Logfile of random's system information tool 1.04 (written by random/random)
Run by User at 2008-12-04 20:16:18
Microsoft Windows XP Professional Service Pack 2
System drive C: has 27 GB (36%) free of 76 GB
Total RAM: 1023 MB (53% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:16 PM, on 12/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Razer\Copperhead\razertra.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Transparent Windows\Transparent.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Windows\system32\wscntfy.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\User\Desktop\RSIT.exe
C:\Documents and Settings\User\Desktop\User.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {069ECBF8-2D70-43E7-8A54-29B1BE82E2B4} - (no file)
O2 - BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - C:\PROGRA~1\IDA\idaiehlp.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {CD869B0E-7699-2631-B45F-5B17566E21C8} - (no file)
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: IDA Bar - {C70E30C7-140A-4166-A2E8-43557E62B41A} - C:\Program Files\IDA\idabar.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [System Files Updater] C:\Windows\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Transparent Windows.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: >>> FREE PORN GALLERIES <<< - java script:{document.location='http://sexmaxx.com/freegalleries.htm';}
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download ALL with IDA - C:\Program Files\IDA\idaieall.htm
O8 - Extra context menu item: Download with IDA - C:\Program Files\IDA\idaie.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Windows\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - C:\Program Files\IDA\ida.exe
O9 - Extra 'Tools' menuitem: &Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - C:\Program Files\IDA\ida.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Windows\System32\shdocvw.dll (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader -
http://www.miniclip....tgameloader.cabO16 - DPF: {00001016-A15C-11D4-97A4-0050BF0FBE67} (NetmarbleStarter16 Class) -
http://www.netmarble...NMStarter16.cabO16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -
http://www.pcpitstop...cpConnCheck.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {32ECCE1D-F91E-413F-AFF3-BA477CF0C9C6} (IMBCControl Control) -
http://touch.imbc.co...lineService.cabO16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) -
https://www.e-games....GamesPlugin.cabO16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) -
http://www.acclaim.c.../acclaim_v5.cabO16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) -
http://www.spgame.co...game/msxml4.cabO16 - DPF: {89981B1D-07DA-43C3-9770-06C51E7E5DCE} (NostaleWebStarter Control) -
http://game.nostale....WebLauncher.cabO16 - DPF: {92E82FBB-DA00-41E0-ABFE-95482E21A4F6} (NMTransX Module) -
http://download.netm...tX/NMTransX.cabO16 - DPF: {938527D1-CDB7-4147-998A-B20FCA5CC976} -
http://cafeimg.hanma...ersion=1,0,0,10O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} -
http://gamedownload....GPlugin7USA.cabO16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} -
http://www.crucial.c.../cpcScanner.cabO16 - DPF: {ADCC68D4-AAEA-4338-817D-1F261D9FB759} (ENetLauncher Control) -
http://www.dragongem...NetLauncher.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
http://messenger.msn...pDownloader.cabO16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} -
http://gamedownload....GPlugin9USA.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.m...ash/swflash.cabO16 - DPF: {E75386B4-C629-11DB-8338-444553544200} (PcubeSet Class) -
http://cyimg7.cyworl...ge/cyinstal.cabO16 - DPF: {F707D836-1E2B-4ADD-94BB-24E6CAF11A1A} (IMBCCaptionDumy Control) -
http://caption.imbc....IMBCCaption.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: controlrandom - controlrandom.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Data Files Manager Service (msclcosd) - Unknown owner - C:\Windows\system32\msclco.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10877 bytes
======Scheduled tasks folder======
C:\Windows\tasks\AppleSoftwareUpdate.job
C:\Windows\tasks\CAAntiSpywareScan_Daily as User at 7 16 PM.job
C:\Windows\tasks\Uniblue SpeedUpMyPC Nag.job
C:\Windows\tasks\Uniblue SpeedUpMyPC.job
C:\Windows\tasks\Uniblue SpyEraser.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{069ECBF8-2D70-43E7-8A54-29B1BE82E2B4}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A646672-9C3A-4C28-9A7A-1FB0F63F28B6}]
