Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

need help TMP files [RESOLVED]

Started by Lucy Diamond , Jan 31 2008 08:12 PM

  • This topic is locked This topic is locked

#1
Lucy Diamond
Posted 31 January 2008 - 08:12 PM

Lucy Diamond

    New Member

  • Member
  • Pip
  • 9 posts
Ok, i've been having a very odd problem as of late. two icons pop up on my desktop, and Windows Update and a Help and Support. the thing is, both are shortcuts to Internet Explorer, though I use Firefox. Every time i delete them, they come right back.

I clicked into My Documents and saw a [bleep] of a lot of .tmp files that cannot be scanned OR deleted.
In My computer.... there are even more of them.

here are some examples of them

C:\pos1B2.tmp
C:\pos1B3.tmp
C:\pos1B4.tmp

and they just keep going.

for once, i'm not sure whats going on in my computer.

i have tried scanning and/or cleaning with McAfee, Spybot Search and Destroy, Avast Ativirus, and CCleaner.

I NEED HELP

-Kels :)
  • 0

Advertisements

#2
Essexboy
Posted 01 February 2008 - 12:33 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there and welcome I know at least one of the infections you have - plus the cure :)

I will need you to download and run TWO programmes. Please run them in the correct order :)

Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

THEN

Download & Run HijackThis.exe

  • Download HJTInstall.exe to your Desktop.
  • Doubleclick HJTInstall.exe to install it.
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed, it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Copy/Paste the log to your next reply please.
Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.


Logs required : Combofix and Hijackthis
  • 0

#3
Lucy Diamond
Posted 03 February 2008 - 04:21 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
COMBOFIX LOG

ComboFix 08-02.03.1 - krp 2008-02-03 16:04:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.266 [GMT -6:00]
Running from: C:\Documents and Settings\krp\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mljgf.dll
C:\Documents and Settings\krp\Application Data\ShoppingReport
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\Config.xml
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\db\Aliases.dbs
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\db\Sites.dbs
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\report\aggr_storage.xml
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\report\send_storage.xml
C:\Documents and Settings\krp\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
C:\Program Files\outlook
C:\Program Files\outlook\p.zip
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\emjnadtf.dll
C:\WINDOWS\system32\fgjlm.ini
C:\WINDOWS\system32\fgjlm.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljgf.dll
C:\WINDOWS\system32\model.dat
C:\WINDOWS\system32\phzsqnqi.dllbox
C:\WINDOWS\system32\wwzzihvm.dllbox

.
((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-03 15:58 . 2008-02-03 15:59 <DIR> d-------- C:\ComboFix(2)
2008-02-03 15:17 . 2008-02-03 15:17 <DIR> d-------- C:\Program Files\MSBuild
2008-02-03 15:14 . 2008-02-03 15:14 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-03 15:10 . 2008-02-03 15:10 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-02-03 15:02 . 2008-02-03 15:02 <DIR> dr-h----- C:\MSOCache
2008-02-03 14:53 . 2008-02-03 15:15 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-31 19:26 . 2008-01-31 19:26 149 --a------ C:\WINDOWS\wininit.ini
2008-01-31 17:56 . 2008-01-31 17:56 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-01-31 16:35 . 2008-01-31 16:36 <DIR> d-------- C:\Program Files\CCleaner
2008-01-28 22:55 . 2008-01-29 19:00 <DIR> d-------- C:\Program Files\Free iPod Video Converter
2008-01-27 18:33 . 2008-01-27 18:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-21 21:06 . 2008-01-21 21:06 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-21 19:18 . 2008-01-21 19:18 <DIR> d-------- C:\WINDOWS\HB_CHRON_SS_PC dir
2008-01-19 22:17 . 2008-01-19 22:17 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-01-13 22:26 . 2008-01-13 22:26 2,399,315 --a------ C:\WINDOWS\DEBS.scr
2008-01-13 16:21 . 2008-01-28 22:49 <DIR> d-------- C:\Documents and Settings\krp\Application Data\Any Video Converter
2008-01-13 16:16 . 2008-01-13 16:17 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-13 16:15 . 2008-01-13 16:17 <DIR> d-------- C:\Program Files\AoA MP4 Converter
2008-01-13 16:14 . 2008-01-13 16:14 <DIR> d-------- C:\OutputFolder
2008-01-13 16:14 . 2008-01-13 16:14 280 --a------ C:\WINDOWS\system32\temp_0000_60390.aok
2008-01-13 16:13 . 2007-04-12 14:19 129,024 --a------ C:\WINDOWS\system32\AVERM.dll
2008-01-13 16:13 . 2006-09-26 13:57 28,672 --a------ C:\WINDOWS\system32\AVEQT.dll
2008-01-13 16:13 . 2008-01-13 16:13 131 --a------ C:\WINDOWS\system32\test.aok
2008-01-12 20:00 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe
2008-01-12 20:00 . 2007-05-14 15:24 394,240 --a------ C:\WINDOWS\system32\Smab.dll
2008-01-12 20:00 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2008-01-12 20:00 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-01-12 20:00 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2008-01-12 20:00 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe
2008-01-12 20:00 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2008-01-12 19:59 . 2005-02-12 16:00 186,880 -rahs---- C:\WINDOWS\system32\RLOgg.ax
2008-01-12 19:59 . 2005-01-17 16:26 179,200 -rahs---- C:\WINDOWS\system32\DiracSplitter.ax
2008-01-12 19:59 . 2006-08-16 07:53 175,104 -rahs---- C:\WINDOWS\system32\CoreAAC.ax
2008-01-12 19:59 . 2005-02-05 16:00 92,672 -rahs---- C:\WINDOWS\system32\RLVorbisDec.ax
2008-01-12 19:59 . 2005-02-22 09:55 81,920 -rahs---- C:\WINDOWS\system32\aac_parser.ax
2008-01-12 19:59 . 2005-02-12 16:00 67,584 -rahs---- C:\WINDOWS\system32\RLTheoraDec.ax
2008-01-12 19:59 . 2005-02-12 16:00 51,712 -rahs---- C:\WINDOWS\system32\RLSpeexDec.ax
2008-01-12 19:31 . 2008-01-12 19:35 <DIR> d-------- C:\Documents and Settings\krp\Application Data\Winff
2008-01-12 19:24 . 2008-01-29 19:00 <DIR> d-------- C:\Program Files\MediaCoder
2008-01-12 19:19 . 2008-01-12 19:19 <DIR> d-------- C:\Documents and Settings\krp\Application Data\STOIK
2008-01-12 19:14 . 2004-05-26 20:37 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-01-12 19:14 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-10 14:56 . 2008-01-10 14:56 <DIR> d-------- C:\Program Files\AVSMedia
2008-01-10 14:31 . 2008-01-10 14:31 <DIR> d-------- C:\WINDOWS\system32\RMBin
2008-01-10 14:31 . 2005-07-21 13:33 2,846,720 --a------ C:\WINDOWS\system32\NCTAudioCompress3.dll
2008-01-10 14:31 . 2005-06-01 12:11 877,568 --a------ C:\WINDOWS\system32\NCTAudioFile2.dll
2008-01-10 14:31 . 2005-07-08 18:31 495,104 --a------ C:\WINDOWS\system32\NCTVideoCoreM.dll
2008-01-10 14:31 . 2006-03-30 06:35 475,136 --a------ C:\WINDOWS\system32\SkinCrafter.dll
2008-01-10 14:31 . 2005-06-01 12:11 467,456 --a------ C:\WINDOWS\system32\NCTAudioPlayer2.dll
2008-01-10 14:31 . 2005-07-19 17:53 249,856 --a------ C:\WINDOWS\system32\NCTQuickTimeFile.dll
2008-01-10 14:31 . 2005-01-25 17:12 201,216 --a------ C:\WINDOWS\system32\NCTVideoPlayer.dll
2008-01-10 14:31 . 2005-06-15 20:04 90,112 --a------ C:\WINDOWS\system32\NCTAudioFormatSettings3.dll
2008-01-09 20:27 . 2008-01-09 20:27 <DIR> d-------- C:\Program Files\Bobyte
2008-01-09 18:00 . 2008-01-09 18:57 38 --a------ C:\WINDOWS\avisplitter.INI
2008-01-09 16:41 . 2008-01-09 16:41 <DIR> d-------- C:\Documents and Settings\krp\Application Data\Search Settings
2008-01-09 16:10 . 2008-01-09 16:10 <DIR> d-------- C:\Program Files\Search Settings
2008-01-09 16:10 . 2008-01-09 16:10 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-01-09 16:09 . 2008-01-10 18:39 <DIR> d-------- C:\Program Files\Free FLV Converter
2008-01-09 16:09 . 2006-07-11 18:06 765,952 --a------ C:\WINDOWS\system32\msvcp71d.dll
2008-01-09 16:09 . 2007-06-18 23:22 364,544 --a------ C:\WINDOWS\system32\PropertyGrid.ocx
2008-01-09 16:09 . 2005-10-13 13:42 208,500 --a------ C:\WINDOWS\system32\ReyXpBasics.tlb
2008-01-09 16:09 . 2004-03-09 00:00 84,512 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-01-09 16:09 . 1998-07-13 00:00 9,728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL
2008-01-05 19:58 . 2008-01-05 20:01 <DIR> d-------- C:\Program Files\WinAce

