alvarez Posted October 31, 2008 Report Share Posted October 31, 2008 (edited) Computer being slowed down; occasional screen flickering and occasional pop ups to random advertising sites is all that I can notice.another.This is a brand new computer can someone please help Logfile of Trend Micro HijackThis v2.0.2Scan saved at 4:37:40 PM, on 31/10/2008Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v7.00 (7.00.6001.18000)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEc:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Dell\DellDock\DellDock.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\RtHDVCpl.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Dell\MediaDirect\PCMService.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Alwil Software\Avast4\ashDisp.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Windows\ehome\ehtray.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Windows\System32\rundll32.exeC:\Windows\ehome\ehmsas.exeC:\Windows\System32\rundll32.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Windows\system32\wuauclt.exeC:\Program Files\Winamp\winamp.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\thing\Documents\HJT\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exeO4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exeO4 - HKLM\..\Run: [updReg] C:\Windows\UpdReg.EXEO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkeyO4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll,cO4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\thing\AppData\Local\Temp\byXPHyxY.dll,#1O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'Default user')O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exeO4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLLO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dllO23 - Service: McAfee Application Installer Cleanup (0101641225429339) (0101641225429339mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\010164~1.EXEO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exeO23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exeO23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 11097 bytes Edited October 31, 2008 by Rorschach112 removed links Link to post Share on other sites
Rorschach112 Posted October 31, 2008 Report Share Posted October 31, 2008 HelloDisable resident protections (Antivirus...); you'll re-enable them after the scanDownload Lop S&D < hereDouble-click Lop S&D.exeChoose the language, then choose Option 1 (Search)Wait till the end of the scanPost the log which is created: (%SystemDrive%\lopR.txt) Link to post Share on other sites
alvarez Posted November 1, 2008 Author Report Share Posted November 1, 2008 --------------------\\ Lop S&D 4.2.4-9 XP/Vista Microsoft® Windows Vistaâ„¢ Home Premium ( v6.0.6001 ) Service Pack 1 X86-based PC ( Multiprocessor Free : Intel® Core2 Quad CPU Q6600 @ 2.40GHz ) BIOS : Phoenix - AwardBIOS v6.00PG USER : thing ( Administrator ) BOOT : Normal boot C:\ (Local Disk) - NTFS - Total:450 Go (Free:347 Go) D:\ (Local Disk) - NTFS - Total:14 Go (Free:10 Go) E:\ (CD or DVD) F:\ (USB) G:\ (USB) H:\ (USB) I:\ (USB) J:\ (CD or DVD) "C:\Lop SD" ( MAJ : 30-10-2008|21:58 ) Option : [1] ( Sat 01/11/2008|11:22 ) [ UAC => 1 ] --------------------\\ Listing folders in Local [29/10/2008|09:40] C:\Users\thing\AppData\Local\<DIR> Adobe [12/10/2008|01:54] C:\Users\thing\AppData\Local\<JUNCTION> Application Data [12/10/2008|01:56] C:\Users\thing\AppData\Local\<DIR> ATI [01/11/2008|11:20] C:\Users\thing\AppData\Local\6,836 d3d9caps.dat [30/10/2008|07:58] C:\Users\thing\AppData\Local\245,760 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [29/10/2008|09:11] C:\Users\thing\AppData\Local\108,064 GDIPFONTCACHEV1.DAT [12/10/2008|02:49] C:\Users\thing\AppData\Local\<DIR> Google [12/10/2008|01:54] C:\Users\thing\AppData\Local\<JUNCTION> History [01/11/2008|11:19] C:\Users\thing\AppData\Local\4,089,760 IconCache.db [12/10/2008|01:56] C:\Users\thing\AppData\Local\<DIR> MediaDirect [27/10/2008|07:00] C:\Users\thing\AppData\Local\<DIR> Microsoft [13/10/2008|10:25] C:\Users\thing\AppData\Local\<DIR> Microsoft Games [22/10/2008|04:55] C:\Users\thing\AppData\Local\<DIR> Microsoft Help [12/10/2008|07:21] C:\Users\thing\AppData\Local\<DIR> Mozilla [12/10/2008|02:03] C:\Users\thing\AppData\Local\<DIR> Stardock_Corporation [12/10/2008|07:15] C:\Users\thing\AppData\Local\<DIR> SupportSoft [01/11/2008|11:21] C:\Users\thing\AppData\Local\<DIR> Temp [12/10/2008|01:54] C:\Users\thing\AppData\Local\<JUNCTION> Temporary Internet Files [13/10/2008|03:59] C:\Users\thing\AppData\Local\<DIR> VirtualStore --------------------\\ Scheduled Tasks located in C:\Windows\Tasks [01/11/2008 11:20 AM][--a------] C:\Windows\tasks\RtlNICDiagVistaStart.job [01/11/2008 11:20 AM][--ah-----] C:\Windows\tasks\SA.DAT [01/11/2008 11:19 AM][--a------] C:\Windows\tasks\SCHEDLGU.TXT --------------------\\ Listing Folders in C:\ProgramData [29/10/2008|09:42] C:\ProgramData\<DIR> Adobe [12/10/2008|01:51] C:\ProgramData\<JUNCTION> Application Data [12/10/2008|01:56] C:\ProgramData\<DIR> ATI [06/09/2008|02:48] C:\ProgramData\<DIR> Creative [06/09/2008|02:48] C:\ProgramData\<DIR> Creative Labs [06/09/2008|03:04] C:\ProgramData\<DIR> CyberLink [06/09/2008|03:06] C:\ProgramData\<DIR> Dell [12/10/2008|01:51] C:\ProgramData\<JUNCTION> Desktop [12/10/2008|01:51] C:\ProgramData\<JUNCTION> Documents [12/10/2008|01:51] C:\ProgramData\<JUNCTION> Favorites [29/10/2008|09:06] C:\ProgramData\<DIR> FLEXnet [06/09/2008|02:54] C:\ProgramData\<DIR> Google [22/10/2008|04:23] C:\ProgramData\429 hpzinstall.log [12/10/2008|01:54] C:\ProgramData\<DIR> McAfee [12/10/2008|08:12] C:\ProgramData\<DIR> Messenger Plus! [22/10/2008|04:58] C:\ProgramData\<DIR> Microsoft [22/10/2008|05:01] C:\ProgramData\<DIR> Microsoft Help [12/10/2008|09:57] C:\ProgramData\<DIR> QuickTime [12/10/2008|01:51] C:\ProgramData\<JUNCTION> Start Menu [06/09/2008|02:58] C:\ProgramData\<DIR> SupportSoft [12/10/2008|01:51] C:\ProgramData\<JUNCTION> Templates [12/10/2008|07:23] C:\ProgramData\<DIR> WLInstaller --------------------\\ Listing Folders in C:\Program Files [29/10/2008|09:42] C:\Program Files\<DIR> Adobe [29/10/2008|08:48] C:\Program Files\<DIR> Adobe Media Player [16/10/2008|04:30] C:\Program Files\<DIR> Alwil Software [06/09/2008|02:52] C:\Program Files\<DIR> ATI Technologies [06/09/2008|02:59] C:\Program Files\<DIR> Citrix [29/10/2008|09:44] C:\Program Files\<DIR> Common Files [06/09/2008|10:36] C:\Program Files\<DIR> CONEXANT [17/10/2008|10:47] C:\Program Files\<DIR> ConvertHelper [06/09/2008|02:49] C:\Program Files\<DIR> Creative [06/09/2008|02:50] C:\Program Files\<DIR> Creative Installation Information [06/09/2008|03:03] C:\Program Files\<DIR> CyberLink [20/10/2008|05:20] C:\Program Files\<DIR> DAEMON Tools Lite [20/10/2008|05:20] C:\Program Files\<DIR> DAEMON Tools Toolbar [17/10/2008|06:10] C:\Program Files\<DIR> Dell [06/09/2008|02:58] C:\Program Files\<DIR> Dell Support Center [06/09/2008|02:53] C:\Program Files\<DIR> Digital Line Detect [28/10/2008|04:02] C:\Program Files\<DIR> Electronic Arts [16/10/2008|04:39] C:\Program Files\<DIR> FLV Player [12/10/2008|03:12] C:\Program Files\<DIR> Google [22/10/2008|04:16] C:\Program Files\<DIR> HP [28/10/2008|04:30] C:\Program Files\<DIR> InstallShield Installation Information [06/09/2008|02:51] C:\Program Files\<DIR> Intel [12/10/2008|09:57] C:\Program Files\<DIR> Internet Explorer [06/09/2008|02:47] C:\Program Files\<DIR> Java [12/10/2008|07:21] C:\Program Files\<DIR> K-Lite Codec Pack [31/10/2008|04:02] C:\Program Files\<DIR> McAfee [06/09/2008|02:55] C:\Program Files\<DIR> McAfee.com [12/10/2008|07:30] C:\Program Files\<DIR> Messenger Plus! Live [02/11/2006|11:37] C:\Program Files\<DIR> Microsoft Games [22/10/2008|04:59] C:\Program Files\<DIR> Microsoft Office [22/10/2008|04:59] C:\Program Files\<DIR> Microsoft Visual Studio [22/10/2008|04:56] C:\Program Files\<DIR> Microsoft Visual Studio 8 [06/09/2008|02:59] C:\Program Files\<DIR> Microsoft Works [22/10/2008|04:58] C:\Program Files\<DIR> Microsoft.NET [06/09/2008|02:48] C:\Program Files\<DIR> Modem Diagnostic Tool [21/01/2008|01:35] C:\Program Files\<DIR> Movie Maker [20/10/2008|05:20] C:\Program Files\<DIR> Mozilla Firefox [22/10/2008|04:59] C:\Program Files\<DIR> MSBuild [06/09/2008|02:54] C:\Program Files\<DIR> NetWaiting [12/10/2008|09:55] C:\Program Files\<DIR> Numbers Up! VP V1.2.2 [12/10/2008|09:57] C:\Program Files\<DIR> QuickTime [15/10/2008|08:08] C:\Program Files\<DIR> Real [06/09/2008|02:50] C:\Program Files\<DIR> Realtek [21/10/2008|03:54] C:\Program Files\<DIR> SystemRequirementsLab [03/11/2006|12:01] C:\Program Files\<DIR> Uninstall Information [14/10/2008|05:13] C:\Program Files\<DIR> uTorrent [17/10/2008|06:51] C:\Program Files\<DIR> Valve [21/10/2008|07:56] C:\Program Files\<DIR> VideoLAN [21/10/2008|03:50] C:\Program Files\<DIR> Vpskeys [12/10/2008|07:23] C:\Program Files\<DIR> Winamp [21/01/2008|01:35] C:\Program Files\<DIR> Windows Calendar [21/01/2008|01:35] C:\Program Files\<DIR> Windows