IE 4.x-6.x BHO for Internet Download Accelerator - C:\PROGRA~1\IDA\idaiehlp.dll [2006-11-24 68096]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2007-07-31 1933256]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-19 320920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CD869B0E-7699-2631-B45F-5B17566E21C8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-19 34816]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{C70E30C7-140A-4166-A2E8-43557E62B41A} - IDA Bar - C:\Program Files\IDA\idabar.dll [2005-08-08 61440]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2007-07-31 1933256]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Smapp"=C:\Program Files\Analog Devices\SoundMAX\Smtray.exe [2002-06-26 90112]
"DeadAIM"=C:\PROGRA~1\AIM\\DeadAIM.ocm [2003-06-19 116224]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-05-02 13529088]
"razer"=C:\Program Files\Razer\Copperhead\razerhid.exe [2005-10-08 155648]
"Launch LCDMon"=C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2007-12-13 2051096]
"Launch LGDCore"=C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [2007-12-13 2095640]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-05-02 94208]
"System Files Updater"=C:\Windows\FlyakiteOSX\Tools\System Files Updater.exe [2006-02-25 118485]
"ISUSPM Startup"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2005-08-11 249856]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-19 136600]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"=C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe [2007-09-04 81920]
"AIM"=C:\Program Files\AIM\aim.exe [2003-08-01 61440]
"STYLEXP"=C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [2004-10-25 1118208]
"UberIcon"=C:\Program Files\UberIcon\UberIcon Manager.exe [2006-02-23 188416]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
C:\Windows\AGRSMMSG.exe [2005-03-04 88209]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AHHOENC]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIMWDInstallFilename]
C:\PROGRA~1\AIM\AIMWDI~1.EXE [2004-01-12 102400]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ajah]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMan]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BSplayer_WhenUSave_Installer]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BullsEye Network]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\Windows\system32\ctfmon.exe [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeadAIM]
C:\Program Files\AIM\\DeadAIM.ocm [2003-06-19 116224]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iamapp]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
C:\Windows\ime\imkr6_1\IMEKRMIG.EXE [2001-08-23 44032]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\Windows\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2005-08-11 249856]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-08-11 81920]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KavSvc]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KB49RUc2U]
fsqnls.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\malkopny]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1686016]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\Windows\system32\IME\PINTLGNT\ImScInst.exe [2002-08-28 59392]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NAV Agent]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\Windows\system32\NeroCheck.exe [2001-07-09 155648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Windows\system32\NeroCheck.exe [2001-07-09 155648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]
rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\Windows\system32\NvCpl.dll [2008-05-02 13529088]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe [2007-09-04 81920]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\Windows\system32\NvMcTray.dll [2008-05-02 94208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCTAVApp]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\Windows\system32\IME\TINTLGNT\TINTSETP.EXE [2002-08-28 455168]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\Windows\system32\IME\TINTLGNT\TINTSETP.EXE [2002-08-28 455168]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\prkqkzw]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegistryMechanic]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-10-31 