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 21:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-03 21:17 --------- d-----w C:\Program Files\Microsoft Works
2008-02-03 20:28 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-02-01 01:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-01 00:31 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 23:37 --------- d-----w C:\Program Files\RocketDock
2008-01-31 05:21 --------- d-----w C:\Program Files\InterVideo
2008-01-30 01:01 --------- d-----w C:\Documents and Settings\krp\Application Data\BitTorrent
2008-01-22 01:19 535,040 ----a-w C:\WINDOWS\flashax.exe
2008-01-22 01:19 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-01-17 06:11 --------- d-----w C:\Documents and Settings\krp\Application Data\OpenOffice.org2
2008-01-16 22:08 --------- d-----w C:\Program Files\iTunes
2008-01-16 22:07 --------- d-----w C:\Program Files\iPod
2008-01-16 22:06 --------- d-----w C:\Program Files\QuickTime
2008-01-14 01:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-13 22:12 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-01-10 23:52 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-01-10 20:59 --------- d-----w C:\Documents and Settings\krp\Application Data\AVSMedia
2008-01-10 19:45 --------- d-----w C:\Program Files\Ipod Video Converter
2008-01-04 21:24 --------- d-----w C:\Program Files\InterActual
2007-12-16 20:17 --------- d-----w C:\Program Files\Common Files\DVDVIDEOSOFT
2007-12-16 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\AVS4YOU
2007-12-16 17:52 --------- d-----w C:\Documents and Settings\krp\Application Data\StaxRip
2007-12-16 17:12 --------- d-----w C:\Program Files\PQDVD
2007-12-16 16:24 --------- d-----w C:\Program Files\DivX
2007-12-16 16:22 --------- d-----w C:\Program Files\Real
2007-12-16 16:20 --------- d-----w C:\Program Files\K-Lite Codec Pack(2)
2007-12-16 16:20 --------- d-----w C:\Documents and Settings\krp\Application Data\DivX
2007-12-16 03:14 --------- d-----w C:\Program Files\Common Files\Real
2007-12-13 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-12-11 01:24 --------- d-----w C:\Documents and Settings\krp\Application Data\LimeWire
2007-12-06 04:58 --------- d-----w C:\Program Files\Java
2004-08-10 12:00 22,040 -c-h--w C:\Documents and Settings\krp\Application Data\aon.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
2007-12-06 11:58 1198432 --a------ C:\Program Files\Search Settings\kb125\SearchSettings.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 02:32 65536]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-18 23:05 630784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TDispVol"="TDispVol.exe" [2005-03-11 17:03 73728 C:\WINDOWS\system32\TDispVol.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-12-16 02:34 82009]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 02:32 761945]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2004-08-18 05:37 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 08:29 88203 C:\WINDOWS\agrsmmsg.exe]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 14:25 73728]
"TPSMain"="TPSMain.exe" [2005-05-31 23:00 282624 C:\WINDOWS\system32\TPSMain.exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 18:13 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 19:37 151552]
"WService"="WService.EXE" [2005-08-15 17:48 28672 C:\WINDOWS\system32\WService.exe]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-19 23:27 65536]
"VisualTooltip"="C:\Program Files\VisualTooltip\VisualToolTip.exe" [2006-10-06 07:21 942080]
"Blaero Start Orb"="C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe" [2006-07-30 17:32 575488]
"Styler"="C:\Program Files\Styler\Styler.exe" [2006-05-03 08:48 307200]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 07:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 12:39 136768]
"LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 17:38 987187]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2007-12-06 11:58 1069920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 19:48 434528]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22 288472]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 06:56:20 73728]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-02-16 03:25:30 286720]
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2006-02-15 10:31:42 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccabxw]
fccabxw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
--a------ 2005-08-18 11:28 50776 C:\Program Files\America Online 9.0\AOL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL TopSpeedMonitor"=2 (0x2)
"AOL ACS"=2 (0x2)

R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2005-01-12 02:05]
R0 XPacket;Filseclab Packet Filter;C:\WINDOWS\system32\xpacket.sys [2005-07-05 10:55]
S3 cdrmkaun;cdrmkaun;C:\DOCUME~1\krp\LOCALS~1\Temp\cdrmkaun.sys []
S3 PAC207;Basic Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-05-27 13:57]
S3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 16:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b48e8dee-fe46-11db-be10-00038a000015}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9311b4a-cf70-11db-bd89-001302d70568}]
\Shell\AutoRun\command - E:\JDSecure\Windows\JDSecure31.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-13 01:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-03 22:00:00 C:\WINDOWS\Tasks\B4DA702E944A1E9E.job"
- c:\docume~1\krp\applic~1\loudda~1\Info Mess Regs.exe
"2008-02-03 21:25:09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2007-11-15 07:00:00 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\WINDOWS\system32\defrag.exe
"2008-01-01 07:00:00 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-02-03 22:14:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2006-12-25 15:50:57 C:\WINDOWS\Tasks\Registration reminder 2.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 16:13:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\LClock\LC.dll
-> C:\Program Files\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\DRIVERS\WtSrv.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\DOCUME~1\krp\LOCALS~1\Temp\{4B2165AC-47F9-463D-9B81-B73E41685938}\Blaero Start Orb.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2008-02-03 16:17:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-03 22:17:14
.
2008-01-31 22:34:37 --- E O F ---




Hijackthis LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:19:24 PM, on 2/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\DRIVERS\WtSrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\LClock\LClock.exe
C:\WINDOWS\system32\WService.EXE
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\DOCUME~1\krp\LOCALS~1\Temp\{4B2165AC-47F9-463D-9B81-B73E41685938}\Blaero Start Orb.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb125\SearchSettings.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [WService] WService.EXE
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Search - ?p=ZNfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\krp\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1167770917226
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: fccabxw - fccabxw.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\system32\DRIVERS\WtSrv.exe

--
End of file - 11751 bytes
  • 0

#4
Essexboy
Posted 03 February 2008 - 04:56 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Looks better now :)

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\Tasks\B4DA702E944A1E9E.job

Folder::
C:\Program Files\Search Settings\kb125

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccabxw]

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

NOW FOR THE WAIFS AND STRAYS

Download WinPFind35u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind35u on your desktop.
  • Close ALL OTHER PROGRAMS.
  • Open the WinPFind35u folder and double-click on WinPFind35U.exe to start the program.
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the Add Reply button and attach the log. I will review it when it comes in. If, after posting, the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.

Logs required : Combofix and Winpfind Plus how is your computer now ?
  • 0

#5
Lucy Diamond
Posted 03 February 2008 - 06:25 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
COMBO FIX LOG

ComboFix 08-02.03.1 - krp 2008-02-03 18:00:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.341 [GMT -6:00]
Running from: C:\Documents and Settings\krp\Desktop\other\ComboFix.exe
Command switches used :: C:\Documents and Settings\krp\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\Tasks\B4DA702E944A1E9E.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Search Settings\kb125
C:\Program Files\Search Settings\kb125\res\ErrorPageTemplate.css
C:\Program Files\Search Settings\kb125\res\help.gif
C:\Program Files\Search Settings\kb125\res\pixel.gif
C:\Program Files\Search Settings\kb125\res\tab_icon.png
C:\Program Files\Search Settings\kb125\res\tabdata.js
C:\Program Files\Search Settings\kb125\res\tablib.js
C:\Program Files\Search Settings\kb125\res\tabwelcome_en.html
C:\Program Files\Search Settings\kb125\res\toolbar_background.gif
C:\Program Files\Search Settings\kb125\res\vista_directions.png
C:\Program Files\Search Settings\kb125\res\xp_directions.png
C:\Program Files\Search Settings\kb125\res\yahoo_search.gif
C:\Program Files\Search Settings\kb125\SearchSettings.dll
C:\WINDOWS\Tasks\B4DA702E944A1E9E.job

.
((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-03 16:19 . 2008-02-03 16:19 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-03 15:58 . 2008-02-03 15:59 <DIR> d-------- C:\ComboFix(2)
2008-02-03 15:17 . 2008-02-03 15:17 <DIR> d-------- C:\Program Files\MSBuild
2008-02-03 15:14 . 2008-02-03 15:14 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-03 15:10 . 2008-02-03 15:10 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-02-03 15:02 . 2008-02-03 15:02 <DIR> dr-h----- C:\MSOCache
2008-02-03 14:53 . 2008-02-03 15:15 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-31 19:26 . 2008-01-31 19:26 149 --a------ C:\WINDOWS\wininit.ini
2008-01-31 17:56 . 2008-01-31 17:56 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-01-31 16:35 . 2008-01-31 16:36 <DIR> d-------- C:\Program Files\CCleaner
2008-01-28 22:55 . 2008-01-29 19:00 <DIR> d-------- C:\Program Files\Free iPod Video Converter
2008-01-27 18:33 . 2008-01-27 18:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-21 21:06 . 2008-01-21 21:06 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-21 19:18 . 2008-01-21 19:18 <DIR> d-------- C:\WINDOWS\HB_CHRON_SS_PC dir
2008-01-19 22:17 . 2008-01-19 22:17 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-01-13 22:26 . 2008-01-13 22:26 2,399,315 --a------ C:\WINDOWS\DEBS.scr
2008-01-13 16:21 . 2008-01-28 22:49 <DIR> d-------- C:\Documents and Settings\krp\Application Data\Any Video Converter
2008-01-13 16:16 . 2008-01-13 16:17 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-13 16:15 . 2008-01-13 16:17 <DIR> d-------- C:\Program Files\AoA MP4 Converter
2008-01-13 16:14 . 2008-01-13 16:14 <DIR> d-------- C:\OutputFolder
2008-01-13 16:14 . 2008-01-13 16:14 280 --a------ C:\WINDOWS\system32\temp_0000_60390.aok
2008-01-13 16:13 . 2007-04-12 14:19 129,024 --a------ C:\WINDOWS\system32\AVERM.dll
2008-01-13 16:13 . 2006-09-26 13:57 28,672 --a------ C:\WINDOWS\system32\AVEQT.dll
2008-01-13 16:13 . 2008-01-13 16:13 131 --a------ C:\WINDOWS\system32\test.aok
2008-01-12 20:00 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe
2008-01-12 20:00 . 2007-05-14 15:24 394,240 --a------ C:\WINDOWS\system32\Smab.dll
2008-01-12 20:00 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2008-01-12 20:00 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe
2008-01-12 20:00 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2008-01-12 20:00 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe
2008-01-12 20:00 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2008-01-12 19:59 . 2005-02-12 16:00 186,880 -rahs---- C:\WINDOWS\system32\RLOgg.ax
2008-01-12 19:59 . 2005-01-17 16:26 179,200 -rahs---- C:\WINDOWS\system32\DiracSplitter.ax
2008-01-12 19:59 . 2006-08-16 07:53 175,104 -rahs---- C:\WINDOWS\system32\CoreAAC.ax
2008-01-12 19:59 . 2005-02-05 16:00 92,672 -rahs---- C:\WINDOWS\system32\RLVorbisDec.ax
2008-01-12 19:59 . 2005-02-22 09:55 81,920 -rahs---- C:\WINDOWS\system32\aac_parser.ax
2008-01-12 19:59 . 2005-02-12 16:00 67,584 -rahs---- C:\WINDOWS\system32\RLTheoraDec.ax
2008-01-12 19:59 . 2005-02-12 16:00 51,712 -rahs---- C:\WINDOWS\system32\RLSpeexDec.ax
2008-01-12 19:31 . 2008-01-12 19:35 <DIR> d-------- C:\Documents and Settings\krp\Application Data\Winff
2008-01-12 19:24 . 2008-01-29 19:00 <DIR> d-------- C:\Program Files\MediaCoder
2008-01-12 19:19 . 2008-01-12 19:19 <DIR> d-------- C:\Documents and Settings\krp\Application Data\STOIK
2008-01-12 19:14 . 2004-05-26 20:37 719,872 --a------ C:\WINDOWS\system32\devil.dll
2008-01-12 19:14 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-10 14:56 . 2008-01-10 14:56 <DIR> d-------- C:\Program Files\AVSMedia
2008-01-10 14:31 . 2008-01-10 14:31 <DIR> d-------- C:\WINDOWS\system32\RMBin
2008-01-10 14:31 . 2005-07-21 13:33 2,846,720 --a------ C:\WINDOWS\system32\NCTAudioCompress3.dll
2008-01-10 14:31 . 2005-06-01 12:11 877,568 --a------ C:\WINDOWS\system32\NCTAudioFile2.dll
2008-01-10 14:31 . 2005-07-08 18:31 495,104 --a------ C:\WINDOWS\system32\NCTVideoCoreM.dll
2008-01-10 14:31 . 2006-03-30 06:35 475,136 --a------ C:\WINDOWS\system32\SkinCrafter.dll
2008-01-10 14:31 . 2005-06-01 12:11 467,456 --a------ C:\WINDOWS\system32\NCTAudioPlayer2.dll
2008-01-10 14:31 . 2005-07-19 17:53 249,856 --a------ C:\WINDOWS\system32\NCTQuickTimeFile.dll
2008-01-10 14:31 . 2005-01-25 17:12 201,216 --a------ C:\WINDOWS\system32\NCTVideoPlayer.dll
2008-01-10 14:31 . 2005-06-15 20:04 90,112 --a------ C:\WINDOWS\system32\NCTAudioFormatSettings3.dll
2008-01-09 20:27 . 2008-01-09 20:27 <DIR> d-------- C:\Program Files\Bobyte
2008-01-09 18:00 . 2008-01-09 18:57 38 --a------ C:\WINDOWS\avisplitter.INI
2008-01-09 16:41 . 2008-01-09 16:41 <DIR> d-------- C:\Documents and Settings\krp\Application Data\Search Settings
2008-01-09 16:10 . 2008-02-03 18:00 <DIR> d-------- C:\Program Files\Search Settings
2008-01-09 16:10 . 2008-01-09 16:10 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-01-09 16:09 . 2008-01-10 18:39 <DIR> d-------- C:\Program Files\Free FLV Converter
2008-01-09 16:09 . 2006-07-11 18:06 765,952 --a------ C:\WINDOWS\system32\msvcp71d.dll
2008-01-09 16:09 . 2007-06-18 23:22 364,544 --a------ C:\WINDOWS\system32\PropertyGrid.ocx
2008-01-09 16:09 . 2005-10-13 13:42 208,500 --a------ C:\WINDOWS\system32\ReyXpBasics.tlb
2008-01-09 16:09 . 2004-03-09 00:00 84,512 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-01-09 16:09 . 1998-07-13 00:00 9,728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL
2008-01-05 19:58 . 2008-01-05 20:01 <DIR> d-------- C:\Program Files\WinAce