Collaboration [21/01/2008|01:35] C:\Program Files\<DIR> Windows Defender [21/01/2008|01:35] C:\Program Files\<DIR> Windows Journal [12/10/2008|07:28] C:\Program Files\<DIR> Windows Live [12/10/2008|03:11] C:\Program Files\<DIR> Windows Mail [21/01/2008|01:35] C:\Program Files\<DIR> Windows Media Player [02/11/2006|11:37] C:\Program Files\<DIR> Windows NT [21/01/2008|01:35] C:\Program Files\<DIR> Windows Photo Gallery [21/01/2008|01:35] C:\Program Files\<DIR> Windows Sidebar [13/10/2008|07:38] C:\Program Files\<DIR> WinRAR [17/10/2008|05:51] C:\Program Files\<DIR> Zone Labs --------------------\\ Listing Folders in C:\Program Files\Common Files [29/10/2008|09:44] C:\Program Files\Common Files\<DIR> Adobe [29/10/2008|08:47] C:\Program Files\Common Files\<DIR> Adobe AIR [06/09/2008|02:49] C:\Program Files\Common Files\<DIR> Creative [06/09/2008|02:48] C:\Program Files\Common Files\<DIR> Creative Labs Shared [22/10/2008|04:59] C:\Program Files\Common Files\<DIR> DESIGNER [06/09/2008|02:48] C:\Program Files\Common Files\<DIR> InstallShield [06/09/2008|02:46] C:\Program Files\Common Files\<DIR> Java [06/09/2008|02:55] C:\Program Files\Common Files\<DIR> McAfee [22/10/2008|05:00] C:\Program Files\Common Files\<DIR> microsoft shared [15/10/2008|08:08] C:\Program Files\Common Files\<DIR> Real [02/11/2006|10:18] C:\Program Files\Common Files\<DIR> Services [02/11/2006|10:18] C:\Program Files\Common Files\<DIR> SpeechEngines [17/10/2008|07:25] C:\Program Files\Common Files\<DIR> Steam [06/09/2008|02:58] C:\Program Files\Common Files\<DIR> supportsoft [20/10/2008|05:06] C:\Program Files\Common Files\<DIR> SWF Studio [22/10/2008|04:56] C:\Program Files\Common Files\<DIR> System [12/10/2008|07:27] C:\Program Files\Common Files\<DIR> WindowsLiveInstaller [15/10/2008|08:08] C:\Program Files\Common Files\<DIR> xing shared --------------------\\ Process ( 64 Processes ) ... OK ! --------------------\\ Searching with S_Lop No Lop folder found ! --------------------\\ Searching for Lop Files - Folders No Lop folder found ! --------------------\\ Searching within the Registry ..... OK ! --------------------\\ Checking the Hosts file Hosts file CLEAN --------------------\\ Searching for hidden files with Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 11:22:37 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 0 --------------------\\ Searching for other infections No other infections found ! [F:1080][D:84]-> C:\Users\thing\AppData\Local\Temp [F:41][D:1]-> C:\Users\thing\AppData\Roaming\MICROS~1\Windows\Cookies [F:91][D:5]-> C:\Users\thing\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5 [F:3][D:3]-> C:\$Recycle.Bin 1 - "C:\Lop SD\LopR_1.txt" - Sat 01/11/2008|11:24 - Option : [1] --------------------\\ Scan completed at 11:24:56 [ UAC => 1 ] Link to post Share on other sites
Rorschach112 Posted November 1, 2008 Report Share Posted November 1, 2008 HelloDownload random's system information tool (RSIT) by random/random from here and save it to your desktop.Double click on RSIT.exe to run RSIT.Click Continue at the disclaimer screen.Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized) Link to post Share on other sites
alvarez Posted November 1, 2008 Author Report Share Posted November 1, 2008 Logfile of random's system information tool 1.04 (written by random/random)Run by thing at 2008-11-01 11:35:43Microsoft® Windows Vistaâ„¢ Home Premium Service Pack 1System drive C: has 356 GB (77%) free of 461 GBTotal RAM: 3325 MB (65% free)Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:35:52 AM, on 1/11/2008Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v7.00 (7.00.6001.18000)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEC:\Program Files\Dell\DellDock\DellDock.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\RtHDVCpl.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Dell\MediaDirect\PCMService.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Windows\ehome\ehtray.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Windows\system32\wuauclt.exeC:\Program Files\uTorrent\uTorrent.exeC:\Windows\system32\taskeng.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Internet Explorer\IEUser.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\Taskmgr.exeC:\Windows\system32\SearchFilterHost.exeC:\Users\thing\Downloads\RSIT.exeC:\Users\thing\Documents\HJT\thing.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exeO4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exeO4 - HKLM\..\Run: [updReg] C:\Windows\UpdReg.EXEO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll,cO4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\thing\AppData\Local\Temp\vtUnnNEx.dll,#1O4 - HKCU\..\Run: [842ec2aa] rundll32.exe "C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll",bO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'Default user')O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exeO4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLLO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exeO23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exeO23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 10021 bytes======Scheduled tasks folder======C:\Windows\tasks\RtlNICDiagVistaStart.job======Registry dump======[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]Adobe PDF Link Helper - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-12 75128][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-10-15 308832][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2008-10-12 2549368][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2008-09-06 325048][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]CBrowserHelperObject Object - C:\Program Files\Dell\BAE\BAE.dll [2006-11-09 98304][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2008-10-12 2549368]{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-10-15 863688][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]"ECenter"=C:\Dell\E-Center\EULALauncher.exe [2008-02-29 17920]"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-03-06 4706304]"UpdReg"=C:\Windows\UpdReg.EXE [2000-05-11 90112]"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-06 29744]"dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2008-03-11 16384]"PCMService"=C:\Program Files\Dell\MediaDirect\PCMService.exe [2008-01-14 132392]"Adobe Reader Speed Launcher"=c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]"WinampAgent"=C:\Program Files\Winamp\winampa.exe []"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-10-12 77824]"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-10-15 185872]"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-20 78008][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-09-06 68856]"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]"cmds"=C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll [2008-10-29 321920]"MSServer"=C:\Users\thing\AppData\Local\Temp\vtUnnNEx.dll [2008-10-29 33664]"842ec2aa"=C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll [2008-10-30 75904][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\842ec2aa]C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll [2008-10-30 75904][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds]C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll [2008-10-29 321920][HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer]C:\Users\thing\AppData\Local\Temp\byXPHyxY.dll []C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartupDigital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exeC:\Users\thing\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupDell Dock.lnk - C:\Program Files\Dell\DellDock\DellDock.exe[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist]C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll [2008-09-06 10536][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]"{338CF144-A9ED-4EEA-8DC4-4A6A3CA69D8B}"=C:\Windows\system32\tuvWmlKc.dll [2008-10-29 33664][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\GoToAssist][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]"dontdisplaylastusername"=0"legalnoticecaption"="legalnoticetext"="shutdownwithoutlogon"=1"undockwithoutlogon"=1"EnableUIADesktopToggle"=0[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list][HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]======List of files/folders created in the last 1 months======2008-11-01 11:35:43 ----D---- C:\rsit2008-11-01 11:27:40 ----A---- C:\Windows\system32\aswBoot.exe2008-11-01 11:22:28 ----A---- C:\lopR.txt2008-11-01 11:22:04 ----D---- C:\Lop SD2008-10-31 08:37:02 ----D---- C:\NDSBackup - 31.102008-10-31 08:31:39 ----D---- C:\Counter-Strike2008-10-29 21:06:58 ----D---- C:\ProgramData\FLEXnet2008-10-29 21:06:18 ----A---- C:\Windows\system32\tuvWmlKc.dll2008-10-29 21:06:18 ----A---- C:\Windows\system32\opnnnKBR.dll2008-10-29 20:48:52 ----D---- C:\Program Files\Adobe Media Player2008-10-29 20:47:17 ----D---- C:\Program Files\Common Files\Adobe AIR2008-10-28 16:44:58 ----D---- C:\Users\thing\AppData\Roaming\SPORE2008-10-28 