32768]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe [2002-06-26 90112]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smiley Faces For AIM]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [2004-10-25 1118208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SysTray]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-03-04 185896]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uninstall_TBPS]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updmgr]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wardo]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webassist]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinNite]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winsync]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XEMJDLL]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xvcwte]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LimeWire 4.0.8.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MiniEYE-MiniREAD Launch.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ojzg.exe]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^riap.exe]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online Account Setup.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Verizon Online.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^Adobe Gamma.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
[]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2
"wuauserv"=2
"NVSvc"=2
"Netlogon"=3
"navapsvc"=2
"MSSQLServerADHelper"=3
"MSSQL$SONY_MEDIAMGR"=3
"LmHosts"=2
"LiveUpdate"=3
"iPodService"=3
"ImapiService"=3
"IDriverT"=3
"clr_optimization_v2.0.50727_32"=3
"CiSvc"=3
"Automatic LiveUpdate Scheduler"=2
"ATI Smart"=2
"Ati HotKey Poller"=2
"aspnet_state"=3
"AppMgmt"=3
"Apache"=2
"ALG"=3
"Adobe LM Service"=3
"wsldoekd"=2
"Viewpoint Manager Service"=2
"usnjsvc"=3
"tdydowkc"=2
"soxpeca"=2
"rpcapd"=3
"roytctm"=2
"Pctspk"=2
"ose"=3
"odserv"=3
"npkcsvc"=2
"noytcyr"=2
"MDM"=2
"mabidwe"=2
"iPod Service"=3
"Apple Mobile Device"=2
"afisicx"=2
C:\Documents and Settings\User\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE
Transparent Windows.lnk - C:\Documents and Settings\User\Application Data\Microsoft\Installer\{3105352A-DA47-473F-9D85-3867FE9EDF35}\_609D529CCA3C1366DBDAE8.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\controlrandom]
controlrandom.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\Windows\system32\WgaLogon.dll [2006-06-19 702768]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\system32\WPDShServiceObj.dll [2006-10-18 133632]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\Windows\system32\upnpui.dll [2004-08-04 193536]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SYMTDI]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWirepr\LimeWire.exe"="C:\Program Files\LimeWirepr\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\Program Files\Wizet\MapleStory\Patcher.exe"="C:\Program Files\Wizet\MapleStory\Patcher.exe:*:Disabled:Patcher MFC ?? ????"
"C:\Program Files\Warcraft III\Warcraft III.exe"="C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Documents and Settings\User\Desktop\Demo-PortForward\Release\PortForward.exe"="C:\Documents and Settings\User\Desktop\Demo-PortForward\Release\PortForward.exe:*:Enabled:PortForward"
"C:\Program Files\Steam\SteamApps\itzderek\counter-strike source\hl2.exe"="C:\Program Files\Steam\SteamApps\itzderek\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Disabled:BitComet - a BitTorrent Client"
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe"="C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Disabled:Nexon Game Manager"
"C:\Program Files\SupaSupa, AERO-REVO!\SupaSupa.exe"="C:\Program Files\SupaSupa, AERO-REVO!\SupaSupa.exe:*:Disabled:SupaSupa"
"C:\Program Files\GameUs\SupaSupa\SupaSupa.exe"="C:\Program Files\GameUs\SupaSupa\SupaSupa.exe:*:Disabled:SupaSupa"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Disabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Google\Google Talk\googletalk.exe"="C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\WINDOWS\system32\skcbgm.exe"="C:\WINDOWS\system32\skcbgm.exe:*:Enabled:SK Communications Cyworld BGM Player"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\Warcraft III\war3.exe"="C:\Program Files\Warcraft III\war3.exe:*:Enabled:Warcraft III"
"C:\Program Files\NeoWiz\GameChu\Common Files\GamechuAgent.exe"="C:\Program Files\NeoWiz\GameChu\Common Files\GamechuAgent.exe:*:Enabled:????????????"