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 21:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-02-03 21:17 --------- d-----w C:\Program Files\Microsoft Works
2008-02-03 20:28 --------- d-----w C:\Program Files\OpenOffice.org 2.3
2008-02-01 01:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-01 00:31 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 23:37 --------- d-----w C:\Program Files\RocketDock
2008-01-31 05:21 --------- d-----w C:\Program Files\InterVideo
2008-01-30 01:01 --------- d-----w C:\Documents and Settings\krp\Application Data\BitTorrent
2008-01-22 01:19 535,040 ----a-w C:\WINDOWS\flashax.exe
2008-01-22 01:19 12,288 ----a-w C:\WINDOWS\impborl.dll
2008-01-17 06:11 --------- d-----w C:\Documents and Settings\krp\Application Data\OpenOffice.org2
2008-01-16 22:08 --------- d-----w C:\Program Files\iTunes
2008-01-16 22:07 --------- d-----w C:\Program Files\iPod
2008-01-16 22:06 --------- d-----w C:\Program Files\QuickTime
2008-01-14 01:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-13 22:12 --------- d-----w C:\Program Files\Common Files\Download Manager
2008-01-10 23:52 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-01-10 20:59 --------- d-----w C:\Documents and Settings\krp\Application Data\AVSMedia
2008-01-10 19:45 --------- d-----w C:\Program Files\Ipod Video Converter
2008-01-04 21:24 --------- d-----w C:\Program Files\InterActual
2007-12-16 20:17 --------- d-----w C:\Program Files\Common Files\DVDVIDEOSOFT
2007-12-16 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\AVS4YOU
2007-12-16 17:52 --------- d-----w C:\Documents and Settings\krp\Application Data\StaxRip
2007-12-16 17:12 --------- d-----w C:\Program Files\PQDVD
2007-12-16 16:24 --------- d-----w C:\Program Files\DivX
2007-12-16 16:22 --------- d-----w C:\Program Files\Real
2007-12-16 16:20 --------- d-----w C:\Program Files\K-Lite Codec Pack(2)
2007-12-16 16:20 --------- d-----w C:\Documents and Settings\krp\Application Data\DivX
2007-12-16 03:14 --------- d-----w C:\Program Files\Common Files\Real
2007-12-13 23:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-12-11 01:24 --------- d-----w C:\Documents and Settings\krp\Application Data\LimeWire
2007-12-06 04:58 --------- d-----w C:\Program Files\Java
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-03-02 20:21 82,022 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_03_01_16_39_41_small.dmp.zip
2007-02-24 16:29 85,762 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_23_22_29_19_small.dmp.zip
2007-02-17 19:34 16,601,847 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_16_20_19_23_full.dmp.zip
2007-02-15 21:15 87,921 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_15_14_24_38_small.dmp.zip
2007-02-15 21:15 82,328 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_15_14_21_27_small.dmp.zip
2007-02-14 03:49 78,642 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_13_16_20_52_small.dmp.zip
2007-02-13 21:20 92,038 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_13_16_17_33_small.dmp.zip
2007-02-13 21:20 82,798 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_13_16_16_06_small.dmp.zip
2007-02-08 19:56 84,722 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_08_09_37_48_small.dmp.zip
2007-02-06 20:01 87,920 -c--a-w C:\WINDOWS\Internet Logs\vsmon_2nd_2007_02_06_10_33_26_small.dmp.zip
2006-02-19 08:28 12,288 -c--a-w C:\WINDOWS\Fonts\RandFont.dll
2004-08-10 12:00 22,040 -c-h--w C:\Documents and Settings\krp\Application Data\aon.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 06:00 15360]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 02:32 65536]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-18 23:05 630784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TDispVol"="TDispVol.exe" [2005-03-11 17:03 73728 C:\WINDOWS\system32\TDispVol.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-12-16 02:34 82009]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 02:32 761945]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2004-08-18 05:37 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 08:29 88203 C:\WINDOWS\agrsmmsg.exe]
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 14:25 73728]
"TPSMain"="TPSMain.exe" [2005-05-31 23:00 282624 C:\WINDOWS\system32\TPSMain.exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 18:13 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 19:37 151552]
"WService"="WService.EXE" [2005-08-15 17:48 28672 C:\WINDOWS\system32\WService.exe]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-19 23:27 65536]
"VisualTooltip"="C:\Program Files\VisualTooltip\VisualToolTip.exe" [2006-10-06 07:21 942080]
"Blaero Start Orb"="C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe" [2006-07-30 17:32 575488]
"Styler"="C:\Program Files\Styler\Styler.exe" [2006-05-03 08:48 307200]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 07:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 12:39 136768]
"LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 17:38 987187]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2007-12-06 11:58 1069920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2006-10-26 19:48 434528]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 03:21:22 288472]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 06:56:20 73728]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-02-16 03:25:30 286720]
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2006-02-15 10:31:42 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
--a------ 2005-08-18 11:28 50776 C:\Program Files\America Online 9.0\AOL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL TopSpeedMonitor"=2 (0x2)
"AOL ACS"=2 (0x2)

R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2005-01-12 02:05]
R0 XPacket;Filseclab Packet Filter;C:\WINDOWS\system32\xpacket.sys [2005-07-05 10:55]
S3 cdrmkaun;cdrmkaun;C:\DOCUME~1\krp\LOCALS~1\Temp\cdrmkaun.sys []
S3 PAC207;Basic Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-05-27 13:57]
S3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 16:47]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b48e8dee-fe46-11db-be10-00038a000015}]
\Shell\AutoRun\command - E:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d9311b4a-cf70-11db-bd89-001302d70568}]
\Shell\AutoRun\command - E:\JDSecure\Windows\JDSecure31.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-01-13 01:29:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-03 23:25:06 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2007-11-15 07:00:00 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\WINDOWS\system32\defrag.exe
"2008-01-01 07:00:00 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-02-03 22:31:29 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2006-12-25 15:50:57 C:\WINDOWS\Tasks\Registration reminder 2.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 18:02:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 18:03:07
ComboFix-quarantined-files.txt 2008-02-04 00:03:05
ComboFix2.txt 2008-02-03 22:17:19
.
2008-01-31 22:34:37 --- E O F ---


Hijack this LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:21:03 PM, on 2/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\DRIVERS\WtSrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\toshiba\ivp\ism\pinger.exe
C:\Program Files\LClock\LClock.exe
C:\WINDOWS\system32\WService.EXE
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\DOCUME~1\krp\LOCALS~1\Temp\{4B2165AC-47F9-463D-9B81-B73E41685938}\Blaero Start Orb.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [WService] WService.EXE
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Search - ?p=ZNfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\krp\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1167770917226
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\system32\DRIVERS\WtSrv.exe

--
End of file - 11702 bytes

Edited by Lucy Diamond, 03 February 2008 - 06:30 PM.

  • 0

#6
Lucy Diamond
Posted 03 February 2008 - 06:27 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
WinPFind part1

[code=auto:0]
WinPFind35 logfile created on: 2/3/2008 6:21:20 PM
WinPFind35U Version Beta42 Folder = C:\Documents and Settings\krp\Desktop\WinPFind35u
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)

1013.98 Mb Total Physical Memory | 409.00 Mb Available Physical Memory | 40.34% Memory free
2.38 Gb Paging File | 1.95 Gb Available in Paging File | 81.90% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92.91 Gb Total Space | 58.11 Gb Free Space | 62.55% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: TOSHIBA-USER
Current User Name: krp
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user