16:43:48 ----A---- C:\Windows\system32\d3dx9_27.dll2008-10-28 16:02:56 ----D---- C:\Program Files\Electronic Arts2008-10-22 17:01:11 ----A---- C:\Windows\system32\msonpmon.dll2008-10-22 16:59:29 ----D---- C:\Program Files\Microsoft Visual Studio2008-10-22 16:59:29 ----D---- C:\Program Files\Common Files\DESIGNER2008-10-22 16:58:45 ----D---- C:\Program Files\Microsoft.NET2008-10-22 16:56:38 ----D---- C:\Program Files\Microsoft Visual Studio 82008-10-22 16:55:31 ----D---- C:\ProgramData\Microsoft Help2008-10-22 16:54:38 ----RHD---- C:\MSOCache2008-10-22 16:16:21 ----D---- C:\Program Files\HP2008-10-22 16:16:15 ----HD---- C:\Config.Msi2008-10-22 16:15:22 ----D---- C:\Temp2008-10-21 19:57:32 ----D---- C:\Users\thing\AppData\Roaming\vlc2008-10-21 19:56:38 ----D---- C:\Program Files\VideoLAN2008-10-21 19:07:13 ----A---- C:\Windows\Ultimate Maths Invaders Uninstall Log.txt2008-10-20 17:20:11 ----D---- C:\Program Files\DAEMON Tools Toolbar2008-10-20 17:19:48 ----D---- C:\Program Files\DAEMON Tools Lite2008-10-20 17:17:14 ----D---- C:\Users\thing\AppData\Roaming\DAEMON Tools2008-10-20 17:06:36 ----D---- C:\Program Files\Common Files\SWF Studio2008-10-20 16:02:42 ----D---- C:\Program Files\SystemRequirementsLab2008-10-20 16:02:32 ----D---- C:\Users\thing\AppData\Roaming\SystemRequirementsLab2008-10-18 17:47:39 ----D---- C:\Windows\Ultimate Maths Invaders2008-10-17 22:47:12 ----D---- C:\Program Files\ConvertHelper2008-10-17 19:25:11 ----D---- C:\Program Files\Common Files\Steam2008-10-17 18:51:25 ----D---- C:\Program Files\Valve2008-10-17 18:10:08 ----D---- C:\Windows\system32\Dell2008-10-17 17:51:34 ----D---- C:\Program Files\Zone Labs2008-10-17 17:51:22 ----D---- C:\Windows\Internet Logs2008-10-16 16:39:34 ----D---- C:\Program Files\FLV Player2008-10-16 16:30:34 ----D---- C:\Program Files\Alwil Software2008-10-16 15:57:06 ----A---- C:\Windows\system32\ntkrnlpa.exe2008-10-16 15:57:05 ----A---- C:\Windows\system32\ntoskrnl.exe2008-10-16 15:56:57 ----A---- C:\Windows\system32\mshtml.dll2008-10-16 15:56:56 ----A---- C:\Windows\system32\urlmon.dll2008-10-16 15:56:56 ----A---- C:\Windows\system32\ieframe.dll2008-10-16 15:56:54 ----A---- C:\Windows\system32\wininet.dll2008-10-16 15:56:54 ----A---- C:\Windows\system32\iertutil.dll2008-10-16 15:56:53 ----A---- C:\Windows\system32\mstime.dll2008-10-16 15:56:48 ----A---- C:\Windows\system32\jsproxy.dll2008-10-15 20:11:28 ----A---- C:\Windows\cdplayer.ini2008-10-15 20:08:21 ----D---- C:\Program Files\Common Files\xing shared2008-10-15 20:08:16 ----A---- C:\Windows\system32\rmoc3260.dll2008-10-15 20:08:05 ----A---- C:\Windows\system32\pndx5032.dll2008-10-15 20:08:05 ----A---- C:\Windows\system32\pndx5016.dll2008-10-15 20:08:04 ----D---- C:\Program Files\Real2008-10-15 20:08:04 ----A---- C:\Windows\system32\pncrt.dll2008-10-15 20:08:00 ----D---- C:\Program Files\Common Files\Real2008-10-15 20:07:59 ----D---- C:\Users\thing\AppData\Roaming\Real2008-10-14 17:13:53 ----D---- C:\Program Files\uTorrent2008-10-14 17:13:44 ----D---- C:\Users\thing\AppData\Roaming\uTorrent2008-10-14 16:54:37 ----D---- C:\Users\thing\AppData\Roaming\WinRAR2008-10-13 19:37:52 ----D---- C:\Program Files\WinRAR2008-10-12 21:57:32 ----A---- C:\Windows\unvise32qt.exe2008-10-12 21:55:48 ----D---- C:\Windows\system32\QuickTime2008-10-12 21:55:44 ----D---- C:\Program Files\QuickTime2008-10-12 21:55:31 ----D---- C:\ProgramData\QuickTime2008-10-12 21:55:22 ----A---- C:\Windows\iun6002.exe2008-10-12 21:55:11 ----D---- C:\Program Files\Numbers Up! VP V1.2.22008-10-12 20:42:08 ----D---- C:\Users\thing\AppData\Roaming\Media Player Classic2008-10-12 20:12:44 ----D---- C:\ProgramData\Messenger Plus!2008-10-12 19:39:45 ----D---- C:\Program Files\Vpskeys2008-10-12 19:28:51 ----D---- C:\Program Files\Messenger Plus! Live2008-10-12 19:28:00 ----D---- C:\Windows\PCHEALTH2008-10-12 19:24:20 ----SHDC---- C:\Program Files\Common Files\WindowsLiveInstaller2008-10-12 19:24:11 ----D---- C:\Program Files\Windows Live2008-10-12 19:23:48 ----D---- C:\ProgramData\WLInstaller2008-10-12 19:23:10 ----N---- C:\Windows\system32\vxblock.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxwave.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxsfs.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxmas.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxinsa64.exe2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxhpinst.exe2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxdrv.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxcpya64.exe2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxafs.dll2008-10-12 19:23:09 ----N---- C:\Windows\system32\px.dll2008-10-12 19:23:07 ----D---- C:\Users\thing\AppData\Roaming\Winamp2008-10-12 19:23:07 ----D---- C:\Program Files\Winamp2008-10-12 19:21:30 ----D---- C:\Users\thing\AppData\Roaming\Mozilla2008-10-12 19:21:25 ----A---- C:\Windows\system32\unrar.dll2008-10-12 19:21:25 ----A---- C:\Windows\avisplitter.ini2008-10-12 19:21:20 ----A---- C:\Windows\system32\yv12vfw.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\xvidvfw.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\xvidcore.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\qt-dx331.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\dpl100.dll2008-10-12 19:21:19 ----A---- C:\Windows\system32\ff_vfw.dll.manifest2008-10-12 19:21:19 ----A---- C:\Windows\system32\ff_vfw.dll2008-10-12 19:21:19 ----A---- C:\Windows\system32\divx.dll2008-10-12 19:21:17 ----D---- C:\Program Files\K-Lite Codec Pack2008-10-12 19:18:31 ----D---- C:\Program Files\Mozilla Firefox2008-10-12 15:50:01 ----D---- C:\Users\thing\AppData\Roaming\Macromedia2008-10-12 15:08:43 ----A---- C:\Windows\system32\tzres.dll2008-10-12 15:07:49 ----A---- C:\Windows\system32\msshooks.dll2008-10-12 15:07:49 ----A---- C:\Windows\system32\msscb.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\SearchFilterHost.exe2008-10-12 15:07:47 ----A---- C:\Windows\system32\propsys.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\propdefs.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\msstrc.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\mssprxy.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\mssitlb.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\msshsq.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\xmlfilter.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\wsepno.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\thawbrkr.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\srchadmin.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\rtffilt.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\offfilt.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\nlhtml.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\msscntrs.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\mimefilt.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\korwbrkr.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\chsbrkr.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\tquery.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\SearchProtocolHost.exe2008-10-12 15:07:45 ----A---- C:\Windows\system32\SearchIndexer.exe2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssvp.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssrch.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssphtb.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssph.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\chtbrkr.dll2008-10-12 15:04:21 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll2008-10-12 15:04:21 ----A---- C:\Windows\system32\Apphlpdm.dll2008-10-12 15:04:16 ----A---- C:\Windows\system32\NlsLexicons0007.dll2008-10-12 15:04:14 ----A---- C:\Windows\system32\NlsLexicons0009.dll2008-10-12 15:04:03 ----A---- C:\Windows\system32\NaturalLanguage6.dll2008-10-12 15:03:30 ----A---- C:\Windows\system32\shell32.dll2008-10-12 15:03:24 ----A---- C:\Windows\system32\rpcrt4.dll2008-10-12 15:03:22 ----A---- C:\Windows\system32\pacerprf.dll2008-10-12 15:03:20 ----A---- C:\Windows\system32\IPSECSVC.DLL2008-10-12 15:02:58 ----A---- C:\Windows\system32\es.dll2008-10-12 15:02:57 ----A---- C:\Windows\system32\wmpeffects.dll2008-10-12 15:02:03 ----A---- C:\Windows\system32\emdmgmt.dll2008-10-12 15:02:03 ----A---- C:\Windows\system32\dataclen.dll2008-10-12 15:02:03 ----A---- C:\Windows\system32\cdd.dll2008-10-12 15:02:01 ----A---- C:\Windows\system32\vbscript.dll2008-10-12 15:02:01 ----A---- C:\Windows\system32\jscript.dll2008-10-12 15:02:00 ----A---- C:\Windows\system32\wshext.dll2008-10-12 15:02:00 ----A---- C:\Windows\system32\wscript.exe2008-10-12 15:02:00 ----A---- C:\Windows\system32\cscript.exe2008-10-12 15:01:59 ----A---- C:\Windows\system32\scrrun.dll2008-10-12 15:01:59 ----A---- C:\Windows\system32\scrobj.dll2008-10-12 15:01:58 ----A---- C:\Windows\system32\inetcomm.dll2008-10-12 14:50:01 ----D---- C:\Users\thing\AppData\Roaming\Adobe2008-10-12 14:49:58 ----D---- C:\Users\thing\AppData\Roaming\Google2008-10-12 13:56:26 ----D---- C:\Users\thing\AppData\Roaming\ATI2008-10-12 13:56:26 ----D---- C:\ProgramData\ATI2008-10-12 13:55:30 ----D---- C:\Users\thing\AppData\Roaming\Identities2008-10-12 13:55:14 ----A---- C:\Windows\IMAPIShellExt.dll2008-10-12 13:55:14 ----A---- C:\Windows\BurnImage.exe2008-10-12 13:55:07 ----D---- C:\Users\thing\AppData\Roaming\Dell2008-10-12 13:54:44 ----SD---- C:\Users\thing\AppData\Roaming\Microsoft2008-10-12 13:54:44 ----D---- C:\Users\thing\AppData\Roaming\Media Center Programs2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Templates2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Start Menu2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Favorites2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Documents2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Desktop2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Application Data2008-10-12 13:51:22 ----SHD---- C:\Documents and Settings======List of files/folders modified in the last 1 months======2008-11-01 11:35:45 ----D---- C:\Windows\Temp2008-11-01 11:28:08 ----D---- C:\Windows\system32\drivers2008-11-01 11:28:03 ----D---- C:\Windows\System322008-11-01 11:27:33 ----D---- C:\Windows\inf2008-11-01 11:27:33 ----A---- C:\Windows\system32\PerfStringBackup.INI2008-11-01 11:18:47 ----D---- C:\Windows\Tasks2008-10-31 16:02:16 ----D---- C:\Program Files\McAfee2008-10-29 21:50:43 ----D---- C:\Windows\system32\WDI2008-10-29 21:46:21 ----SHD---- C:\Windows\Installer2008-10-29 21:44:32 ----D---- C:\Program Files\Common Files\Adobe2008-10-29 21:44:31 ----D---- C:\Program Files\Common Files2008-10-29 21:42:41 ----D---- C:\ProgramData\Adobe2008-10-29 21:42:41 ----D---- C:\Program Files\Adobe2008-10-29 21:20:15 ----SD---- C:\Windows\Downloaded Program Files2008-10-29 21:06:58 ----HD---- C:\ProgramData2008-10-29 20:48:52 ----RD---- C:\Program Files2008-10-29 20:48:27 ----RSD---- C:\Windows\Fonts2008-10-28 16:43:53 ----RSD---- C:\Windows\assembly2008-10-28 16:43:51 ----D---- C:\Windows\Microsoft.NET2008-10-28 16:43:38 ----SHD---- C:\System Volume Information2008-10-28 16:30:31 ----HD---- C:\Program Files\InstallShield Installation Information2008-10-28 16:16:21 ----D---- C:\Windows\Prefetch2008-10-28 16:13:38 ----D---- C:\Windows2008-10-27 22:48:03 ----D---- C:\PerfLogs2008-10-25 12:28:51 ----D---- C:\Windows\rescache2008-10-24 16:36:31 ----D---- C:\Windows\winsxs2008-10-24 16:08:41 ----D---- C:\Windows\system32\catroot2008-10-22 17:00:46 ----D---- C:\Windows\LiveKernelReports2008-10-22 17:00:02 ----D---- C:\Program Files\Common Files\microsoft shared2008-10-22 16:59:50 ----D---- C:\Program Files\MSBuild2008-10-22 16:59:39 ----D---- C:\Program Files\Microsoft Office2008-10-22 16:59:25 ----D---- C:\Windows\ShellNew2008-10-22 16:58:45 ----SD---- C:\ProgramData\Microsoft2008-10-22 16:56:07 ----A---- C:\Windows\win.ini2008-10-22 16:56:06 ----D---- C:\Program Files\Common Files\System2008-10-22 16:47:56 ----D---- C:\Windows\system32\catroot22008-10-21 19:42:55 ----D---- C:\Windows\system32\LogFiles2008-10-19 12:03:58 ----D---- C:\Windows\system32\migration2008-10-17 22:58:11 ----D---- C:\Windows\system32\Tasks2008-10-17 18:10:08 ----D---- C:\Program Files\Dell2008-10-14 20:20:11 ----D---- C:\Windows\Logs2008-10-12 21:57:30 ----D---- C:\Program Files\Internet Explorer2008-10-12 20:33:25 ----D---- C:\Windows\Debug2008-10-12 15:12:39 ----D---- C:\Program Files\Google2008-10-12 15:12:39 ----D---- C:\DELL2008-10-12 15:11:40 ----D---- C:\Windows\AppPatch2008-10-12 15:11:37 ----D---- C:\Windows\system32\en-US2008-10-12 15:11:37 ----D---- C:\Windows\PolicyDefinitions2008-10-12 15:11:34 ----D---- C:\Windows\ehome2008-10-12 15:11:30 ----D---- C:\Program Files\Windows Mail2008-10-12 15:02:59 ----D---- C:\Windows\SoftwareDistribution2008-10-12 13:55:55 ----SHD---- C:\$Recycle.Bin2008-10-12 13:54:44 ----RD---- C:\Users2008-10-12 13:54:34 ----D---- C:\ProgramData\McAfee======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-20 12672]R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys [2008-03-06 27648]R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-05 8192]R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-13 3592704]R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-10-19 986624]R3 HSXHWBS2;HSXHWBS2; C:\Windows\system32\DRIVERS\HSXHWBS2.sys [2006-10-19 258048]R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-03-06 2047576]R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-08-06 124928]R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-10-19 659968]R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]S1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2008-07-20 23152]S1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2008-07-20 78416]S1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2008-07-20 42912]S2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys []S2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-20 20560]S2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-20 51280]S3 aztudawr;aztudawr; C:\Windows\system32\drivers\aztudawr.sys []S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]S3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-21 220672]S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-13 3592704]S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]S4 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys [2008-03-06 308248]S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-06-13 675840]R2 Creative Labs Licensing Service;Creative Labs Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe [2008-09-06 72704]R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\Windows\system32\CTsvcCDA.exe [1999-12-13 44032]R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-05 386560]S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-20 16056]S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-20 147640]S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-20 250040]S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-24 348344]S3 GoogleDesktopManager-010708-104812;Google Desktop Manager 5.7.801.7324; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-06 29744]S3 GoToAssist;GoToAssist; C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe [2008-09-06 16680]S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-06 138168]S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-10-17 87288]S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]S4 0101641225429339mcinstcleanup;McAfee Application Installer Cleanup (0101641225429339); C:\Windows\TEMP\010164~1.EXE [2008-07-09 315264]-----------------EOF-----------------info.txt logfile of random's system information tool 1.04 2008-11-01 11:35:54======Uninstall list======-->"C:\Program Files\Creative Installation Information\CREATIVE_MEDIASOURCE_U\Setup.exe" /remove /l0x0009-->"C:\Program Files\Creative Installation Information\CTCMSGO\Setup.exe" /remove /l0x0009-->"C:\Program Files\Creative Installation Information\E-CENTER_NET_CONTENT_U\Setup.exe" /remove /l0x0009-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {926CC8AE-8414-43DF-8EB4-CF26D9C3C663}-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2670895A-4E6C-4450-B868-7B7DB80A3357}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2670895A-4E6C-4450-B868-7B7DB80A3357}\setup.exe" -l0x9 /remove-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x9 /remove-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAEF329E-F353-46C9-933D-24A571986093}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AAEF329E-F353-46C9-933D-24A571986093}\setup.exe" -l0x9 /remove-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC406C89-7668-46AE-8EFE-75D199C055AB}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC406C89-7668-46AE-8EFE-75D199C055AB}\setup.exe" -l0x9 /remove-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x9 /remove-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FCCDA302-32D9-4AE7-A094-4BE677554F26}\setup.exe" -l0x9 -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FCCDA302-32D9-4AE7-A094-4BE677554F26}\setup.exe" -l0x9 /removeAcrobat.com-->msiexec /qb /x {77DCDCE3-2DED-62F3-8154-05E745472D07}Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstallAdobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exeAdobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x9 avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetupBrowser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}Conexant D850 PCI V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1\HXFSETUP.EXE -U -IDel200fz.infConvertHelper 2.1-->"C:\Program Files\ConvertHelper\unins000.exe"Creative MediaSource 5-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}\Setup.exe" -l0x9 /removeDAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exeDell Dock-->MsiExec.exe /I{F6CB42B9-F033-4152-8813-FF11DA8E6A78}Dell Getting Started Guide-->MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}Dell Support Center-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}Dell-eBay-->MsiExec.exe /I{B935C985-A17F-484B-8470-09E4FC27DC26}Digital Line