"c:\69.exe"="c:\69.exe:*:Enabled:Control"
"c:\windows\systemfiles32.exe"="c:\windows\systemfiles32.exe:*:Enabled:Control"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AIM\aim.exe"="C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d2ffc3d-5601-11dd-b793-0007e9abe348}]
shell\Auto\command - F:\OSO.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15bc8382-407c-11dd-b767-0007e9abe348}]
shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15bc8383-407c-11dd-b767-0007e9abe348}]
shell\Auto\command - G:\OSO.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15bc8384-407c-11dd-b767-0007e9abe348}]
shell\Auto\command - F:\OSO.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{501a194c-4250-11dd-b76d-0007e9abe348}]
shell\Auto\command - F:\OSO.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f10a360-a60f-11dd-b833-0007e9abe348}]
shell\AutoRun\command - F:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3047f1c-3e1d-11dd-b760-0007e9abe348}]
shell\Auto\command - F:\OSO.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a83e73a5-ef10-11da-b28a-0007e9abe348}]
shell\AutoRun\command - F:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ddd1f828-22dd-11dd-b724-0007e9abe348}]
shell\Auto\command - F:\OSO.exe
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
======List of files/folders created in the last 3 months======
2008-12-03 21:36:55 ----A---- C:\Windows\PSEXESVC.EXE
2008-12-03 21:34:59 ----A---- C:\Boot.bak
2008-12-03 21:34:53 ----RASHD---- C:\cmdcons
2008-12-03 21:15:22 ----D---- C:\ComboFix
2008-12-03 21:15:20 ----A---- C:\Windows\system32\CF2152.exe
2008-12-03 21:00:36 ----A---- C:\Windows\zip.exe
2008-12-03 21:00:36 ----A---- C:\Windows\VFIND.exe
2008-12-03 21:00:36 ----A---- C:\Windows\SWXCACLS.exe
2008-12-03 21:00:36 ----A---- C:\Windows\SWSC.exe
2008-12-03 21:00:36 ----A---- C:\Windows\SWREG.exe
2008-12-03 21:00:36 ----A---- C:\Windows\sed.exe
2008-12-03 21:00:36 ----A---- C:\Windows\NIRCMD.exe
2008-12-03 21:00:36 ----A---- C:\Windows\grep.exe
2008-12-03 21:00:36 ----A---- C:\Windows\fdsv.exe
2008-12-03 21:00:26 ----D---- C:\Qoobox
2008-12-03 18:39:51 ----D---- C:\Windows\ERUNT
2008-12-03 18:36:48 ----A---- C:\Windows\ntbtlog.txt
2008-12-03 18:20:42 ----D---- C:\SDFix
2008-12-02 19:47:33 ----A---- C:\Windows\system32\wuapi.dll.mui
2008-12-02 19:44:19 ----D---- C:\Windows\ERDNT
2008-12-02 19:44:03 ----D---- C:\Program Files\ERUNT
2008-12-02 19:19:48 ----D---- C:\Program Files\trend micro
2008-12-02 19:19:46 ----D---- C:\rsit
2008-12-01 20:24:44 ----D---- C:\Documents and Settings\User\Application Data\Malwarebytes
2008-12-01 20:24:20 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-01 20:24:20 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-25 13:02:30 ----D---- C:\Program Files\netmeeting
2008-11-25 13:02:29 ----D---- C:\Program Files\microsoft frontpage
2008-11-24 14:32:37 ----D---- C:\Documents and Settings\All Users\Application Data\Avg8
2008-11-22 19:15:58 ----HD---- C:\$AVG8.VAULT$
2008-11-22 18:49:01 ----D---- C:\Program Files\IObit
2008-11-22 18:43:33 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-11-20 16:38:15 ----D---- C:\Program Files\Microsoft Visual Studio
2008-11-19 18:54:55 ----A---- C:\Windows\system32\javaws.exe
2008-11-19 18:54:55 ----A---- C:\Windows\system32\javaw.exe
2008-11-19 18:54:55 ----A---- C:\Windows\system32\java.exe
2008-11-19 18:54:55 ----A---- C:\Windows\system32\deploytk.dll
2008-11-19 00:09:00 ----D---- C:\Documents and Settings\User\Application Data\Ubisoft