[Processes - Non-Microsoft Only]
applemobiledeviceservice.exe -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> Apple, Inc. [Ver = 1, 14, 0, 0 | Size = 110592 bytes | Modified Date = 9/6/2007 12:28:18 PM | Attr = ]
cfsvcs.exe -> %ProgramFiles%\TOSHIBA\ConfigFree\CFSvcs.exe -> TOSHIBA CORPORATION [Ver = 6, 0, 0, 1 | Size = 40960 bytes | Modified Date = 1/17/2005 6:38:38 PM | Attr = ]
dvdramsv.exe -> %System32%\DVDRAMSV.exe -> Matsushita Electric Industrial Co., Ltd. [Ver = 3, 0, 0, 0 | Size = 110592 bytes | Modified Date = 8/28/2004 2:33:00 AM | Attr = ]
frameworkservice.exe -> %ProgramFiles%\McAfee\Common Framework\FrameworkService.exe -> McAfee, Inc. [Ver = 3.6.0.453 | Size = 104000 bytes | Modified Date = 11/17/2006 12:37:44 PM | Attr = ]
mcshield.exe -> %ProgramFiles%\McAfee\VirusScan Enterprise\Mcshield.exe -> McAfee, Inc. [Ver = VSCORE.13.3.1.100.x86 | Size = 144960 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
vstskmgr.exe -> %ProgramFiles%\McAfee\VirusScan Enterprise\VsTskMgr.exe -> McAfee, Inc. [Ver = 8.5.0.781 | Size = 54872 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
naprdmgr.exe -> %ProgramFiles%\McAfee\Common Framework\naPrdMgr.exe -> McAfee, Inc. [Ver = 3.6.0.453 | Size = 136768 bytes | Modified Date = 11/17/2006 12:40:56 PM | Attr = ]
swupdtmr.exe -> %SystemDrive%\TOSHIBA\IVP\swupdate\swupdtmr.exe -> [Ver = | Size = 40960 bytes | Modified Date = 7/12/2005 7:14:42 PM | Attr = ]
tappsrv.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe -> TOSHIBA Corp. [Ver = 1, 0, 0, 13M | Size = 35328 bytes | Modified Date = 12/20/2005 1:22:14 PM | Attr = ]
wtsrv.exe -> %System32%\drivers\WtSrv.exe -> Tablet Driver [Ver = 4.03.02 | Size = 40960 bytes | Modified Date = 8/15/2005 5:48:19 PM | Attr = ]
syntpenh.exe -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe -> Synaptics, Inc. [Ver = 8.2.9 16Dec05 | Size = 761945 bytes | Modified Date = 12/16/2005 2:32:58 AM | Attr = ]
ltmoh.exe -> %ProgramFiles%\ltmoh\ltmoh.exe -> Agere Systems [Ver = 1.75 | Size = 184320 bytes | Modified Date = 8/18/2004 5:37:44 AM | Attr = ]
agrsmmsg.exe -> %SystemRoot%\agrsmmsg.exe -> Agere Systems [Ver = 2.1.60.5 2.1.60.5 10/14/2005 13:29:07 | Size = 88203 bytes | Modified Date = 10/15/2005 8:29:08 AM | Attr = ]
tvstray.exe -> %ProgramFiles%\TOSHIBA\Tvs\TvsTray.exe -> TOSHIBA Corporation [Ver = 1, 0, 0, 7 | Size = 73728 bytes | Modified Date = 11/30/2005 2:25:22 PM | Attr = ]
toshiba.exe -> %ProgramFiles%\Synaptics\SynTP\Toshiba.exe -> Synaptics, Inc. [Ver = 8.2.9 16Dec05 | Size = 151552 bytes | Modified Date = 12/16/2005 2:21:00 AM | Attr = ]
tpsmain.exe -> %System32%\TPSMain.exe -> TOSHIBA Corporation [Ver = 1, 0, 15, 0 | Size = 282624 bytes | Modified Date = 5/31/2005 11:00:12 PM | Attr = ]
smoothview.exe -> %ProgramFiles%\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe -> TOSHIBA Corporation [Ver = 2, 0, 0, 23 | Size = 122880 bytes | Modified Date = 4/26/2005 6:13:20 PM | Attr = ]
pinger.exe -> %SystemDrive%\TOSHIBA\IVP\ISM\pinger.exe -> TOSHIBA Corporation [Ver = 3.7.0.0 | Size = 151552 bytes | Modified Date = 3/17/2005 7:37:26 PM | Attr = ]
lclock.exe -> %ProgramFiles%\LClock\LClock.exe -> [Ver = 1, 0, 0, 1 | Size = 65536 bytes | Modified Date = 9/19/2004 11:27:46 PM | Attr = ]
wservice.exe -> %System32%\WService.exe -> Tablet Driver [Ver = 4.03.02 | Size = 28672 bytes | Modified Date = 8/15/2005 5:48:19 PM | Attr = ]
visualtooltip.exe -> %ProgramFiles%\VisualTooltip\VisualToolTip.exe -> Christian Salmon [Ver = 2.0.0.0 | Size = 942080 bytes | Modified Date = 10/6/2006 7:21:32 AM | Attr = ]
tpsbattm.exe -> %System32%\TPSBattM.exe -> TOSHIBA Corporation [Ver = 1, 0, 2, 0 | Size = 45056 bytes | Modified Date = 5/31/2005 10:59:58 PM | Attr = ]
styler.exe -> %ProgramFiles%\Styler\Styler.exe -> ta2027 [Ver = 1, 4, 0, 1 | Size = 307200 bytes | Modified Date = 5/3/2006 8:48:46 AM | Attr = ]
shstat.exe -> %ProgramFiles%\McAfee\VirusScan Enterprise\shstat.exe -> McAfee, Inc. [Ver = 8.5.0.781 | Size = 112216 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
udaterui.exe -> %ProgramFiles%\McAfee\Common Framework\UdaterUI.exe -> McAfee, Inc. [Ver = 3.6.0.453 | Size = 136768 bytes | Modified Date = 11/17/2006 12:39:58 PM | Attr = ]
blaero start orb.exe -> %LocalSettings%\Temp\{4B2165AC-47F9-463D-9B81-B73E41685938}\Blaero Start Orb.exe -> [Ver = | Size = 521216 bytes | Modified Date = 7/30/2006 7:32:48 PM | Attr = ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_03\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 132496 bytes | Modified Date = 9/25/2007 1:11:35 AM | Attr = ]
mctray.exe -> %ProgramFiles%\McAfee\Common Framework\Mctray.exe -> McAfee, Inc. [Ver = 1.0.0.125 | Size = 86016 bytes | Modified Date = 11/17/2006 2:06:00 AM | Attr = ]
searchsettings.exe -> %ProgramFiles%\Search Settings\SearchSettings.exe -> Vendio Services, Inc. [Ver = 1, 0, 0, 13 | Size = 1069920 bytes | Modified Date = 12/6/2007 11:58:18 AM | Attr = ]
ituneshelper.exe -> %ProgramFiles%\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 267048 bytes | Modified Date = 1/15/2008 3:22:56 AM | Attr = ]
toscdspd.exe -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe -> TOSHIBA [Ver = 1, 0, 6, 0 | Size = 65536 bytes | Modified Date = 12/30/2004 2:32:20 AM | Attr = ]
rocketdock.exe -> %ProgramFiles%\RocketDock\RocketDock.exe -> [Ver = | Size = 630784 bytes | Modified Date = 3/18/2007 11:05:02 PM | Attr = ]
hpqtra08.exe -> %ProgramFiles%\HP\Digital Imaging\bin\hpqtra08.exe -> Hewlett-Packard Development Company, L.P. [Ver = 70.0.170.000 | Size = 288472 bytes | Modified Date = 2/19/2006 3:21:22 AM | Attr = ]
wincinemamgr.exe -> %ProgramFiles%\InterVideo\Common\Bin\WinCinemaMgr.exe -> InterVideo Inc. [Ver = IVI_MAJOR_VERSION.IVI_MINOR_VERSION | Size = 286720 bytes | Modified Date = 12/26/2005 9:55:48 PM | Attr = ]
ramasst.exe -> %System32%\RAMASST.exe -> Matsushita Electric Industrial Co., Ltd. [Ver = 1, 1, 0, 0 | Size = 155648 bytes | Modified Date = 8/28/2004 2:37:00 AM | Attr = ]
hpqnrs08.exe -> %ProgramFiles%\HP\Digital Imaging\bin\hpqnrs08.exe -> Hewlett-Packard Development Company, L.P. [Ver = 70.0.170.000 | Size = 139264 bytes | Modified Date = 2/19/2006 4:29:46 AM | Attr = ]
ipodservice.exe -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 504104 bytes | Modified Date = 1/15/2008 3:22:44 AM | Attr = ]
hpqimzone.exe -> %ProgramFiles%\HP\Digital Imaging\bin\hpqimzone.exe -> Hewlett-Packard Development Company, L.P. [Ver = 065.000.117.000 | Size = 479232 bytes | Modified Date = 2/10/2006 6:56:12 AM | Attr = ]
hpzinw12.exe -> %System32%\HPZinw12.exe -> HP [Ver = 10, 1, 1, 5 | Size = 65536 bytes | Modified Date = 3/3/2006 8:03:22 PM | Attr = ]
hpboid.exe -> %System32%\spool\drivers\w32x86\3\HPBOID.EXE -> Hewlett-Packard Company [Ver = 1, 0, 46, 0 | Size = 73728 bytes | Modified Date = 10/16/2004 4:31:06 AM | Attr = ]
hpbpro.exe -> %System32%\spool\drivers\w32x86\3\HPBPRO.EXE -> Hewlett-Packard Company [Ver = 1, 0, 50, 0 | Size = 81920 bytes | Modified Date = 5/20/2005 9:37:12 AM | Attr = ]
hpboid.exe -> %System32%\spool\drivers\w32x86\3\HPBOID.EXE -> Hewlett-Packard Company [Ver = 1, 0, 46, 0 | Size = 73728 bytes | Modified Date = 10/16/2004 4:31:06 AM | Attr = ]
winpfind35u.exe -> %UserDesktop%\WinPFind35u\WinPFind35U.exe -> OldTimer Tools [Ver = 1.0.0.0 | Size = 307712 bytes | Modified Date = 1/31/2008 12:38:16 PM | Attr = ]

[Win32 Services - Non-Microsoft Only]
(Adobe LM Service) Adobe LM Service [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\Adobe Systems Shared\Service\Adobelmsvc.exe -> Adobe Systems [Ver = 2.67.010 | Size = 72704 bytes | Modified Date = 1/2/2007 3:16:09 PM | Attr = ]
(AOL ACS) AOL Connectivity Service [Win32_Own | Disabled | Stopped] -> %CommonProgramFiles%\AOL\ACS\AOLacsd.exe -> America Online [Ver = 3.0.0.1 | Size = 10328 bytes | Modified Date = 10/20/2004 7:40:04 AM | Attr = R ]
(AOL TopSpeedMonitor) AOL TopSpeed Monitor [Win32_Own | Disabled | Stopped] -> %CommonProgramFiles%\AOL\TopSpeed\2.0\aoltsmon.exe -> America Online, Inc [Ver = 2, 0, 0, 0 | Size = 100016 bytes | Modified Date = 10/15/2004 2:54:14 PM | Attr = ]
(Apple Mobile Device) Apple Mobile Device [Win32_Own | Auto | Running] -> %CommonProgramFiles%\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> Apple, Inc. [Ver = 1, 14, 0, 0 | Size = 110592 bytes | Modified Date = 9/6/2007 12:28:18 PM | Attr = ]
(CFSvcs) ConfigFree Service [Win32_Own | Auto | Running] -> %ProgramFiles%\TOSHIBA\ConfigFree\CFSvcs.exe -> TOSHIBA CORPORATION [Ver = 6, 0, 0, 1 | Size = 40960 bytes | Modified Date = 1/17/2005 6:38:38 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/10/2004 6:00:00 AM | Attr = ]
(DVD-RAM_Service) DVD-RAM_Service [Win32_Own | Auto | Running] -> %System32%\DVDRAMSV.exe -> Matsushita Electric Industrial Co., Ltd. [Ver = 3, 0, 0, 0 | Size = 110592 bytes | Modified Date = 8/28/2004 2:33:00 AM | Attr = ]
(IDriverT) InstallDriver Table Manager [Win32_Own | On_Demand | Stopped] -> %CommonProgramFiles%\InstallShield\Driver\11\Intel 32\IDriverT.exe -> Macrovision Corporation [Ver = 11.00.28844 | Size = 69632 bytes | Modified Date = 4/4/2005 2:41:10 AM | Attr = ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Running] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 504104 bytes | Modified Date = 1/15/2008 3:22:44 AM | Attr = ]
(McAfeeFramework) McAfee Framework Service [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\Common Framework\FrameworkService.exe -> McAfee, Inc. [Ver = 3.6.0.453 | Size = 104000 bytes | Modified Date = 11/17/2006 12:37:44 PM | Attr = ]
(McShield) McAfee McShield [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\VirusScan Enterprise\Mcshield.exe -> McAfee, Inc. [Ver = VSCORE.13.3.1.100.x86 | Size = 144960 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
(McTaskManager) McAfee Task Manager [Win32_Own | Auto | Running] -> %ProgramFiles%\McAfee\VirusScan Enterprise\VsTskMgr.exe -> McAfee, Inc. [Ver = 8.5.0.781 | Size = 54872 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
(Pml Driver HPZ12) Pml Driver HPZ12 [Win32_Own | Unknown | Stopped] -> -> File not found
(Swupdtmr) Swupdtmr [Win32_Own | Auto | Running] -> %SystemDrive%\TOSHIBA\IVP\swupdate\swupdtmr.exe -> [Ver = | Size = 40960 bytes | Modified Date = 7/12/2005 7:14:42 PM | Attr = ]
(TAPPSRV) TOSHIBA Application Service [Win32_Own | Auto | Running] -> %ProgramFiles%\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe -> TOSHIBA Corp. [Ver = 1, 0, 0, 13M | Size = 35328 bytes | Modified Date = 12/20/2005 1:22:14 PM | Attr = ]
(WinTabService) WinTab Service [Win32_Own | Auto | Running] -> %System32%\drivers\WtSrv.exe -> Tablet Driver [Ver = 4.03.02 | Size = 40960 bytes | Modified Date = 8/15/2005 5:48:19 PM | Attr = ]
(HP Port Resolver) HP Port Resolver [Win32_Own | On_Demand | Stopped] -> %System32%\spool\drivers\w32x86\3\HPBPRO.EXE -> Hewlett-Packard Company [Ver = 1, 0, 50, 0 | Size = 81920 bytes | Modified Date = 5/20/2005 9:37:12 AM | Attr = ]

