.sys [2007-11-16 821856]
R1 Avg7RsW;AVG7 Wrap Driver; C:\WINDOWS\System32\Drivers\avg7rsw.sys [2007-01-02 4224]
R1 Avg7RsXP;AVG7 Resident Driver XP; C:\WINDOWS\System32\Drivers\avg7rsxp.sys [2007-02-25 27776]
R1 AvgClean;AVG7 Clean Driver; C:\WINDOWS\System32\Drivers\avgclean.sys [2007-12-21 10760]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2005-04-05 267192]
R2 AvgTdi;AVG Network Redirector; C:\WINDOWS\System32\Drivers\avgtdi.sys [2007-01-02 4960]
R2 CSS DVP;CSS DVP; C:\WINDOWS\system32\DRIVERS\css-dvp.sys [2006-01-20 783984]
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2004-06-29 1268204]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2006-09-19 15664]
R3 hcwPP2;Hauppauge WinTV PVR PCI II ([23|25|26]xxx); C:\WINDOWS\system32\DRIVERS\hcwPP2.sys [2004-11-11 131840]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2004-12-01 776637]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2004-10-13 2287104]
R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-11 21060]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061101.019\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061101.019\NavEx15.Sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
R3 Ps2;PS2; C:\WINDOWS\system32\DRIVERS\PS2.sys [2001-06-04 14112]
R3 rtl8139;Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver; C:\WINDOWS\system32\DRIVERS\R8139n51.SYS [2002-10-04 46976]
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []
R3 SSKBFD;Webroot Spy Sweeper Keylogger Shield Keyboard Filter; C:\WINDOWS\System32\Drivers\sskbfd.sys [2008-01-04 23920]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2005-04-05 11512]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2005-04-05 173208]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2005-04-05 36984]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20061025.029\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2005-04-05 47192]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2005-04-05 17976]
R3 usbccgp;Microsoft USB Generic Parent Driver

Share this topic:


  • 2 Pages +
  • 1
  • 2