2008-11-19 00:09:00 ----D---- C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-11-15 21:46:05 ----D---- C:\Program Files\Ventrilo
2008-11-15 21:46:03 ----A---- C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2008-11-15 21:45:53 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-11-14 13:17:13 ----D---- C:\Program Files\iTunes
2008-11-14 13:17:13 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-08 00:26:35 ----D---- C:\Program Files\Guild Wars
2008-11-06 22:31:10 ----A---- C:\Windows\system32\d7c1f283-.txt
2008-11-06 22:18:46 ----D---- C:\Program Files\Common Files\DESIGNER
2008-11-06 22:16:09 ----D---- C:\Windows\SHELLNEW
2008-10-29 18:17:41 ----A---- C:\Windows\system32\SET13.tmp
2008-10-18 21:01:52 ----D---- C:\Program Files\StepMania
2008-10-18 16:25:11 ----D---- C:\Program Files\xerox
2008-10-18 16:25:08 ----D---- C:\Program Files\msn gaming zone
2008-10-18 14:28:51 ----D---- C:\Documents and Settings\All Users\Application Data\Blizzard
2008-10-15 06:44:09 ----D---- C:\Program Files\Safari
2008-10-11 14:31:31 ----D---- C:\Documents and Settings\User\Application Data\DAEMON Tools
2008-09-19 18:17:27 ----D---- C:\Documents and Settings\User\Application Data\Move Networks
2008-09-12 20:39:40 ----D---- C:\Documents and Settings\All Users\Application Data\acccore
2008-09-07 11:03:58 ----A---- C:\Windows\system32\msxml2a.dll
======List of files/folders modified in the last 3 months======
2008-12-04 20:13:28 ----D---- C:\Windows\Prefetch
2008-12-04 19:48:14 ----D---- C:\Program Files\Mozilla Firefox
2008-12-04 18:15:03 ----AD---- C:\Windows\Temp
2008-12-04 18:14:46 ----HD---- C:\Windows\FlyakiteOSX
2008-12-03 22:42:04 ----A---- C:\Windows\SchedLgU.Txt
2008-12-03 21:39:23 ----AD---- C:\WINDOWS
2008-12-03 21:39:22 ----A---- C:\Windows\system.ini
2008-12-03 21:38:56 ----SHD---- C:\Windows\system32
2008-12-03 21:38:09 ----D---- C:\Windows\system32\drivers
2008-12-03 21:37:09 ----D---- C:\Windows\system32\config
2008-12-03 21:36:15 ----D---- C:\Windows\AppPatch
2008-12-03 21:36:15 ----D---- C:\Program Files\Common Files
2008-12-03 21:35:32 ----AD---- C:\Program Files
2008-12-03 21:35:12 ----D---- C:\Windows\system32\CatRoot2
2008-12-03 21:34:59 ----RASH---- C:\boot.ini
2008-12-03 18:37:38 ----D---- C:\Documents and Settings
2008-12-02 20:17:40 ----D---- C:\Program Files\Microsoft Silverlight
2008-12-02 20:08:34 ----HD---- C:\Windows\inf
2008-12-02 20:04:24 ----HD---- C:\Windows\$hf_mig$
2008-12-02 19:58:59 ----D---- C:\Windows\system32\CatRoot
2008-12-02 19:57:01 ----D---- C:\Windows\system32\CatRoot_bak
2008-12-02 19:49:49 ----D---- C:\Windows\Help
2008-12-02 19:43:45 ----SHD---- C:\Windows\Installer
2008-12-02 19:43:45 ----SHD---- C:\Config.Msi
2008-12-02 19:40:33 ----SHD---- C:\System Volume Information
2008-12-02 19:40:33 ----D---- C:\Windows\system32\Restore
2008-12-02 19:05:21 ----D---- C:\Program Files\Warcraft III
2008-12-01 21:08:19 ----D---- C:\Program Files\Common Files\Symantec Shared
2008-12-01 21:07:13 ----D---- C:\Windows\Config
2008-12-01 20:56:40 ----SD---- C:\Windows\Tasks
2008-12-01 20:08:17 ----A---- C:\Windows\win.ini
2008-12-01 19:52:48 ----AC---- C:\Windows\system32\regedt32.exe
2008-11-28 17:17:48 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-11-25 23:26:26 ----D---- C:\Documents and Settings\User\Application Data\uTorrent
2008-11-22 20:31:12 ----D---- C:\Windows\Crack
2008-11-22 19:09:21 ----D---- C:\Windows\WinSxS
2008-11-22 18:43:36 ----D---- C:\Program Files\Lavasoft