[Registry - Non-Microsoft Only]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
Adobe Reader Speed Launcher -> %ProgramFiles%\Adobe\Reader 8.0\Reader\Reader_SL.exe -> Adobe Systems Incorporated [Ver = 8.0.0.0 | Size = 39792 bytes | Modified Date = 10/10/2007 7:51:55 PM | Attr = ]
AGRSMMSG -> %SystemRoot%\agrsmmsg.exe -> Agere Systems [Ver = 2.1.60.5 2.1.60.5 10/14/2005 13:29:07 | Size = 88203 bytes | Modified Date = 10/15/2005 8:29:08 AM | Attr = ]
Blaero Start Orb -> %ProgramFiles%\Blaero Start Orb\Blaero Start Orb.exe -> [Ver = | Size = 575488 bytes | Modified Date = 7/30/2006 5:32:50 PM | Attr = ]
iTunesHelper -> %ProgramFiles%\iTunes\iTunesHelper.exe -> Apple Inc. [Ver = 7.6.0.29 | Size = 267048 bytes | Modified Date = 1/15/2008 3:22:56 AM | Attr = ]
LClock -> %ProgramFiles%\LClock\LClock.exe -> [Ver = 1, 0, 0, 1 | Size = 65536 bytes | Modified Date = 9/19/2004 11:27:46 PM | Attr = ]
LogonStudio -> %ProgramFiles%\WinCustomize\LogonStudio\LogonStudio.exe -> Stardock and Luca Saggese [Ver = 1.00.0064 | Size = 987187 bytes | Modified Date = 9/3/2002 5:38:12 PM | Attr = ]
LtMoh -> %ProgramFiles%\ltmoh\ltmoh.exe -> Agere Systems [Ver = 1.75 | Size = 184320 bytes | Modified Date = 8/18/2004 5:37:44 AM | Attr = ]
McAfeeUpdaterUI -> %ProgramFiles%\McAfee\Common Framework\UdaterUI.exe -> McAfee, Inc. [Ver = 3.6.0.453 | Size = 136768 bytes | Modified Date = 11/17/2006 12:39:58 PM | Attr = ]
Pinger -> %SystemDrive%\TOSHIBA\IVP\ISM\pinger.exe -> TOSHIBA Corporation [Ver = 3.7.0.0 | Size = 151552 bytes | Modified Date = 3/17/2005 7:37:26 PM | Attr = ]
QuickTime Task -> %ProgramFiles%\QuickTime\QTTask.exe -> Apple Inc. [Ver = 7.4 | Size = 385024 bytes | Modified Date = 1/10/2008 3:27:36 PM | Attr = ]
SearchSettings -> %ProgramFiles%\Search Settings\SearchSettings.exe -> Vendio Services, Inc. [Ver = 1, 0, 0, 13 | Size = 1069920 bytes | Modified Date = 12/6/2007 11:58:18 AM | Attr = ]
ShStatEXE -> %ProgramFiles%\McAfee\VirusScan Enterprise\shstat.exe -> McAfee, Inc. [Ver = 8.5.0.781 | Size = 112216 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
SmoothView -> %ProgramFiles%\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe -> TOSHIBA Corporation [Ver = 2, 0, 0, 23 | Size = 122880 bytes | Modified Date = 4/26/2005 6:13:20 PM | Attr = ]
Styler -> %ProgramFiles%\Styler\Styler.exe -> ta2027 [Ver = 1, 4, 0, 1 | Size = 307200 bytes | Modified Date = 5/3/2006 8:48:46 AM | Attr = ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_03\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 132496 bytes | Modified Date = 9/25/2007 1:11:35 AM | Attr = ]
SynTPEnh -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe -> Synaptics, Inc. [Ver = 8.2.9 16Dec05 | Size = 761945 bytes | Modified Date = 12/16/2005 2:32:58 AM | Attr = ]
SynTPLpr -> %ProgramFiles%\Synaptics\SynTP\SynTPLpr.exe -> Synaptics, Inc. [Ver = 8.2.9 16Dec05 | Size = 82009 bytes | Modified Date = 12/16/2005 2:34:16 AM | Attr = ]
TDispVol -> %System32%\TDispVol.exe -> TOSHIBA Corporation [Ver = 3, 18, 0, 0 | Size = 73728 bytes | Modified Date = 3/11/2005 5:03:16 PM | Attr = ]
TPSMain -> %System32%\TPSMain.exe -> TOSHIBA Corporation [Ver = 1, 0, 15, 0 | Size = 282624 bytes | Modified Date = 5/31/2005 11:00:12 PM | Attr = ]
Tvs -> %ProgramFiles%\TOSHIBA\Tvs\TvsTray.exe -> TOSHIBA Corporation [Ver = 1, 0, 0, 7 | Size = 73728 bytes | Modified Date = 11/30/2005 2:25:22 PM | Attr = ]
VisualTooltip -> %ProgramFiles%\VisualTooltip\VisualToolTip.exe -> Christian Salmon [Ver = 2.0.0.0 | Size = 942080 bytes | Modified Date = 10/6/2006 7:21:32 AM | Attr = ]
WService -> %System32%\WService.exe -> Tablet Driver [Ver = 4.03.02 | Size = 28672 bytes | Modified Date = 8/15/2005 5:48:19 PM | Attr = ]
< OptionalComponents [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ ->
IMAIL-> Installed = 1 ->
MAPI-> Installed = 1 ->
MSFS-> Installed = 1 ->
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
RocketDock -> %ProgramFiles%\RocketDock\RocketDock.exe -> [Ver = | Size = 630784 bytes | Modified Date = 3/18/2007 11:05:02 PM | Attr = ]
TOSCDSPD -> %ProgramFiles%\TOSHIBA\TOSCDSPD\TOSCDSPD.exe -> TOSHIBA [Ver = 1, 0, 6, 0 | Size = 65536 bytes | Modified Date = 12/30/2004 2:32:20 AM | Attr = ]
< All Users Startup Folder > -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup ->
%AllUsersStartup%\HP Digital Imaging Monitor.lnk -> %ProgramFiles%\HP\Digital Imaging\bin\hpqtra08.exe -> Hewlett-Packard Development Company, L.P. [Ver = 70.0.170.000 | Size = 288472 bytes | Modified Date = 2/19/2006 3:21:22 AM | Attr = ]
%AllUsersStartup%\HP Photosmart Premier Fast Start.lnk -> %ProgramFiles%\HP\Digital Imaging\bin\hpqthb08.exe -> Hewlett-Packard Development Company, L.P. [Ver = 065.000.117.000 | Size = 73728 bytes | Modified Date = 2/10/2006 6:56:20 AM | Attr = ]
%AllUsersStartup%\InterVideo WinCinema Manager.lnk -> %ProgramFiles%\InterVideo\Common\Bin\WinCinemaMgr.exe -> InterVideo Inc. [Ver = IVI_MAJOR_VERSION.IVI_MINOR_VERSION | Size = 286720 bytes | Modified Date = 12/26/2005 9:55:48 PM | Attr = ]
%AllUsersStartup%\RAMASST.lnk -> %System32%\RAMASST.exe -> Matsushita Electric Industrial Co., Ltd. [Ver = 1, 1, 0, 0 | Size = 155648 bytes | Modified Date = 8/28/2004 2:37:00 AM | Attr = ]
< krp Startup Folder > -> C:\Documents and Settings\krp\Start Menu\Programs\Startup ->
%UserStartup%\Adobe Gamma.lnk -> %CommonProgramFiles%\Adobe\Calibration\Adobe Gamma Loader.exe -> Adobe Systems, Inc. [Ver = 1, 0, 0, 1 | Size = 113664 bytes | Modified Date = 3/16/2005 9:16:50 PM | Attr = ]
< SecurityProviders [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->
< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
igfxcui -> %System32%\igfxdev.dll -> Intel Corporation [Ver = 3.0.0.4436 | Size = 135168 bytes | Modified Date = 11/27/2005 11:51:04 PM | Attr = ]
< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Attachments\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Attachments\\ScanWithAntiVirus -> 2 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun -> 67108863 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 255 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallVisualStyle -> C:\WINDOWS\Resources\Themes\Royale\Royale.mss [C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\InstallTheme -> C:\WINDOWS\Resources\Themes\Royale.the [C:\WINDOWS\Resources\Themes\Royale.theme] -> File not found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ -> ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ -> ->
< CurrentVersion Policy Settings [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 0 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ -> ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ -> ->
< HOSTS File > (27 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts ->
< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> ->
HKEY_LOCAL_MACHINE\: Main\\Default_Page_URL -> http://www.yahoo.com ->
HKEY_LOCAL_MACHINE\: Main\\Default_Search_URL -> http://go.microsoft....k/?LinkId=54896 ->
HKEY_LOCAL_MACHINE\: Main\\Local Page -> %SystemRoot%\system32\blank.htm ->
HKEY_LOCAL_MACHINE\: Main\\Search Page -> http://go.microsoft....k/?LinkId=54896 ->
HKEY_LOCAL_MACHINE\: Main\\Start Page -> http://www.yahoo.com ->
HKEY_LOCAL_MACHINE\: Search\\CustomizeSearch -> http://ie.search.msn...st/srchcust.htm ->
HKEY_LOCAL_MACHINE\: Search\\SearchAssistant -> http://ie.search.msn...st/srchasst.htm ->
< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> ->
HKEY_CURRENT_USER\: Main\\Local Page -> C:\WINDOWS\system32\blank.htm ->
HKEY_CURRENT_USER\: Main\\Search Page -> http://www.microsoft...amp;ar=iesearch ->
HKEY_CURRENT_USER\: Main\\Start Page -> http://www.deviantart.com/ ->
HKEY_CURRENT_USER\: Search\\SearchAssistant -> http://www.google.com/ie ->
HKEY_CURRENT_USER\: SearchURL\\ -> about:blank[Reg Error: Value provider does not exist or could not be read.] ->
HKEY_CURRENT_USER\: URLSearchHooks\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Yahoo! Toolbar] -> File not found
HKEY_CURRENT_USER\: ProxyEnable -> 0 ->
HKEY_CURRENT_USER\: ProxyOverride -> <local> ->
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4185 domain(s) found. ->
33 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. ->
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 4200 domain(s) found. ->
33 domain(s) and sub-domain(s) not assigned to a zone.
< Trusted Sites Ranges [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 77 range(s) found. ->
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKEY_LOCAL_MACHINE] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 10/22/2006 10:08:42 PM | Attr = ]
{53707962-6F74-2D53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 1/28/2008 11:43:28 AM | Attr = ]
{5CA3D70E-1895-11CF-8E15-001234567890} [HKEY_LOCAL_MACHINE] -> %System32%\DLA\DLASHX_W.DLL [DriveLetterAccess] -> Sonic Solutions [Ver = 5.20.09a | Size = 110652 bytes | Modified Date = 10/6/2005 7:20:00 AM | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_03\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 501136 bytes | Modified Date = 9/25/2007 1:11:33 AM | Attr = ]
{7DB2D5A0-7241-4E79-B68D-6309F01C5231} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\McAfee\VirusScan Enterprise\ScriptCl.dll [scriptproxy] -> McAfee, Inc. [Ver = VSCORE.13.3.1.100.x86 | Size = 67136 bytes | Modified Date = 11/30/2006 7:50:00 AM | Attr = ]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar ->
{D2F8F919-690B-4EA2-9FA7-A203D1E04F75} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Styler\TB\StylerTB.dll [StylerToolBar] -> StyleFantasist [Ver = 1, 1, 8, 0 | Size = 102400 bytes | Modified Date = 5/2/2006 2:31:26 AM | Attr = ]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ ->
WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened. [Yahoo! Toolbar] -> File not found
< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_03\bin\npjpi160_03.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 132496 bytes | Modified Date = 9/25/2007 1:11:34 AM | Attr = ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} [HKEY_CURRENT_USER] -> %ProgramFiles%\Java\jre1.6.0_03\bin\ssv.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 501136 bytes | Modified Date = 9/25/2007 1:11:33 AM | Attr = ]
{d9288080-1baa-4bc4-9cf8-a92d743db949}:Exec -> %SystemDrive%\Documents and Settings\krp\Start Menu\Programs\IMVU\Run IMVU.lnk [Run IMVU] -> File not found
{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll [Spybot - Search & Destroy Configuration] -> Safer Networking Limited [Ver = 1, 5, 0, 11 | Size = 1554256 bytes | Modified Date = 1/28/2008 11:43:28 AM | Attr = ]
{FB5F1910-F110-11d2-BB9E-00C04F795683}:Exec -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> File not found
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\ ->
CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Java\jre1.6.0_03\bin\npjpi160_03.dll [Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.30.5 | Size = 132496 bytes | Modified Date = 9/25/2007 1:11:34 AM | Attr = ]
CmdMapping\\{FB5F1910-F110-11d2-BB9E-00C04F795683} [HKEY_LOCAL_MACHINE] -> %ProgramFiles%\Messenger\msmsgs.exe [Messenger] -> File not found
< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ ->
&Search -> -> File not found
< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ ->
PluginsPageFriendlyName -> Microsoft ActiveX Gallery ->
PluginsPage -> http://activex.micro...d...=%s&mime=%s ->
< DNS Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ ->
{1712BD3B-DD04-4B6B-ABBB-CD09702BDF92} -> (1394 Net Adapter) ->
{26DB7B9D-E704-4F87-8FCA-5DEDFD3BFBE8} -> () ->
{49E05315-5A60-4F3D-9488-CE2BC905E2CA} -> (Intel® PRO/100 VE Network Connection) ->
{CACFD00F-CC83-47BE-BC57-CA4616CA6FCB} -> (Intel® PRO/Wireless 3945ABG Network Connection) ->
< Protocol Handlers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ ->
ipp: [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened.[] -> File not found
msdaipp: [HKEY_LOCAL_MACHINE] -> Reg Error: Key does not exist or could not be opened.[] -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{17492023-C23A-453E-A040-C7C580BBF700}[HKEY_LOCAL_MACHINE] -> http://download.micr...heckControl.cab[Windows Genuine Advantage Validation Tool] ->
{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}[HKEY_LOCAL_MACHINE] -> C:\Program Files\Yahoo!\Common\Yinsthelper.dll[Reg Error: Key does not exist or could not be opened.] ->
{6414512B-B978-451D-A0D8-FCFDF33E833C}[HKEY_LOCAL_MACHINE] -> http://update.micros...b?1167770917226[WUWebControl Class] ->
{8AD9C840-044E-11D1-B3E9-00805F499D93}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/...indows-i586.cab[Java Plug-in 1.6.0_03] ->
{C3F79A2B-B9B4-4A66-B012-3EE46475B072}[HKEY_LOCAL_MACHINE] -> http://messenger.zon...nt.cab56907.cab[MessengerStatsClient Class] ->
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/...indows-i586.cab[Java Plug-in 1.6.0_03] ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}[HKEY_LOCAL_MACHINE] -> http://java.sun.com/...indows-i586.cab[Java Plug-in 1.6.0_03] ->