Detect-->C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonlyEDocs-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}\setup.exe" FLV Player 2.0, build 24-->C:\Program Files\FLV Player\uninst.exeGoogle Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstallGoogle Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"GoToAssist 8.0.0.514-->C:\Program Files\Citrix\GoToAssist\514\G2AUninstaller.exe /uninstallHalf-Life 2: Deathmatch-->"C:\Program Files\Valve\Steam\steam.exe" steam://uninstall/320Half-Life® 2-->MsiExec.exe /I{D45EC259-4A19-4656-B588-C2C360DD18EA}HijackThis 2.0.2-->"C:\Users\thing\Documents\HJT\HijackThis.exe" /uninstallJava 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}K-Lite Codec Pack 4.1.7 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"MediaDirect-->C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0009 -cluninstallMessenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLLMicrosoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}Modem Diagnostic Tool-->MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B}Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exeNetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonlyNumbers Up! VP V1.2.2-->C:\Windows\iun6002.exe "C:\Program Files\Numbers Up! VP V1.2.2\irunin.ini"QuickTime-->C:\Windows\unvise32qt.exe C:\Windows\system32\QuickTime\Uninstall.logRealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0Realtek Ethernet Network Card Diagnostic tool for Windows Vista-->C:\Program Files\InstallShield Installation Information\{1FECF5F8-8E75-432C-9FF7-1C04F1956B54}\setup.exe -runfromtemp -l0x0009 -removeonlyRealtek High Definition Audio Driver-->RtlUpd.exe -r -mSound Blaster Audigy ADVANCED MB-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}\Setup.exe" -l0x9 /removeSPOREâ„¢-->"C:\Program Files\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORESetup.exe" -runfromtemp -l0x0009 -removeonlySteam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exeVLC media player 0.9.4-->C:\Program Files\VideoLAN\VLC\uninstall.exeWinamp-->"C:\Program Files\Winamp\UninstWA.exe"Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}Windows Live Messenger-->MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe======Security center information======AS: Windows Defender======Environment variables======"ComSpec"=%SystemRoot%\system32\cmd.exe"FP_NO_HOST_CHECK"=NO"OS"=Windows_NT"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC"PROCESSOR_ARCHITECTURE"=x86"TEMP"=%SystemRoot%\TEMP"TMP"=%SystemRoot%\TEMP"USERNAME"=SYSTEM"windir"=%SystemRoot%"PROCESSOR_LEVEL"=6"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel"PROCESSOR_REVISION"=0f0b"NUMBER_OF_PROCESSORS"=4"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat"DFSTRACINGON"=FALSE-----------------EOF----------------- Link to post Share on other sites
Rorschach112 Posted November 1, 2008 Report Share Posted November 1, 2008 HelloPlease download the OTMoveIt3 by OldTimer or from here. Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)::Processesexplorer.exe:Servicesaztudawr:Reg[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\842ec2aa][-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds][-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]"{338CF144-A9ED-4EEA-8DC4-4A6A3CA69D8B}"=-:FilesC:\Windows\system32\tuvWmlKc.dllC:\Windows\system32\opnnnKBR.dll:Commands[purity][emptytemp][start explorer][Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.Click the red Moveit! button.Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.Close OTMoveIt3Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.Also post a new Rsit log Link to post Share on other sites
alvarez Posted November 1, 2008 Author Report Share Posted November 1, 2008 ========== PROCESSES ==========Process explorer.exe killed successfully.========== SERVICES/DRIVERS ==================== REGISTRY ==========Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\842ec2aa\\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds\\ deleted successfully.Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer\\ deleted successfully.Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{338CF144-A9ED-4EEA-8DC4-4A6A3CA69D8B} deleted successfully.Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{338CF144-A9ED-4EEA-8DC4-4A6A3CA69D8B}\ deleted successfully.========== FILES ==========DllUnregisterServer procedure not found in C:\Windows\system32\tuvWmlKc.dllC:\Windows\system32\tuvWmlKc.dll NOT unregistered.C:\Windows\system32\tuvWmlKc.dll moved successfully.DllUnregisterServer procedure not found in C:\Windows\system32\opnnnKBR.dllC:\Windows\system32\opnnnKBR.dll NOT unregistered.C:\Windows\system32\opnnnKBR.dll moved successfully.========== COMMANDS ==========File delete failed. C:\Users\thing\AppData\Local\Temp\etilqs_OwZ4AGeos1DRNRr0IM5j scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\~DF1412.tmp scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\~DF1428.tmp scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\~DF313D.tmp scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\~DF3143.tmp scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\~DF5658.tmp scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Temp\~DF7D46.tmp scheduled to be deleted on reboot.User's Temp folder emptied.User's Temporary Internet Files folder emptied.User's Internet Explorer cache folder emptied.Local Service Temp folder emptied.Local Service Temporary Internet Files folder emptied.File delete failed. C:\Windows\temp\TMP00000062058A3F037D5A6EFE scheduled to be deleted on reboot.Windows Temp folder emptied.File delete failed. C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\urlclassifier3.sqlite scheduled to be deleted on reboot.File delete failed. C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\XUL.mfl scheduled to be deleted on reboot.FireFox cache emptied.Temp folders emptied.Explorer started successfullyOTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11012008_114743Files moved on Reboot...File C:\Users\thing\AppData\Local\Temp\etilqs_OwZ4AGeos1DRNRr0IM5j not found!DllUnregisterServer procedure not found in C:\Users\thing\AppData\Local\Temp\hxblgrnv.dllC:\Users\thing\AppData\Local\Temp\hxblgrnv.dll NOT unregistered.C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll moved successfully.DllUnregisterServer procedure not found in C:\Users\thing\AppData\Local\Temp\yaywwuvw.dllC:\Users\thing\AppData\Local\Temp\yaywwuvw.dll NOT unregistered.C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll moved successfully.File C:\Users\thing\AppData\Local\Temp\~DF1412.tmp not found!File C:\Users\thing\AppData\Local\Temp\~DF1428.tmp not found!File C:\Users\thing\AppData\Local\Temp\~DF313D.tmp not found!File C:\Users\thing\AppData\Local\Temp\~DF3143.tmp not found!C:\Users\thing\AppData\Local\Temp\~DF5658.tmp moved successfully.File C:\Users\thing\AppData\Local\Temp\~DF7D46.tmp not found!File C:\Windows\temp\TMP00000062058A3F037D5A6EFE not found!C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_001_ moved successfully.C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_002_ moved successfully.C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_003_ moved successfully.C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\Cache\_CACHE_MAP_ moved successfully.C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\urlclassifier3.sqlite moved successfully.C:\Users\thing\AppData\Local\Mozilla\Firefox\Profiles\o6a9sgix.default\XUL.mfl moved successfully.Logfile of random's system information tool 1.04 (written by random/random)Run by thing at 2008-11-01 11:53:31Microsoft® Windows Vistaâ„¢ Home Premium Service Pack 1System drive C: has 356 GB (77%) free of 461 GBTotal RAM: 3325 MB (68% free)Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:53:36 AM, on 1/11/2008Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v7.00 (7.00.6001.18000)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEC:\Program Files\Dell\DellDock\DellDock.exeC:\Windows\notepad.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\RtHDVCpl.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Dell\MediaDirect\PCMService.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Alwil Software\Avast4\ashDisp.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Windows\ehome\ehtray.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\system32\wuauclt.exeC:\Users\thing\Downloads\RSIT.exeC:\Users\thing\Documents\HJT\thing.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exeO4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exeO4 - HKLM\..\Run: [updReg] C:\Windows\UpdReg.EXEO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exeO4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll,cO4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\thing\AppData\Local\Temp\vtUnnNEx.dll,#1O4 - HKCU\..