2008-11-22 18:43:01 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-11-22 18:21:25 ----A---- C:\Windows\system32\hx1.bat
2008-11-20 19:15:14 ----RSD---- C:\Windows\assembly
2008-11-20 16:39:11 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-11-20 16:37:50 ----RSD---- C:\Windows\Fonts
2008-11-20 16:24:47 ----D---- C:\Program Files\Microsoft Office
2008-11-20 16:24:47 ----D---- C:\Program Files\Common Files\System
2008-11-19 18:54:18 ----D---- C:\Program Files\Java
2008-11-19 14:46:33 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-19 00:03:38 ----D---- C:\Windows\system32\DirectX
2008-11-15 21:46:32 ----D---- C:\Documents and Settings\User\Application Data\Ventrilo
2008-11-15 16:22:57 ----D---- C:\Program Files\World of Warcraft
2008-11-14 13:17:28 ----D---- C:\Program Files\iPod
2008-11-14 13:04:38 ----DC---- C:\Windows\system32\DRVSTORE
2008-11-09 23:24:02 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2008-11-09 22:45:54 ----D---- C:\Documents and Settings\User\Application Data\Adobe
2008-11-08 13:40:44 ----D---- C:\Windows\system32\ias
2008-11-02 08:08:20 ----AC---- C:\Windows\system32\PerfStringBackup.INI
2008-10-31 17:22:00 ----D---- C:\Documents and Settings\All Users\Application Data\Macromedia
2008-10-31 17:21:46 ----D---- C:\Documents and Settings\User\Application Data\Macromedia
2008-10-28 21:47:16 ----D---- C:\Program Files\LimeWirepr
2008-10-25 05:39:04 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-19 22:00:34 ----D---- C:\Windows\Debug
2008-10-18 21:03:34 ----SD---- C:\Windows\Downloaded Program Files
2008-10-17 16:29:12 ----D---- C:\Program Files\Adobe
2008-10-17 16:18:34 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-16 14:13:40 ----A---- C:\Windows\system32\wuaueng.dll
2008-10-16 14:12:22 ----A---- C:\Windows\system32\wucltui.dll
2008-10-16 14:12:20 ----A---- C:\Windows\system32\wuapi.dll
2008-10-16 14:09:44 ----AC---- C:\Windows\system32\wups2.dll
2008-10-16 14:09:44 ----A---- C:\Windows\system32\wuauclt.exe
2008-10-16 14:09:44 ----A---- C:\Windows\system32\cdm.dll
2008-10-16 14:09:40 ----A---- C:\Windows\system32\wucltui.dll.mui
2008-10-16 14:08:58 ----A---- C:\Windows\system32\wups.dll
2008-10-16 14:07:14 ----A---- C:\Windows\system32\wuaueng.dll.mui
2008-10-11 18:00:36 ----D---- C:\Program Files\Common Files\Adobe
2008-10-11 17:33:09 ----HD---- C:\Documents and Settings\User\Application Data\ijjigame
2008-10-11 16:54:45 ----D---- C:\Program Files\Diablo II
2008-10-05 17:58:00 ----D---- C:\soundmax
2008-10-05 17:58:00 ----D---- C:\Program Files\WinRoll
2008-10-05 17:58:00 ----D---- C:\Program Files\Windows Media Player
2008-10-05 17:58:00 ----D---- C:\Program Files\Transparent Windows
2008-10-05 17:57:59 ----D---- C:\Program Files\Tiger System Preferences v2
2008-10-05 17:57:59 ----D---- C:\Program Files\themexp
2008-10-05 17:57:56 ----D---- C:\Program Files\Messenger
2008-10-05 17:57:56 ----D---- C:\Program Files\MegauploadToolbar
2008-10-05 17:57:55 ----D---- C:\Program Files\DivX
2008-10-05 17:57:55 ----D---- C:\Program Files\AIM
2008-10-05 08:57:05 ----RSHDC---- C:\Windows\system32\dllcache
2008-09-18 17:28:47 ----D---- C:\Documents and Settings\User\Application Data\Apple Computer
2008-09-18 16:54:47 ----D---- C:\Program Files\Apple Software Update
2008-09-16 21:00:38 ----D---- C:\Program Files\QuickTime
2008-09-16 20:48:09 ----D---- C:\Program Files\Bonjour
2008-09-14 17:04:27 ----AC---- C:\Windows\wininit.ini
2008-09-12 20:40:06 ----D---- C:\Program Files\AIM6
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 cdrbsvsd;cdrbsvsd; C:\Windows\system32\drivers\cdrbsvsd.sys [2003-12-03 13566]
R1 FsVga;FsVga; C:\Windows\system32\DRIVERS\fsvga.sys [2001-08-23 12160]
R1 intelppm;Intel Processor Driver; C:\Windows\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 kbdhid;Keyboard HID Driver; C:\Windows\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 NPPTNT;NPPTNT; \??\C:\WINDOWS\System32\npptNT.sys []
R1 StyleXPHelper;StyleXPHelper; \??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe []
R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2006-08-07 195776]
R2 npkcrypt;npkcrypt; \??\C:\Program Files\Wizet\MapleStory\npkcrypt.sys []
R2 symlcbrd;symlcbrd; \??\C:\Windows\system32\drivers\symlcbrd.sys []
R3 aeaudio;aeaudio; C:\Windows\system32\drivers\aeaudio.sys [2002-08-22 98752]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\System32\DRIVERS\AGRSM.sys [2005-03-04 1066278]
R3 E100B;Intel® PRO Adapter Driver; C:\Windows\System32\DRIVERS\e100b325.sys [2002-02-25 139776]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HidUsb;Microsoft HID Class Driver; C:\Windows\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\Windows\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\Windows\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 nv;nv; C:\Windows\system32\DRIVERS\nv4_mini.sys [2008-05-02 6554496]
R3 NVR0Dev;NVR0Dev; \??\C:\Windows\nvoclock.sys []
R3 Razerlow;Razer Copperhead Driver; C:\Windows\System32\Drivers\Razerlow.sys [2005-08-12 19020]
R3 smbusp;Intel® SMBus 2.0 Driver; C:\Windows\System32\DRIVERS\smb.sys [2002-02-28 21963]
R3 smwdm;smwdm; C:\Windows\system32\drivers\smwdm.sys [2002-08-23 549672]
R3 SYMDNS;SYMDNS; C:\Windows\System32\Drivers\SYMDNS.SYS [2006-08-07 12992]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\Windows\System32\Drivers\SYMFW.SYS [2006-08-07 110784]
R3 SYMIDS;SYMIDS; C:\Windows\System32\Drivers\SYMIDS.SYS [2006-08-07 31936]
R3 SYMNDIS;SYMNDIS; C:\Windows\System32\Drivers\SYMNDIS.SYS [2006-08-07 28352]
R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2006-08-07 24768]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\Windows\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\Windows\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\Windows\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\Windows\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S1 ASPI32;ASPI32; C:\Windows\system32\drivers\ASPI32.sys []
S1 ATITool;ATITool Overclocking Utility; C:\Windows\system32\DRIVERS\ATITool.sys [2006-11-10 24064]
S3 catchme;catchme; \??\C:\DOCUME~1\User\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\Windows\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 dtscsi;dtscsi; C:\Windows\System32\Drivers\dtscsi.sys []
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2006-12-19 16224]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\Windows\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\Windows\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 nm;Network Monitor Driver; C:\Windows\system32\DRIVERS\NMnt.sys [2004-08-04 40320]
S3 nocashio;nocashio; C:\Windows\system32\drivers\nocashio.sys [2007-11-01 4096]
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2005-08-02 32512]
S3 npkcusb;npkcusb; \??\C:\Nexon\MapleStory\npkcusb.sys []
S3 Ptserlp;PCTEL Serial Device Driver for PCI; C:\Windows\System32\DRIVERS\ptserlp.sys [2001-08-17 112574]
S3 SLIP;BDA Slip De-Framer; C:\Windows\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 SONYPVU1;Sony USB Filter