Edited by Lucy Diamond, 03 February 2008 - 06:29 PM.

  • 0

#7
Lucy Diamond
Posted 03 February 2008 - 06:31 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
WinPFind Part 2


[Files/Folders - Created Within 30 days]
ComboFix(2) -> %SystemDrive%\ComboFix(2) -> [Folder | Created Date = 2/3/2008 3:58:47 PM | Attr = ]
MSOCache -> %SystemDrive%\MSOCache -> [Folder | Created Date = 2/3/2008 3:02:13 PM | Attr = RH ]
OutputFolder -> %SystemDrive%\OutputFolder -> [Folder | Created Date = 1/13/2008 4:14:47 PM | Attr = ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Created Date = 2/3/2008 4:02:33 PM | Attr = ]
aac_parser.ax -> %System32%\aac_parser.ax -> [Ver = 1.1 | Size = 81920 bytes | Created Date = 1/12/2008 7:59:16 PM | Attr = RHS]
AVEQT.dll -> %System32%\AVEQT.dll -> [Ver = | Size = 28672 bytes | Created Date = 1/13/2008 4:13:27 PM | Attr = ]
AVERM.dll -> %System32%\AVERM.dll -> [Ver = 1, 0, 0, 9 | Size = 129024 bytes | Created Date = 1/13/2008 4:13:27 PM | Attr = ]
avisynth.dll -> %System32%\avisynth.dll -> The Public [Ver = 2, 5, 8, 0 | Size = 318976 bytes | Created Date = 1/12/2008 7:14:38 PM | Attr = ]
AVSredirect.dll -> %System32%\AVSredirect.dll -> [Ver = | Size = 27648 bytes | Created Date = 1/12/2008 8:00:16 PM | Attr = ]
CoreAAC.ax -> %System32%\CoreAAC.ax -> [Ver = 1, 2, 0, 575 | Size = 175104 bytes | Created Date = 1/12/2008 7:59:17 PM | Attr = RHS]
devil.dll -> %System32%\devil.dll -> Abysmal Software [Ver = 1.6.6 | Size = 719872 bytes | Created Date = 1/12/2008 7:14:38 PM | Attr = ]
DiracSplitter.ax -> %System32%\DiracSplitter.ax -> Gabest [Ver = 1, 0, 0, 0 | Size = 179200 bytes | Created Date = 1/12/2008 7:59:18 PM | Attr = RHS]
fdsv.exe -> %System32%\fdsv.exe -> Smallfrogs Studio [Ver = 1.0.0.10 | Size = 73728 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
grep.exe -> %System32%\grep.exe -> [Ver = | Size = 80412 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
i420vfw.dll -> %System32%\i420vfw.dll -> www.helixcommunity.org [Ver = R1.02 | Size = 70656 bytes | Created Date = 1/12/2008 8:00:15 PM | Attr = ]
JwldButn2b.ocx -> %System32%\JwldButn2b.ocx -> Veign Chris Hanscom Http://www.veign.com [Ver = 2.2.0.3 | Size = 221184 bytes | Created Date = 1/10/2008 2:23:40 PM | Attr = ]
lame_enc.dll -> %System32%\lame_enc.dll -> [Ver = | Size = 237568 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
mpgfiltr.ax -> %System32%\mpgfiltr.ax -> Essien Research & Development [Ver = 2.51 | Size = 856064 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
NCTAudioCompress3.dll -> %System32%\NCTAudioCompress3.dll -> Online Media Technologies Ltd. [Ver = 1,1,3,694 | Size = 2846720 bytes | Created Date = 1/10/2008 2:31:14 PM | Attr = ]
NCTAudioFile2.dll -> %System32%\NCTAudioFile2.dll -> NCT Company Ltd. [Ver = 2,6,1,648 | Size = 877568 bytes | Created Date = 1/10/2008 2:31:12 PM | Attr = ]
NCTAudioFormatSettings3.dll -> %System32%\NCTAudioFormatSettings3.dll -> Online Media Technologies Ltd. [Ver = 1,1,1,123 | Size = 90112 bytes | Created Date = 1/10/2008 2:31:15 PM | Attr = ]
NCTAudioPlayer2.dll -> %System32%\NCTAudioPlayer2.dll -> Online Media Technologies Ltd. [Ver = 2,6,2,281 | Size = 467456 bytes | Created Date = 1/10/2008 2:31:13 PM | Attr = ]
NCTQuickTimeFile.dll -> %System32%\NCTQuickTimeFile.dll -> Online Media Technologies Company Ltd. [Ver = 1,6,3,1829 | Size = 249856 bytes | Created Date = 1/10/2008 2:31:17 PM | Attr = ]
NCTVideoCoreM.dll -> %System32%\NCTVideoCoreM.dll -> NCT Company Ltd. [Ver = 1,6,2,1268 | Size = 495104 bytes | Created Date = 1/10/2008 2:31:16 PM | Attr = ]
NCTVideoPlayer.dll -> %System32%\NCTVideoPlayer.dll -> NCT Company Ltd. [Ver = 1,5,1,175 | Size = 201216 bytes | Created Date = 1/10/2008 2:31:18 PM | Attr = ]
PropertyGrid.ocx -> %System32%\PropertyGrid.ocx -> [Ver = 1.00 | Size = 364544 bytes | Created Date = 1/9/2008 4:09:06 PM | Attr = ]
QuickTime.qts -> %System32%\QuickTime.qts -> Apple Inc. [Ver = 7.4 | Size = 57344 bytes | Created Date = 1/10/2008 3:27:44 PM | Attr = ]
QuickTimeVR.qtx -> %System32%\QuickTimeVR.qtx -> Apple Inc. [Ver = 7.4 | Size = 90112 bytes | Created Date = 1/10/2008 3:27:46 PM | Attr = ]
ReyXpBasics.tlb -> %System32%\ReyXpBasics.tlb -> [Ver = | Size = 208500 bytes | Created Date = 1/9/2008 4:09:06 PM | Attr = ]
RLOgg.ax -> %System32%\RLOgg.ax -> RadLight [Ver = 1.0.0.2 | Size = 186880 bytes | Created Date = 1/12/2008 7:59:21 PM | Attr = RHS]
RLSpeexDec.ax -> %System32%\RLSpeexDec.ax -> [Ver = 1, 0, 0, 0 | Size = 51712 bytes | Created Date = 1/12/2008 7:59:22 PM | Attr = RHS]
RLTheoraDec.ax -> %System32%\RLTheoraDec.ax -> RadLight, LLC [Ver = 1, 0, 0, 3 | Size = 67584 bytes | Created Date = 1/12/2008 7:59:22 PM | Attr = RHS]
RLVorbisDec.ax -> %System32%\RLVorbisDec.ax -> RadLight [Ver = 1, 0, 1, 1 | Size = 92672 bytes | Created Date = 1/12/2008 7:59:22 PM | Attr = RHS]
RMBin -> %System32%\RMBin -> [Folder | Created Date = 1/10/2008 2:31:08 PM | Attr = ]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
sed.exe -> %System32%\sed.exe -> [Ver = | Size = 98816 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
SkinCrafter.dll -> %System32%\SkinCrafter.dll -> DMSoft Technologies [Ver = 1, 8, 3, 1 | Size = 475136 bytes | Created Date = 1/10/2008 2:31:08 PM | Attr = ]
Smab.dll -> %System32%\Smab.dll -> [Ver = | Size = 394240 bytes | Created Date = 1/12/2008 8:00:18 PM | Attr = ]
SSubTmr6.dll -> %System32%\SSubTmr6.dll -> vbAccelerator [Ver = 1.01.0003 | Size = 40960 bytes | Created Date = 1/10/2008 2:23:40 PM | Attr = ]
swreg.exe -> %System32%\swreg.exe -> SteelWerX [Ver = 3.0.0.0 | Size = 161792 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
swsc.exe -> %System32%\swsc.exe -> SteelWerX [Ver = 2.0.0.5 | Size = 136704 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
swxcacls.exe -> %System32%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
temp_0000_60390.aok -> %System32%\temp_0000_60390.aok -> [Ver = | Size = 280 bytes | Created Date = 1/13/2008 4:14:52 PM | Attr = ]
test.aok -> %System32%\test.aok -> [Ver = | Size = 131 bytes | Created Date = 1/13/2008 4:13:58 PM | Attr = ]
vbalExpBar6.ocx -> %System32%\vbalExpBar6.ocx -> vbAccelerator [Ver = 1.00.0009 | Size = 200704 bytes | Created Date = 1/10/2008 2:23:40 PM | Attr = ]
vbalIml6.ocx -> %System32%\vbalIml6.ocx -> vbAccelerator [Ver = 2.00.0001 | Size = 94208 bytes | Created Date = 1/10/2008 2:23:40 PM | Attr = ]
VFind.exe -> %System32%\VFind.exe -> [Ver = | Size = 49152 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
VideoEdit.ocx -> %System32%\VideoEdit.ocx -> Viscom Software www.viscomsoft.com [Ver = 2.5 | Size = 245760 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
viscomaudiodata.dll -> %System32%\viscomaudiodata.dll -> Viscom Software [Ver = 9.00 | Size = 94208 bytes | Created Date = 1/10/2008 2:23:40 PM | Attr = ]
viscomaudioencoder.dll -> %System32%\viscomaudioencoder.dll -> Viscom Software [Ver = 9.00 | Size = 110592 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
viscomframe.dll -> %System32%\viscomframe.dll -> L544⑩ Technology [Ver = 8.10 | Size = 90112 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
viscomqtde.dll -> %System32%\viscomqtde.dll -> [Ver = 4.0.19.0 | Size = 598016 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
viscomqtenc.dll -> %System32%\viscomqtenc.dll -> Viscom Software www.viscomsoft.com [Ver = 1.0 | Size = 147456 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
viscomtran.dll -> %System32%\viscomtran.dll -> Viscom Software www.viscomsoft.com [Ver = 1.0 | Size = 98304 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
viscomwave.dll -> %System32%\viscomwave.dll -> Viscom Software [Ver = | Size = 81920 bytes | Created Date = 1/10/2008 2:23:41 PM | Attr = ]
x.264.exe -> %System32%\x.264.exe -> [Ver = | Size = 240128 bytes | Created Date = 1/12/2008 8:00:15 PM | Attr = ]
zip.exe -> %System32%\zip.exe -> [Ver = | Size = 68096 bytes | Created Date = 2/3/2008 4:01:22 PM | Attr = ]
avisplitter.INI -> %SystemRoot%\avisplitter.INI -> [Ver = | Size = 38 bytes | Created Date = 1/9/2008 6:00:43 PM | Attr = ]
DEBS.scr -> %SystemRoot%\DEBS.scr -> Comis [Ver = 1, 0, 0, 1 | Size = 2399315 bytes | Created Date = 1/13/2008 10:26:02 PM | Attr = ]
erdnt -> %SystemRoot%\erdnt -> [Folder | Created Date = 2/3/2008 4:03:12 PM | Attr = ]
1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
HB_CHRON_SS_PC dir -> %SystemRoot%\HB_CHRON_SS_PC dir -> [Folder | Created Date = 1/21/2008 7:18:50 PM | Attr = ]
meta4.exe -> %SystemRoot%\meta4.exe -> [Ver = | Size = 217073 bytes | Created Date = 1/12/2008 8:00:15 PM | Attr = ]
MOTA113.exe -> %SystemRoot%\MOTA113.exe -> [Ver = | Size = 66560 bytes | Created Date = 1/12/2008 8:00:16 PM | Attr = ]
Nircmd.exe -> %SystemRoot%\Nircmd.exe -> NirSoft [Ver = 2.00 | Size = 51200 bytes | Created Date = 2/3/2008 4:01:23 PM | Attr = ]
SHELLNEW -> %SystemRoot%\SHELLNEW -> [Folder | Created Date = 2/3/2008 2:53:48 PM | Attr = ]
TEMP -> %SystemRoot%\TEMP -> [Folder | Created Date = 2/3/2008 4:17:19 PM | Attr = ]
wininit.ini -> %SystemRoot%\wininit.ini -> [Ver = | Size = 149 bytes | Created Date = 1/31/2008 7:26:21 PM | Attr = ]
x2.64.exe -> %SystemRoot%\x2.64.exe -> [Ver = | Size = 502784 bytes | Created Date = 1/12/2008 8:00:15 PM | Attr = ]
MP Scheduled Scan.job -> %SystemRoot%\tasks\MP Scheduled Scan.job -> [Ver = | Size = 330 bytes | Created Date = 1/21/2008 9:09:42 PM | Attr = H ]