\Run: [842ec2aa] rundll32.exe "C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll",bO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'Default user')O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exeO4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLLO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dllO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exeO23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exeO23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exeO23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exeO23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exeO23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exeO23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 9883 bytes======Scheduled tasks folder======C:\Windows\tasks\RtlNICDiagVistaStart.job======Registry dump======[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]Adobe PDF Link Helper - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-12 75128][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-10-15 308832][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]SSVHelper Class - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2008-10-12 2549368][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2008-09-06 325048][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]CBrowserHelperObject Object - C:\Program Files\Dell\BAE\BAE.dll [2006-11-09 98304][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2008-10-12 2549368]{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-10-15 863688][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]"ECenter"=C:\Dell\E-Center\EULALauncher.exe [2008-02-29 17920]"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-03-06 4706304]"UpdReg"=C:\Windows\UpdReg.EXE [2000-05-11 90112]"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-06 29744]"dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2008-03-11 16384]"PCMService"=C:\Program Files\Dell\MediaDirect\PCMService.exe [2008-01-14 132392]"Adobe Reader Speed Launcher"=c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]"WinampAgent"=C:\Program Files\Winamp\winampa.exe []"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-10-12 77824]"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-10-15 185872]"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-20 78008][HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-09-06 68856]"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]"cmds"=C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll []"MSServer"=C:\Users\thing\AppData\Local\Temp\vtUnnNEx.dll []"842ec2aa"=C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll []C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartupDigital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exeC:\Users\thing\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupDell Dock.lnk - C:\Program Files\Dell\DellDock\DellDock.exe[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist]C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll [2008-09-06 10536][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\GoToAssist][HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]"dontdisplaylastusername"=0"legalnoticecaption"="legalnoticetext"="shutdownwithoutlogon"=1"undockwithoutlogon"=1"EnableUIADesktopToggle"=0[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list][HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]======List of files/folders created in the last 1 months======2008-11-01 11:47:43 ----D---- C:\_OTMoveIt2008-11-01 11:35:43 ----D---- C:\rsit2008-11-01 11:27:40 ----A---- C:\Windows\system32\aswBoot.exe2008-11-01 11:22:28 ----A---- C:\lopR.txt2008-11-01 11:22:04 ----D---- C:\Lop SD2008-10-31 08:37:02 ----D---- C:\NDSBackup - 31.102008-10-31 08:31:39 ----D---- C:\Counter-Strike2008-10-29 21:06:58 ----D---- C:\ProgramData\FLEXnet2008-10-29 20:48:52 ----D---- C:\Program Files\Adobe Media Player2008-10-29 20:47:17 ----D---- C:\Program Files\Common Files\Adobe AIR2008-10-28 16:44:58 ----D---- C:\Users\thing\AppData\Roaming\SPORE2008-10-28 16:43:48 ----A---- C:\Windows\system32\d3dx9_27.dll2008-10-28 16:02:56 ----D---- C:\Program Files\Electronic Arts2008-10-22 17:01:11 ----A---- C:\Windows\system32\msonpmon.dll2008-10-22 16:59:29 ----D---- C:\Program Files\Microsoft Visual Studio2008-10-22 16:59:29 ----D---- C:\Program Files\Common Files\DESIGNER2008-10-22 16:58:45 ----D---- C:\Program Files\Microsoft.NET2008-10-22 16:56:38 ----D---- C:\Program Files\Microsoft Visual Studio 82008-10-22 16:55:31 ----D---- C:\ProgramData\Microsoft Help2008-10-22 16:54:38 ----RHD---- C:\MSOCache2008-10-22 16:16:21 ----D---- C:\Program Files\HP2008-10-22 16:16:15 ----HD---- C:\Config.Msi2008-10-22 16:15:22 ----D---- C:\Temp2008-10-21 19:57:32 ----D---- C:\Users\thing\AppData\Roaming\vlc2008-10-21 19:56:38 ----D---- C:\Program Files\VideoLAN2008-10-21 19:07:13 ----A---- C:\Windows\Ultimate Maths Invaders Uninstall Log.txt2008-10-20 17:20:11 ----D---- C:\Program Files\DAEMON Tools Toolbar2008-10-20 17:19:48 ----D---- C:\Program Files\DAEMON Tools Lite2008-10-20 17:17:14 ----D---- C:\Users\thing\AppData\Roaming\DAEMON Tools2008-10-20 17:06:36 ----D---- C:\Program Files\Common Files\SWF Studio2008-10-20 16:02:42 ----D---- C:\Program Files\SystemRequirementsLab2008-10-20 16:02:32 ----D---- C:\Users\thing\AppData\Roaming\SystemRequirementsLab2008-10-18 17:47:39 ----D---- C:\Windows\Ultimate Maths Invaders2008-10-17 22:47:12 ----D---- C:\Program Files\ConvertHelper2008-10-17 19:25:11 ----D---- C:\Program Files\Common Files\Steam2008-10-17 18:51:25 ----D---- C:\Program Files\Valve2008-10-17 18:10:08 ----D---- C:\Windows\system32\Dell2008-10-17 17:51:34 ----D---- C:\Program Files\Zone Labs2008-10-17 17:51:22 ----D---- C:\Windows\Internet Logs2008-10-16 16:39:34 ----D---- C:\Program Files\FLV Player2008-10-16 16:30:34 ----D---- C:\Program Files\Alwil Software2008-10-16 15:57:06 ----A---- C:\Windows\system32\ntkrnlpa.exe2008-10-16 15:57:05 ----A---- C:\Windows\system32\ntoskrnl.exe2008-10-16 15:56:57 ----A---- C:\Windows\system32\mshtml.dll2008-10-16 15:56:56 ----A---- C:\Windows\system32\urlmon.dll2008-10-16 15:56:56 ----A---- C:\Windows\system32\ieframe.dll2008-10-16 15:56:54 ----A---- C:\Windows\system32\wininet.dll2008-10-16 15:56:54 ----A---- C:\Windows\system32\iertutil.dll2008-10-16 15:56:53 ----A---- C:\Windows\system32\mstime.dll2008-10-16 15:56:48 ----A---- C:\Windows\system32\jsproxy.dll2008-10-15 20:11:28 ----A---- C:\Windows\cdplayer.ini2008-10-15 20:08:21 ----D---- C:\Program Files\Common Files\xing shared2008-10-15 20:08:16 ----A---- C:\Windows\system32\rmoc3260.dll2008-10-15 20:08:05 ----A---- C:\Windows\system32\pndx5032.dll2008-10-15 20:08:05 ----A---- C:\Windows\system32\pndx5016.dll2008-10-15 20:08:04 ----D---- C:\Program Files\Real2008-10-15 20:08:04 ----A---- C:\Windows\system32\pncrt.dll2008-10-15 20:08:00 ----D---- C:\Program Files\Common Files\Real2008-10-15 20:07:59 ----D---- C:\Users\thing\AppData\Roaming\Real2008-10-14 17:13:53 ----D---- C:\Program Files\uTorrent2008-10-14 17:13:44 ----D---- C:\Users\thing\AppData\Roaming\uTorrent2008-10-14 16:54:37 ----D---- C:\Users\thing\AppData\Roaming\WinRAR2008-10-13 19:37:52 ----D---- C:\Program Files\WinRAR2008-10-12 21:57:32 ----A---- C:\Windows\unvise32qt.exe2008-10-12 21:55:48 ----D---- C:\Windows\system32\QuickTime2008-10-12 21:55:44 ----D---- C:\Program Files\QuickTime2008-10-12 21:55:31 ----D---- C:\ProgramData\QuickTime2008-10-12 21:55:22 ----A---- C:\Windows\iun6002.exe2008-10-12 21:55:11 ----D---- C:\Program Files\Numbers Up! VP V1.2.22008-10-12 20:42:08 ----D---- C:\Users\thing\AppData\Roaming\Media Player Classic2008-10-12 20:12:44 ----D---- C:\ProgramData\Messenger Plus!2008-10-12 19:39:45 ----D---- C:\Program Files\Vpskeys2008-10-12 19:28:51 ----D---- C:\Program Files\Messenger Plus! Live2008-10-12 19:28:00 ----D---- C:\Windows\PCHEALTH2008-10-12 19:24:20 ----SHDC---- C:\Program Files\Common Files\WindowsLiveInstaller2008-10-12 19:24:11 ----D---- C:\Program Files\Windows Live2008-10-12 19:23:48 ----D---- C:\ProgramData\WLInstaller2008-10-12 19:23:10 ----N---- C:\Windows\system32\vxblock.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxwave.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxsfs.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxmas.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxinsa64.exe2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxhpinst.exe2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxdrv.dll2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxcpya64.exe2008-10-12 19:23:10 ----N---- C:\Windows\system32\pxafs.dll2008-10-12 19:23:09 ----N---- C:\Windows\system32\px.dll2008-10-12 19:23:07 ----D---- C:\Users\thing\AppData\Roaming\Winamp2008-10-12 19:23:07 ----D---- C:\Program Files\Winamp2008-10-12 19:21:30 ----D---- C:\Users\thing\AppData\Roaming\Mozilla2008-10-12 19:21:25 ----A---- C:\Windows\system32\unrar.dll2008-10-12 19:21:25 ----A---- C:\Windows\avisplitter.ini2008-10-12 19:21:20 ----A---- C:\Windows\system32\yv12vfw.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\xvidvfw.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\xvidcore.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\qt-dx331.dll2008-10-12 19:21:20 ----A---- C:\Windows\system32\dpl100.dll2008-10-12 19:21:19 ----A---- C:\Windows\system32\ff_vfw.dll.manifest2008-10-12 19:21:19 ----A---- C:\Windows\system32\ff_vfw.dll2008-10-12 19:21:19 ----A---- C:\Windows\system32\divx.dll2008-10-12 19:21:17 ----D---- C:\Program Files\K-Lite Codec Pack2008-10-12 19:18:31 ----D---- C:\Program Files\Mozilla Firefox2008-10-12 15:50:01 ----D---- C:\Users\thing\AppData\Roaming\Macromedia2008-10-12 15:08:43 ----A---- C:\Windows\system32\tzres.dll2008-10-12 15:07:49 ----A---- C:\Windows\system32\msshooks.dll2008-10-12 15:07:49 ----A---- C:\Windows\system32\msscb.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\SearchFilterHost.exe2008-10-12 15:07:47 ----A---- C:\Windows\system32\propsys.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\propdefs.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\msstrc.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\mssprxy.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\mssitlb.dll2008-10-12 15:07:47 ----A---- C:\Windows\system32\msshsq.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\xmlfilter.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\wsepno.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\thawbrkr.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\srchadmin.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\rtffilt.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\offfilt.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\nlhtml.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\msscntrs.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\mimefilt.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\korwbrkr.dll2008-10-12 15:07:46 ----A---- C:\Windows\system32\chsbrkr.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\tquery.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\SearchProtocolHost.exe2008-10-12 15:07:45 ----A---- C:\Windows\system32\SearchIndexer.exe2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssvp.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssrch.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssphtb.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\mssph.dll2008-10-12 15:07:45 ----A---- C:\Windows\system32\chtbrkr.dll2008-10-12 15:04:21 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll2008-10-12 15:04:21 ----A---- C:\Windows\system32\Apphlpdm.dll2008-10-12 15:04:16 ----A---- C:\Windows\system32\NlsLexicons0007.dll2008-10-12 15:04:14 ----A---- C:\Windows\system32\NlsLexicons0009.dll2008-10-12 15:04:03 ----A---- C:\Windows\system32\NaturalLanguage6.dll2008-10-12 15:03:30 ----A---- C:\Windows\system32\shell32.dll2008-10-12 15:03:24 ----A---- C:\Windows\system32\rpcrt4.dll2008-10-12 15:03:22 ----A---- C:\Windows\system32\pacerprf.dll2008-10-12 15:03:20 ----A---- C:\Windows\system32\IPSECSVC.DLL2008-10-12 15:02:58 ----A---- C:\Windows\system32\es.dll2008-10-12 15:02:57 ----A---- C:\Windows\system32\wmpeffects.dll2008-10-12 15:02:03 ----A---- C:\Windows\system32\emdmgmt.dll2008-10-12 15:02:03 ----A---- C:\Windows\system32\dataclen.dll2008-10-12 15:02:03 ----A---- C:\Windows\system32\cdd.dll2008-10-12 15:02:01 ----A---- C:\Windows\system32\vbscript.dll2008-10-12 15:02:01 ----A---- C:\Windows\system32\jscript.dll2008-10-12 15:02:00 ----A---- C:\Windows\system32\wshext.dll2008-10-12 15:02:00 ----A---- C:\Windows\system32\wscript.exe2008-10-12 15:02:00 ----A---- C:\Windows\system32\cscript.exe2008-10-12 15:01:59 ----A---- C:\Windows\system32\scrrun.dll2008-10-12 15:01:59 ----A---- C:\Windows\system32\scrobj.dll2008-10-12 15:01:58 ----A---- C:\Windows\system32\inetcomm.dll2008-10-12 14:50:01 ----D---- C:\Users\thing\AppData\Roaming\Adobe2008-10-12 14:49:58 ----D---- C:\Users\thing\AppData\Roaming\Google2008-10-12 13:56:26 ----D---- C:\Users\thing\AppData\Roaming\ATI2008-10-12 13:56:26 ----D---- C:\ProgramData\ATI2008-10-12 13:55:30 ----D---- C:\Users\thing\AppData\Roaming\Identities2008-10-12 13:55:14 ----A---- C:\Windows\IMAPIShellExt.dll2008-10-12 13:55:14 ----A---- C:\Windows\BurnImage.exe2008-10-12 13:55:07 ----D---- C:\Users\thing\AppData\Roaming\Dell2008-10-12 13:54:44 ----SD---- C:\Users\thing\AppData\Roaming\Microsoft2008-10-12 13:54:44 ----D---- C:\Users\thing\AppData\Roaming\Media Center Programs2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Templates2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Start Menu2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Favorites2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Documents2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Desktop2008-10-12 13:51:22 ----SHD---- C:\ProgramData\Application Data2008-10-12 13:51:22 ----SHD---- C:\Documents and Settings======List of files/folders modified in the last 1 months======2008-11-01 11:53:34 ----D---- C:\Windows\Temp2008-11-01 11:47:43 ----D---- C:\Windows\System322008-11-01 11:28:08 ----D---- C:\Windows\system32\drivers2008-11-01 11:27:33 ----D---- C:\Windows\inf2008-11-01 11:27:33 ----A---- C:\Windows\system32\PerfStringBackup.INI2008-11-01 11:18:47 ----D---- C:\Windows\Tasks2008-10-31 16:02:16 ----D---- C:\Program Files\McAfee2008-10-29 21:50:43 ----D---- C:\Windows\system32\WDI2008-10-29 21:46:21 ----SHD---- C:\Windows\Installer2008-10-29 21:44:32 ----D---- C:\Program Files\Common Files\Adobe2008-10-29 21:44:31 ----D---- C:\Program Files\Common Files2008-10-29 21:42:41 ----D---- C:\ProgramData\Adobe2008-10-29 21:42:41 ----D---- C:\Program Files\Adobe2008-10-29 21:20:15 ----SD---- C:\Windows\Downloaded Program Files2008-10-29 21:06:58 ----HD---- C:\ProgramData2008-10-29 20:48:52 ----RD---- C:\Program Files2008-10-29 20:48:27 ----RSD---- C:\Windows\Fonts2008-10-28 16:43:53 ----RSD---- C:\Windows\assembly2008-10-28 16:43:51 ----D---- C:\Windows\Microsoft.NET2008-10-28 16:43:38 ----SHD---- C:\System Volume Information2008-10-28 16:30:31 ----HD---- C:\Program Files\InstallShield Installation Information2008-10-28 16:16:21 ----D---- C:\Windows\Prefetch2008-10-28 16:13:38 ----D---- C:\Windows2008-10-27 22:48:03 ----D---- C:\PerfLogs2008-10-25 12:28:51 ----D---- C:\Windows\rescache2008-10-24 16:36:31 ----D---- C:\Windows\winsxs2008-10-24 16:08:41 ----D---- C:\Windows\system32\catroot2008-10-22 17:00:46 ----D---- C:\Windows\LiveKernelReports2008-10-22 17:00:02 ----D---- C:\Program Files\Common Files\microsoft shared2008-10-22 16:59:50 ----D---- C:\Program Files\MSBuild2008-10-22 16:59:39 ----D---- C:\Program Files\Microsoft Office2008-10-22 16:59:25 ----D---- C:\Windows\ShellNew2008-10-22 16:58:45 ----SD---- C:\ProgramData\Microsoft2008-10-22 16:56:07 ----A---- C:\Windows\win.ini2008-10-22 16:56:06 ----D---- C:\Program Files\Common Files\System2008-10-22 16:47:56 ----D---- C:\Windows\system32\catroot22008-10-21 19:42:55 ----D---- C:\Windows\system32\LogFiles2008-10-19 12:03:58 ----D---- C:\Windows\system32\migration2008-10-17 22:58:11 ----D---- C:\Windows\system32\Tasks2008-10-17 18:10:08 ----D---- C:\Program Files\Dell2008-10-14 20:20:11 ----D---- C:\Windows\Logs2008-10-12 21:57:30 ----D---- C:\Program Files\Internet Explorer2008-10-12 20:33:25 ----D---- C:\Windows\Debug2008-10-12 15:12:39 ----D---- C:\Program Files\Google2008-10-12 15:12:39 ----D---- C:\DELL2008-10-12 15:11:40 ----D---- C:\Windows\AppPatch2008-10-12 15:11:37 ----D---- C:\Windows\system32\en-US2008-10-12 15:11:37 ----D---- C:\Windows\PolicyDefinitions2008-10-12 15:11:34 ----D---- C:\Windows\ehome2008-10-12 15:11:30 ----D---- C:\Program Files\Windows Mail2008-10-12 15:02:59 ----D---- C:\Windows\SoftwareDistribution2008-10-12 13:55:55 ----SHD---- C:\$Recycle.Bin2008-10-12 13:54:44 ----RD---- C:\Users2008-10-12 13:54:34 ----D---- C:\ProgramData\McAfee======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr.sys [2008-07-20 23152]R1 aswSP;avast! Self Protection; C:\Windows\system32\drivers\aswSP.sys [2008-07-20 78416]R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2008-07-20 42912]R2 aswFsBlk;aswFsBlk; C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-20 20560]R2 aswMonFlt;aswMonFlt; C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-20 51280]R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-20 12672]R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys [2008-03-06 27648]R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-05 8192]R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-13 3592704]R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-10-19 986624]R3 HSXHWBS2;HSXHWBS2; C:\Windows\system32\DRIVERS\HSXHWBS2.sys [2006-10-19 258048]R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-03-06 2047576]R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-08-06 124928]R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-10-19 659968]R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]S2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys []S3 av6k1j0l;av6k1j0l; C:\Windows\system32\drivers\av6k1j0l.sys []S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]S3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-21 220672]S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-13 3592704]S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328]S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]S4 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys [2008-03-06 308248]S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-20 16056]R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-06-13 675840]R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-20 147640]R2 Creative Labs Licensing Service;Creative Labs Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe [2008-09-06 72704]R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\Windows\system32\CTsvcCDA.exe [1999-12-13 44032]R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-05 386560]R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-20 250040]R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-24 348344]S3 GoogleDesktopManager-010708-104812;Google Desktop Manager 5.7.801.7324; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-06 29744]S3 GoToAssist;GoToAssist; C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe [2008-09-06 16680]S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-06 138168]S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-10-17 87288]S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]S4 0101641225429339mcinstcleanup;McAfee Application Installer Cleanup (0101641225429339); C:\Windows\TEMP\010164~1.EXE C:\PROGRA~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service []-----------------EOF----------------- Link to post Share on other sites
Rorschach112 Posted November 1, 2008 Report Share Posted November 1, 2008 Hello1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\thing\AppData\Local\Temp\yaywwuvw.dll,cO4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\thing\AppData\Local\Temp\vtUnnNEx.dll,#1O4 - HKCU\..\Run: [842ec2aa] rundll32.exe "C:\Users\thing\AppData\Local\Temp\hxblgrnv.dll",b2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis. Please download Malwarebytes' Anti-Malware from Here or HereDouble Click mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.If an update is found, it will download and install the latest version.Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.Go to Kaspersky website and perform an online antivirus scan.Read through the requirements and privacy statement and click on Accept button.It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.When the downloads have finished, click on Settings.Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programsArchivesMail databases[*]Click on My Computer under Scan.[*]Once the scan is complete, it will display the results. Click on View Scan Report.[*]You will see a list of infected items there. Click on Save Report As....[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Link to post Share on other sites
alvarez Posted November 1, 2008 Author Report Share Posted November 1, 2008 Malwarebytes' Anti-Malware 1.30Database version: 1349Windows 6.0.6001 Service Pack 11/11/2008 12:20:46 PMmbam-log-2008-11-01 (12-20-46).txtScan type: Quick ScanObjects scanned: 46852Time elapsed: 2 minute(s), 9 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 4Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)the kaspersky scanner keeps crashing while its uploading Link to post Share on other sites
Rorschach112 Posted November 1, 2008 Report Share Posted November 1, 2008 If you cant get it working then just post a new HJT log Link to post Share on other sites
alvarez Posted November 1, 2008 Author Report Share Posted November 1, 2008 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 7:36:36 PM, on 1/11/2008Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v7.00 (7.00.6001.18000)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEC:\Program Files\Dell\DellDock\DellDock.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\RtHDVCpl.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Dell\MediaDirect\PCMService.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Windows\ehome\ehtray.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\uTorrent\uTorrent.exeC:\Windows\system32\wuauclt.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\IEUser.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Windows\system32\SearchFilterHost.exeC:\Users\thing\Documents\HJT\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLLO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dllO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllO3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exeO4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exeO4 - HKLM\..\Run: [updReg] C:\Windows\UpdReg.EXEO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "c:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exeO4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exeO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\users\thing\appdata\local\temp\IXP009.TMP\VKXSNIN.SH! c:\users\thing\appdata\local\temp\IXP009.SH! c:\users\thing\appdata\local\temp\IXP008.SH! c:\users\thing\appdata\local\temp\IXP007.SH! c:\users\thing\appdata\local\temp\IXP006.SH! c:\users\thing\appdata\local\temp\IXP005.SH! c:\users\thing\appdata\local\temp\IXP004.SH! c:\users\thing\appdata\local\temp\IXP003.SH! c:\users\thing\appdata\local\temp\IXP002.SH! c:\users\thing\appdata\local\temp\IXP000.SH! (User 'Default user')O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')O4 - Startup: Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exeO4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix: O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLLO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dllO23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exeO23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exeO23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exeO23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 9000 bytes Link to post Share on other sites
Rorschach112 Posted November 1, 2008 Report Share Posted November 1, 2008 Your logs are cleanMake sure you have an Internet Connection.Download OTCleanIt to your desktop and run itA list of tool components used in the Cleanup of malware will be downloaded.If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.Click Yes to beging the Cleanup process and remove these components, including this application.You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.Please download JavaRa to your desktop and unzip it to its own folderRun JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.Accept any prompts. Open JavaRa.exe again and select Search For Updates.Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. The easiest and safest way to do this is:1. Create a new Restore Point Click on the Start button to open your Start Menu. Click on the Control Panel menu option. Click on the System and Maintenance menu option. Click on the System menu option. Click on System Protection in the left-hand task list. Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point. Type in a title for the manual restore point and press the Create button. Close the System window after you have been advised that the procedure has been successfully completed..2. Clear your existing system restore points except for the new clean restore point you just created: Go to Start > Run and type in cleanmgr Select the More options tab Next to System Restore click Clean upThis will remove all restore points except the new one you just created.Below I have included a number of recommendations for how to protect your computer against malware infections.* Keep Windows updated by regularly checking their website at :http://windowsupdate.microsoft.com/This will ensure your computer has always the latest security updates available installed on your computer.* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:SpywareBlaster protects against bad ActiveXIE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all Have a look at this tutorial for IE-Spyad here* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.Make Internet Explorer more secureClick Start > RunType Inetcpl.cpl & click OKClick on the Security tabClick Reset all zones to default levelMake sure the Internet Zone is selected & Click Custom levelIn the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".Next Click OK, then Apply button and then OK to exit the Internet Properties page.*ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.*NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points.*Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop upblocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'HereThank you for your patience, and performing all of the procedures requested. Link to post Share on other sites
alvarez Posted November 1, 2008 Author Report Share Posted November 1, 2008 Thanks for all your help! You saved me =DThanks~ Link to post Share on other sites
Rorschach112 Posted November 3, 2008 Report Share Posted November 3, 2008 Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. Link to post Share on other sites
Recommended Posts