[Files/Folders - Modified Within 30 days]
ComboFix(2) -> %SystemDrive%\ComboFix(2) -> [Folder | Modified Date = 2/3/2008 3:59:03 PM | Attr = ]
Config.Msi -> %SystemDrive%\Config.Msi -> [Folder | Modified Date = 2/3/2008 5:51:39 PM | Attr = HS]
hiberfil.sys -> %SystemDrive%\hiberfil.sys -> [Ver = | Size = 1063309312 bytes | Modified Date = 2/3/2008 4:10:50 PM | Attr = HS]
MSOCache -> %SystemDrive%\MSOCache -> [Folder | Modified Date = 2/3/2008 3:02:13 PM | Attr = RH ]
OutputFolder -> %SystemDrive%\OutputFolder -> [Folder | Modified Date = 1/13/2008 4:14:59 PM | Attr = ]
Program Files -> %ProgramFiles% -> [Folder | Modified Date = 2/3/2008 4:19:04 PM | Attr = ]
QooBox -> %SystemDrive%\QooBox -> [Folder | Modified Date = 2/3/2008 6:03:08 PM | Attr = ]
QUARANTINE -> %SystemDrive%\QUARANTINE -> [Folder | Modified Date = 2/3/2008 5:59:28 PM | Attr = ]
TEMP -> %SystemDrive%\TEMP -> [Folder | Modified Date = 1/31/2008 5:40:31 PM | Attr = ]
WINDOWS -> %SystemRoot% -> [Folder | Modified Date = 2/3/2008 6:02:43 PM | Attr = ]
etc -> %System32%\drivers\etc -> [Folder | Modified Date = 2/3/2008 4:13:04 PM | Attr = ]
1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp ->
hosts -> %System32%\drivers\etc\hosts -> [Ver = | Size = 27 bytes | Modified Date = 2/3/2008 4:13:04 PM | Attr = ]
avsplugin -> %System32%\avsplugin -> [Folder | Modified Date = 1/12/2008 7:14:38 PM | Attr = ]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->
CatRoot2 -> %System32%\CatRoot2 -> [Folder | Modified Date = 2/3/2008 2:38:04 PM | Attr = ]
config -> %System32%\config -> [Folder | Modified Date = 2/3/2008 4:09:34 PM | Attr = ]
DLA -> %System32%\DLA -> [Folder | Modified Date = 2/3/2008 4:11:03 PM | Attr = ]
dllcache -> %System32%\dllcache -> [Folder | Modified Date = 1/9/2008 7:10:10 AM | Attr = RHS]
drivers -> %System32%\drivers -> [Folder | Modified Date = 2/3/2008 4:17:20 PM | Attr = ]
FNTCACHE.DAT -> %System32%\FNTCACHE.DAT -> [Ver = | Size = 1617320 bytes | Modified Date = 2/3/2008 4:12:29 PM | Attr = ]
Macromed -> %System32%\Macromed -> [Folder | Modified Date = 1/19/2008 11:42:02 PM | Attr = ]
QuickTime.qts -> %System32%\QuickTime.qts -> Apple Inc. [Ver = 7.4 | Size = 57344 bytes | Modified Date = 1/10/2008 3:27:44 PM | Attr = ]
QuickTimeVR.qtx -> %System32%\QuickTimeVR.qtx -> Apple Inc. [Ver = 7.4 | Size = 90112 bytes | Modified Date = 1/10/2008 3:27:46 PM | Attr = ]
Restore -> %System32%\Restore -> [Folder | Modified Date = 1/9/2008 4:56:44 PM | Attr = ]
RMBin -> %System32%\RMBin -> [Folder | Modified Date = 1/10/2008 2:31:10 PM | Attr = ]
temp_0000_60390.aok -> %System32%\temp_0000_60390.aok -> [Ver = | Size = 280 bytes | Modified Date = 1/13/2008 4:14:52 PM | Attr = ]
test.aok -> %System32%\test.aok -> [Ver = | Size = 131 bytes | Modified Date = 1/13/2008 4:13:58 PM | Attr = ]
wbem -> %System32%\wbem -> [Folder | Modified Date = 1/29/2008 7:02:06 PM | Attr = ]
wpa.dbl -> %System32%\wpa.dbl -> [Ver = | Size = 1158 bytes | Modified Date = 2/3/2008 4:12:52 PM | Attr = ]
$hf_mig$ -> %SystemRoot%\$hf_mig$ -> [Folder | Modified Date = 1/8/2008 7:55:06 PM | Attr = H ]
1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->
assembly -> %SystemRoot%\assembly -> [Folder | Modified Date = 2/3/2008 3:27:07 PM | Attr = R S]
avisplitter.INI -> %SystemRoot%\avisplitter.INI -> [Ver = | Size = 38 bytes | Modified Date = 1/9/2008 6:57:16 PM | Attr = ]
bootstat.dat -> %SystemRoot%\bootstat.dat -> [Ver = | Size = 2048 bytes | Modified Date = 2/3/2008 4:10:58 PM | Attr = S]
DEBS.scr -> %SystemRoot%\DEBS.scr -> Comis [Ver = 1, 0, 0, 1 | Size = 2399315 bytes | Modified Date = 1/13/2008 10:26:02 PM | Attr = ]
Debug -> %SystemRoot%\Debug -> [Folder | Modified Date = 1/31/2008 4:42:45 PM | Attr = ]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files -> [Folder | Modified Date = 1/21/2008 9:04:42 PM | Attr = S]
erdnt -> %SystemRoot%\erdnt -> [Folder | Modified Date = 2/3/2008 4:08:45 PM | Attr = ]
Fonts -> %SystemRoot%\Fonts -> [Folder | Modified Date = 2/3/2008 4:07:59 PM | Attr = R S]
HB_CHRON_SS_PC dir -> %SystemRoot%\HB_CHRON_SS_PC dir -> [Folder | Modified Date = 1/21/2008 7:18:51 PM | Attr = ]
impborl.dll -> %SystemRoot%\impborl.dll -> [Ver = | Size = 12288 bytes | Modified Date = 1/21/2008 7:19:09 PM | Attr = ]
inf -> %SystemRoot%\inf -> [Folder | Modified Date = 1/21/2008 9:06:36 PM | Attr = H ]
Installer -> %SystemRoot%\Installer -> [Folder | Modified Date = 2/3/2008 5:51:39 PM | Attr = HS]
LogonStudio.ini -> %SystemRoot%\LogonStudio.ini -> [Ver = | Size = 24 bytes | Modified Date = 2/3/2008 4:14:44 PM | Attr = ]
machine.ver -> %SystemRoot%\machine.ver -> [Ver = | Size = 3833 bytes | Modified Date = 1/26/2008 9:41:23 AM | Attr = ]
Minidump -> %SystemRoot%\Minidump -> [Folder | Modified Date = 1/31/2008 8:29:36 PM | Attr = ]
mozver.dat -> %SystemRoot%\mozver.dat -> [Ver = | Size = 4661 bytes | Modified Date = 1/19/2008 11:46:30 PM | Attr = ]
Prefetch -> %SystemRoot%\Prefetch -> [Folder | Modified Date = 2/3/2008 4:14:59 PM | Attr = ]
QTFont.qfn -> %SystemRoot%\QTFont.qfn -> [Ver = | Size = 54156 bytes | Modified Date = 2/3/2008 4:15:05 PM | Attr = H ]
Registration -> %SystemRoot%\Registration -> [Folder | Modified Date = 2/3/2008 4:12:14 PM | Attr = ]
SHELLNEW -> %SystemRoot%\SHELLNEW -> [Folder | Modified Date = 2/3/2008 3:15:51 PM | Attr = ]
system.ini -> %SystemRoot%\system.ini -> [Ver = | Size = 293 bytes | Modified Date = 2/3/2008 6:02:43 PM | Attr = ]
system32 -> %System32% -> [Folder | Modified Date = 2/3/2008 6:02:12 PM | Attr = ]
Tasks -> %SystemRoot%\Tasks -> [Folder | Modified Date = 2/3/2008 6:00:33 PM | Attr = S]
TEMP -> %SystemRoot%\TEMP -> [Folder | Modified Date = 2/3/2008 6:21:20 PM | Attr = ]
win.ini -> %SystemRoot%\win.ini -> [Ver = | Size = 945 bytes | Modified Date = 2/3/2008 5:51:40 PM | Attr = ]
wininit.ini -> %SystemRoot%\wininit.ini -> [Ver = | Size = 149 bytes | Modified Date = 1/31/2008 7:26:21 PM | Attr = ]
WinSxS -> %SystemRoot%\WinSxS -> [Folder | Modified Date = 2/3/2008 2:22:53 PM | Attr = ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job -> [Ver = | Size = 284 bytes | Modified Date = 1/12/2008 7:29:02 PM | Attr = ]
Check Updates for Windows Live Toolbar.job -> %SystemRoot%\tasks\Check Updates for Windows Live Toolbar.job -> [Ver = | Size = 352 bytes | Modified Date = 2/3/2008 5:25:06 PM | Attr = ]
MP Scheduled Scan.job -> %SystemRoot%\tasks\MP Scheduled Scan.job -> [Ver = | Size = 330 bytes | Modified Date = 2/3/2008 4:31:29 PM | Attr = H ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT -> [Ver = | Size = 6 bytes | Modified Date = 2/3/2008 4:11:18 PM | Attr = H ]
qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat -> [Ver = | Size = 5857 bytes | Modified Date = 2/3/2008 4:12:59 PM | Attr = ]
qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat -> [Ver = | Size = 5857 bytes | Modified Date = 2/3/2008 4:12:59 PM | Attr = ]
opa11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat -> [Ver = | Size = 11140 bytes | Modified Date = 11/29/2007 10:30:29 PM | Attr = ]
opa12.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa12.dat -> [Ver = | Size = 8578 bytes | Modified Date = 2/3/2008 3:28:35 PM | Attr = ]
Blaero Start Orb.exe -> C:\Documents and Settings\krp\Local Settings\Temp\{4B2165AC-47F9-463D-9B81-B73E41685938}\Blaero Start Orb.exe -> [Ver = | Size = 521216 bytes | Modified Date = 7/30/2006 7:32:48 PM | Attr = ]
Perflib_Perfdata_4d0.dat -> C:\WINDOWS\TEMP\Perflib_Perfdata_4d0.dat -> [Ver = | Size = 16384 bytes | Modified Date = 2/3/2008 5:45:30 PM | Attr = ]

< End of report >
[/code]
  • 0

#8
Essexboy
Posted 04 February 2008 - 01:44 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi Lucy that looks good how is your computer running now ?

Start WinPFind3U. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Files/Folders - Created Within 30 days]
YN -> 3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
YN -> 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
[Files/Folders - Modified Within 30 days]
YN -> 1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp
YN -> 3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
YN -> 1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp
[Empty Temp Folders]


The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new Hijackthis log.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.


You do not appear to have an Antispy programme - so I would like you to run this one to clear any orphan registry entries that I missed, it is a free programme and quite good

Download and then run SuperAntispyware
  • On the first page select Check for Updates
  • On completion select SCAN YOUR COMPUTER
  • On the next page select COMPLETE SCAN and tick ALL your drives
  • The next stage will take a while as your entire drive(s), memory and registry are scanned
  • When it has completed click NEXT
  • The next screen shows the problems found click OK
  • On the next screen place a tick against all items and select NEXT
  • Now to get the log Go to the PREFERENCES button on the right bottom
  • Select the STATISTICS/LOG tab
  • Highlight the scan just completed and click VIEW LOG
  • This will open a notepad text file copy and paste this to your next reply

Logs required : Winpfind report, Superantispyware log and a new Hijackthis :)
  • 0

#9
Lucy Diamond
Posted 04 February 2008 - 11:13 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
It's working so much better

Win log
[Files/Folders - Created Within 30 days]
[Files/Folders - Modified Within 30 days]
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\krp\Local Settings\Temp\{4B2165AC-47F9-463D-9B81-B73E41685938}\Blaero Start Orb.exe scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\krp\Local Settings\Temp\NAILogs\UpdaterUI_TOSHIBA-USER.log scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\krp\Local Settings\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\krp\Local Settings\Temp\~DFA18F.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4d0.dat scheduled to be deleted on reboot.
User temp folders emptied.
SystemRoot temp folder emptied.
IE temp folders emptied
RecycleBin -> emptied.
< End of fix log >
WinPFind35U Version Beta42 fix logfile created on 02042008_220025

Super Log
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/04/2008 at 11:01 PM

Application Version : 3.9.1008

Core Rules Database Version : 3395
Trace Rules Database Version: 1387

Scan type : Complete Scan
Total Scan Time : 00:56:25

Memory items scanned : 642
Memory threats detected : 0
Registry items scanned : 7754
Registry threats detected : 0
File items scanned : 66498
File threats detected : 9

Adware.180solutions/ZangoSearch
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP342\A0079590.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP342\A0079592.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP342\A0079593.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP342\A0079596.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP342\A0079600.DLL

Adware.Vundo-Variant/Small-A
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP363\A0083775.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP363\A0083776.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP365\A0083963.DLL

Adware.Vundo-Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{4B1AEA69-B95E-4955-A6A6-502CD89CDA69}\RP380\A0089733.DLL
  • 0

#10
Lucy Diamond
Posted 04 February 2008 - 11:14 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:09:55 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\DRIVERS\WtSrv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\WService.EXE
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\DOCUME~1\krp\LOCALS~1\Temp\{800F0980-E234-4FD9-BD37-3F27DCA83C21}\Blaero Start Orb.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deviantart.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [WService] WService.EXE
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &Search - ?p=ZNfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\krp\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1167770917226
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\system32\DRIVERS\WtSrv.exe

--
End of file - 11804 bytes
  • 0

#11
Essexboy
Posted 05 February 2008 - 01:16 PM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Excellent, the Superantispyware results were just for old stuff....

Now the best part of the day ----- Your log now appears clean :)

Double click Winpfind35 once again and you should see a CleanUp! button, press that button, you may get prompted by your firewall that Winpfind wants to contact the internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself



Now to get you off to a good start we will re-set your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your your restore point but this is my method:

1. Select Start > All Programs > Accessories > System tools > System Restore.
2. On the dialogue box that appears select Create a Restore Point
3. Click NEXT
4. Enter a name e.g. Clean
5. Click CREATE

You now have a clean restore point, to get rid of the bad ones:

1. Select Start > All Programs > Accessories > System tools > Disk Cleanup.
2. In the Drop down box that appears select your main drive e.g. C
3. Click OK
4. The System will do some calculation and the display a dialogue box with TABS
5. Select the More Options Tab.
6. At the bottom will be a system restore box with a CLEANUP button click this
7. Accept the Warning and select OK again, the program will close and you are done



Now that you are clean, to help protect your computer in the future I recommend that you get the following free program:
  • SpywareBlaster to help prevent spyware from installing in the first place.
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Keep safe :)
  • 0

#12
Lucy Diamond
Posted 05 February 2008 - 07:06 PM

Lucy Diamond

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Thank you so much for the help, my laptop is back to normal. you were a major help.
  • 0

#13
Essexboy
Posted 06 February 2008 - 02:57 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP