Infection with PreciseAd Malware

infectedone

New member
Hello!

I believe I am infected with precisead malware. I have backup of system registry and HJT log (attached).

Thanks in advance for your help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:06 AM, on 6/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Vongo\VongoService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-1219393502-2404566984-3178860527-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Sarah')
O4 - HKUS\S-1-5-21-1219393502-2404566984-3178860527-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Sarah')
O4 - HKUS\S-1-5-21-1219393502-2404566984-3178860527-1006\..\Run: [ares ultra] "C:\Program Files\Ares Ultra\Ares Ultra.exe" -h (User 'Sarah')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.5.709.30344 (GoogleDesktopManager-093007-112848) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 10661 bytes
 
Last edited by a moderator:
I'm getting constant pop-up ads with Internet Explorer. Several programs with "precisead" show up in Add/Remove Programs. If I try to uninstall them, it pops up with a warning about losing rights to some identified source and asks for me to enter a validation code as displayed on the screen. I have not proceeded with the uninstall and have disconnected that computer fromt he internet.

Thanks!
 
I was reviewing the first post and realize that there is a problem with the HJT log. It does not match the one that I attached. (I'm guessing that since I did not post it correctly, another one was mistakenly copied in when it was corrected.) I am re-posting the original log here...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:26 PM, on 6/14/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Windows\SysWOW64\regsvr32.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\...\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
O2 - BHO: precisead - {49eb5486-beb0-a3f7-761d-0472422e0547} - C:\Windows\SysWow64\nshC382.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: precisead search enhancer - {B29A5D2B-CD02-969A-9953-FC78079A089B} - C:\Windows\SysWow64\idvquufhaccg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: precisead browser enhancer - {EAADC6F6-97D9-45C0-1F9B-A62CF7A8A292} - C:\Windows\SysWow64\yfwjpqkzcym.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~2\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [ycwfhfjxalkkcgjnv] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\yfwjpqkzcym.dll"
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBackMonitor - McAfee - C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13565 bytes

Thanks again and sorry for the confusion.
 
I see.

Please save any items you were working on... close any open programs. You may be asked to reboot your machine.
Please download Malwarebytes Anti-Malware and save it to your desktop. If needed...Tutorial w/screenshots
Alternate download site available here.
  1. Make sure you are connected to the Internet.
  2. Double-click on Download_mbam-setup.exe to install the application.
  3. When the installation begins, follow the prompts and do not make any changes to default settings.
  4. When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
    • Then click Finish.
    MBAM will automatically start and you will be asked to update the program before performing a scan.
    • If an update is found, the program will automatically update itself.
    • Press the OK button to close that box and continue.
    • Problems downloading the updates? Manually download them from here and double-click on "mbam-rules.exe" to install.
On the Scanner tab:
  1. Make sure the "Perform Quick Scan" option is selected.
  2. Then click on the Scan button.
  3. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  4. The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  5. When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  6. Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:
  1. Click on the Show Results button to see a list of any malware that was found.
  2. Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
    We will take care of the System Volume Information items later.
  3. When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  4. The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  5. Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Please download RSIT by random/random... save it to your desktop.
  1. Right click on RSIT.exe and select "Run As Administrator" to run it. If Windows UAC prompts you, please allow it.
  2. Please read the disclaimer... click on Continue.
  3. RSIT will start running. When done... 2 logs files...will be produced.
  4. The first one, "log.txt", will be maximized
  5. The second one, "info.txt", will be minimized.
Please post both... "log.txt" and "info.txt", file contents in your next reply.
(These logs can be lengthy, so post 1 log per reply please.)

Post:

- mbam log
- rsit logs (taken after mbam run)
 
MBAM Log follows:

Malwarebytes' Anti-Malware 1.37
Database version: 2277
Windows 6.0.6002 Service Pack 2

6/14/2009 3:46:14 PM
mbam-log-2009-06-14 (15-46-14).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 353337
Time elapsed: 1 hour(s), 11 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{23e99604-9fe9-71dc-3123-b49e1bc4057f} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{49eb5486-beb0-a3f7-761d-0472422e0547} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{49eb5486-beb0-a3f7-761d-0472422e0547} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b29a5d2b-cd02-969a-9953-fc78079a089b} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b29a5d2b-cd02-969a-9953-fc78079a089b} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eaadc6f6-97d9-45c0-1f9b-a62cf7a8a292} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{eaadc6f6-97d9-45c0-1f9b-a62cf7a8a292} (Adware.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ycwfhfjxalkkcgjnv (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\yfwjpqkzcym.dll (Trojan.Agent) -> Delete on reboot.
c:\Windows\System32\efcryp32.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
c:\Windows\System32\idvquufhaccg.dll-uninst.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\nshC382.dll (Adware.BHO) -> Delete on reboot.
C:\Windows\SysWOW64\idvquufhaccg.dll (Adware.AdRotator) -> Delete on reboot.
C:\Windows\SysWOW64\yfwjpqkzcym.dll (Adware.BHO) -> Delete on reboot.
 
RSIT Log.txt follows (Part 1 - Part 2 in next reply):

Logfile of random's system information tool 1.06 (written by random/random)
Run by Gwen E. Murray at 2009-06-15 09:43:01
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 858 GB (91%) free of 938 GB
Total RAM: 8190 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:43:17 AM, on 6/15/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Users\Gwen E. Murray\Desktop\RSIT.exe
c:\PROGRA~2\mcafee\mpf\mc\mpfalert.exe
C:\Program Files (x86)\trend micro\Gwen E. Murray.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~2\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBackMonitor - McAfee - C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13256 bytes

======Scheduled tasks folder======

C:\Windows\tasks\McDefragTask.job
C:\Windows\tasks\McQcTask.job
C:\Windows\tasks\RtlNICDiagVistaStart.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}]
McAfee Phishing Filter - c:\PROGRA~2\mcafee\msk\mskapbho.dll [2009-01-09 246800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
scriptproxy - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll [2009-03-25 62784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll [2009-06-14 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-04-20 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2009-02-13 150032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-04-27 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\Program Files (x86)\Dell\BAE\BAE.dll [2006-11-09 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-02-27 349576]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll [2009-06-14 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-01-21 61440]
"mcagent_exe"=C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe [2009-03-25 645328]
"PDVDDXSrv"=C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [2008-05-23 128296]
"McENUI"=C:\PROGRA~2\McAfee\MHN\McENUI.exe [2009-01-09 1176808]
"RoxWatchTray"=C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [2007-08-16 236016]
"Adobe Acrobat Speed Launcher"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-02-27 38768]
""= []
"Acrobat Assistant 8.0"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-02-27 640376]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2009-01-05 413696]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2009-04-02 342312]
"hpqSRMon"=C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [2008-06-02 80896]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-10-21 68856]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.exe.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Gamma Loader.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
HP Digital Imaging Monitor.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
QuickBooks Update Agent.lnk - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"BindDirectlyToPropertySetStorage"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
shell\AutoRun\command - J:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8b013aa-a2c4-11dd-bc12-00217044cc10}]
shell\AutoRun\command - J:\LaunchU3.exe


======File associations======

.js - edit - C:\Windows\SysWOW64\Notepad.exe %1
.js - open - C:\Windows\SysWOW64\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-06-15 09:43:01 ----D---- C:\rsit
2009-06-15 09:43:01 ----D---- C:\Program Files (x86)\trend micro
2009-06-14 14:31:49 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\Malwarebytes
2009-06-14 14:31:44 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2009-06-14 11:57:37 ----D---- C:\Program Files (x86)\ERUNT
2009-06-14 11:21:55 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2009-06-13 21:30:25 ----D---- C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2009-06-13 21:30:25 ----D---- C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2009-06-13 21:22:58 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\PeerNetworking
2009-06-13 21:03:37 ----A---- C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
2009-06-13 21:03:24 ----A---- C:\Windows\system32\ypkvbbfoombcatdic.exe
2009-06-09 18:58:23 ----A---- C:\Windows\system32\mshtml.dll
2009-06-09 18:58:22 ----A---- C:\Windows\system32\ieframe.dll
2009-06-09 18:58:21 ----A---- C:\Windows\system32\iertutil.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\wininet.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\urlmon.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\ieui.dll
2009-06-09 18:58:20 ----A---- C:\Windows\system32\iedkcs32.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\jsproxy.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\iesetup.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\iernonce.dll
2009-06-09 18:58:19 ----A---- C:\Windows\system32\ie4uinit.exe
2009-06-09 18:58:00 ----A---- C:\Windows\system32\rpcrt4.dll
2009-06-09 18:57:54 ----A---- C:\Windows\system32\localspl.dll
2009-05-30 09:29:58 ----D---- C:\Windows\system32\vi-VN
2009-05-30 09:29:58 ----D---- C:\Windows\system32\eu-ES
2009-05-30 09:29:58 ----D---- C:\Windows\system32\ca-ES
2009-05-30 09:15:33 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-05-30 09:15:28 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-05-30 09:15:26 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-05-30 09:15:24 ----A---- C:\Windows\system32\SLCExt.dll
2009-05-30 09:15:21 ----A---- C:\Windows\system32\mssrch.dll
2009-05-30 09:15:18 ----A---- C:\Windows\system32\WscEapPr.dll
2009-05-30 09:15:18 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-05-30 09:15:16 ----A---- C:\Windows\system32\tquery.dll
2009-05-30 09:15:14 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-05-30 09:15:13 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-05-30 09:15:13 ----A---- C:\Windows\system32\RMActivate.exe
2009-05-30 09:15:12 ----A---- C:\Windows\system32\msi.dll
2009-05-30 09:15:11 ----A---- C:\Windows\system32\secproc_isv.dll
2009-05-30 09:15:11 ----A---- C:\Windows\system32\imapi2fs.dll
2009-05-30 09:15:10 ----A---- C:\Windows\system32\mf.dll
2009-05-30 09:15:10 ----A---- C:\Windows\system32\icardagt.exe
2009-05-30 09:15:08 ----A---- C:\Windows\system32\spwizui.dll
2009-05-30 09:15:08 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-05-30 09:15:06 ----A---- C:\Windows\system32\spreview.exe
2009-05-30 09:15:06 ----A---- C:\Windows\system32\spinstall.exe
2009-05-30 09:15:05 ----A---- C:\Windows\system32\drmv2clt.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\shell32.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\secproc.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-05-30 09:15:04 ----A---- C:\Windows\system32\p2psvc.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-05-30 09:15:04 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-05-30 09:15:03 ----A---- C:\Windows\system32\mssvp.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\ntdll.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\mssphtb.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\mssph.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-05-30 09:15:02 ----A---- C:\Windows\system32\mscoree.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\kernel32.dll
2009-05-30 09:15:02 ----A---- C:\Windows\system32\imapi2.dll
2009-05-30 09:15:01 ----A---- C:\Windows\system32\sdohlp.dll
2009-05-30 09:15:01 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-05-30 09:15:01 ----A---- C:\Windows\system32\esent.dll
2009-05-30 09:15:01 ----A---- C:\Windows\system32\DevicePairing.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\sperror.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\SLC.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-05-30 09:15:00 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-05-30 09:15:00 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-05-30 09:15:00 ----A---- C:\Windows\system32\korwbrkr.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-05-30 09:14:59 ----A---- C:\Windows\system32\wmp.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\msshsq.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\msjet40.dll
2009-05-30 09:14:59 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-05-30 09:14:58 ----A---- C:\Windows\system32\msxml6.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\user32.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\Query.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\msexch40.dll
2009-05-30 09:14:57 ----A---- C:\Windows\system32\EhStorShell.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\srchadmin.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\P2PGraph.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\ole32.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\msxml3.dll
2009-05-30 09:14:56 ----A---- C:\Windows\system32\IasMigReader.exe
2009-05-30 09:14:56 ----A---- C:\Windows\explorer.exe
2009-05-30 09:14:55 ----A---- C:\Windows\system32\mmc.exe
2009-05-30 09:14:55 ----A---- C:\Windows\system32\gdi32.dll
2009-05-30 09:14:55 ----A---- C:\Windows\system32\EncDec.dll
2009-05-30 09:14:55 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-05-30 09:14:54 ----A---- C:\Windows\system32\riched20.dll
2009-05-30 09:14:54 ----A---- C:\Windows\system32\RacEngn.dll
2009-05-30 09:14:54 ----A---- C:\Windows\system32\Magnify.exe
2009-05-30 09:14:54 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-05-30 09:14:54 ----A---- C:\Windows\system32\fdBth.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\spoolss.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-05-30 09:14:53 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-05-30 09:14:53 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\milcore.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\CertEnroll.dll
2009-05-30 09:14:53 ----A---- C:\Windows\system32\bcrypt.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\Storprop.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\msvcp60.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\msjtes40.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\infocardapi.dll
2009-05-30 09:14:52 ----A---- C:\Windows\system32\gpedit.dll
2009-05-30 09:14:51 ----A---- C:\Windows\system32\mstext40.dll
2009-05-30 09:14:51 ----A---- C:\Windows\system32\es.dll
2009-05-30 09:14:51 ----A---- C:\Windows\system32\advapi32.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\WMPhoto.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\WebClnt.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\slwmi.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\msxbde40.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\msexcl40.dll
2009-05-30 09:14:50 ----A---- C:\Windows\system32\comsvcs.dll
2009-05-30 09:14:48 ----A---- C:\Windows\system32\vssapi.dll
2009-05-30 09:14:48 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-05-30 09:14:48 ----A---- C:\Windows\system32\authui.dll
2009-05-30 09:14:47 ----A---- C:\Windows\system32\PresentationHost.exe
2009-05-30 09:14:47 ----A---- C:\Windows\system32\mstscax.dll
2009-05-30 09:14:47 ----A---- C:\Windows\system32\msrepl40.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\propsys.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\newdev.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\iasrecst.dll
2009-05-30 09:14:46 ----A---- C:\Windows\system32\explorer.exe
2009-05-30 09:14:46 ----A---- C:\Windows\system32\eudcedit.exe
2009-05-30 09:14:46 ----A---- C:\Windows\system32\crypt32.dll
2009-05-30 09:14:45 ----A---- C:\Windows\system32\setupapi.dll
2009-05-30 09:14:45 ----A---- C:\Windows\system32\mspbde40.dll
2009-05-30 09:14:45 ----A---- C:\Windows\system32\d3d9.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\shlwapi.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\msltus40.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\mfc42.dll
2009-05-30 09:14:44 ----A---- C:\Windows\system32\davclnt.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\wevtapi.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\photowiz.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\nlhtml.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\msrd3x40.dll
2009-05-30 09:14:43 ----A---- C:\Windows\system32\browseui.dll
2009-05-30 09:14:42 ----A---- C:\Windows\system32\quartz.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\xmlfilter.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\winhttp.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\win32spl.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\oleaut32.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\netshell.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\mswstr10.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\msv1_0.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\msctf.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\kerberos.dll
2009-05-30 09:14:41 ----A---- C:\Windows\system32\apds.dll
2009-05-30 09:14:40 ----A---- C:\Windows\system32\msvcrt.dll
2009-05-30 09:14:40 ----A---- C:\Windows\system32\mfc42u.dll
2009-05-30 09:14:40 ----A---- C:\Windows\system32\eapphost.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\secur32.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\propdefs.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\odbc32.dll
2009-05-30 09:14:39 ----A---- C:\Windows\system32\msrd2x40.dll
2009-05-30 09:14:38 ----A---- C:\Windows\system32\shdocvw.dll
2009-05-30 09:14:38 ----A---- C:\Windows\system32\dbgeng.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\WsmSvc.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\wevtutil.exe
2009-05-30 09:14:37 ----A---- C:\Windows\system32\usp10.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\mssitlb.dll
2009-05-30 09:14:37 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\schannel.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\netlogon.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\msscb.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\msctfp.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\drvinst.exe
2009-05-30 09:14:36 ----A---- C:\Windows\system32\devmgr.dll
2009-05-30 09:14:36 ----A---- C:\Windows\system32\adsldpc.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\WSDApi.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-05-30 09:14:35 ----A---- C:\Windows\system32\Wldap32.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\wcnwiz.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-05-30 09:14:35 ----A---- C:\Windows\system32\evr.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\wcncsvc.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\taskeng.exe
2009-05-30 09:14:34 ----A---- C:\Windows\system32\services.exe
2009-05-30 09:14:34 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\mswdat10.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\msjter40.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\msdtcprx.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\msdrm.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\mimefilt.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\comdlg32.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\certcli.dll
2009-05-30 09:14:34 ----A---- C:\Windows\system32\adtschema.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\rtffilt.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\rsaenh.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\reg.exe
2009-05-30 09:14:33 ----A---- C:\Windows\system32\msshooks.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\msscntrs.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\msihnd.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\dnsapi.dll
2009-05-30 09:14:33 ----A---- C:\Windows\system32\certutil.exe
2009-05-30 09:14:32 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-05-30 09:14:32 ----A---- C:\Windows\system32\netapi32.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\mtxclu.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\msstrc.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\mscories.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\inetcomm.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\hidserv.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\fundisc.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\dfshim.dll
2009-05-30 09:14:32 ----A---- C:\Windows\system32\cryptsvc.dll
2009-05-30 09:14:31 ----A---- C:\Windows\system32\shsvcs.dll
2009-05-30 09:14:31 ----A---- C:\Windows\system32\msiexec.exe
2009-05-30 09:14:31 ----A---- C:\Windows\system32\imapi.dll
2009-05-30 09:14:31 ----A---- C:\Windows\system32\gameux.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\wdc.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\imm32.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\iassdo.dll
2009-05-30 09:14:30 ----A---- C:\Windows\system32\chsbrkr.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\spcmsg.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\scrrun.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\pnidui.dll
2009-05-30 09:14:29 ----A---- C:\Windows\system32\autofmt.exe
2009-05-30 09:14:28 ----A---- C:\Windows\system32\slmgr.vbs
2009-05-30 09:14:28 ----A---- C:\Windows\system32\pidgenx.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\pdh.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-05-30 09:14:28 ----A---- C:\Windows\system32\azroles.dll
2009-05-30 09:14:27 ----A---- C:\Windows\system32\wmpmde.dll
2009-05-30 09:14:27 ----A---- C:\Windows\system32\winlogon.exe
2009-05-30 09:14:27 ----A---- C:\Windows\system32\SyncCenter.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\untfs.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\spp.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\sethc.exe
2009-05-30 09:14:26 ----A---- C:\Windows\system32\scrobj.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\rtutils.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\ncrypt.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\iassam.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\comuid.dll
2009-05-30 09:14:26 ----A---- C:\Windows\system32\certmgr.dll
2009-05-30 09:14:25 ----A---- C:\Windows\system32\taskcomp.dll
2009-05-30 09:14:25 ----A---- C:\Windows\system32\autochk.exe
2009-05-30 09:14:24 ----A---- C:\Windows\system32\WMVDECOD.DLL
2009-05-30 09:14:24 ----A---- C:\Windows\system32\userenv.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\printui.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\onex.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\iasnap.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\cscript.exe
2009-05-30 09:14:24 ----A---- C:\Windows\system32\basecsp.dll
2009-05-30 09:14:24 ----A---- C:\Windows\system32\autoconv.exe
2009-05-30 09:14:24 ----A---- C:\Windows\system32\audiodg.exe
2009-05-30 09:14:23 ----A---- C:\Windows\system32\RelMon.dll
2009-05-30 09:14:23 ----A---- C:\Windows\system32\osk.exe
2009-05-30 09:14:23 ----A---- C:\Windows\system32\mswsock.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\WinSCard.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\winmm.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\WerFault.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\Utilman.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\stobject.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\SndVol.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\rdpencom.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\offfilt.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\msftedit.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\mscms.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\mfplat.dll
2009-05-30 09:14:22 ----A---- C:\Windows\system32\diskraid.exe
2009-05-30 09:14:22 ----A---- C:\Windows\system32\apphelp.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\wscript.exe
2009-05-30 09:14:21 ----A---- C:\Windows\system32\wscntfy.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\ulib.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\rastapi.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\prnntfy.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\pnpsetup.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\odbccp32.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\msnetobj.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-05-30 09:14:21 ----A---- C:\Windows\system32\iasdatastore.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\fdProxy.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\dsound.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\cryptui.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\AudioEng.dll
2009-05-30 09:14:21 ----A---- C:\Windows\system32\adsmsext.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\wlangpui.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\vdsdyn.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\rastls.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\iashlpr.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\gpapi.dll
2009-05-30 09:14:20 ----A---- C:\Windows\system32\diskpart.exe
2009-05-30 09:14:19 ----A---- C:\Windows\system32\wusa.exe
2009-05-30 09:14:19 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-05-30 09:14:19 ----A---- C:\Windows\system32\rasapi32.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\ntprint.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\netiohlp.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\mscorier.dll
2009-05-30 09:14:19 ----A---- C:\Windows\system32\logman.exe
2009-05-30 09:14:19 ----A---- C:\Windows\system32\iasrad.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\zipfldr.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\wshext.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\wer.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\rasdlg.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\netcenter.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\iassvcs.dll
2009-05-30 09:14:18 ----A---- C:\Windows\system32\findstr.exe
2009-05-30 09:14:17 ----A---- C:\Windows\system32\wsnmp32.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\tsbyuv.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\themecpl.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\slcc.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\scansetting.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\ntmarta.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\msutb.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\mstlsapi.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\mssprxy.dll
2009-05-30 09:14:17 ----A---- C:\Windows\system32\iasads.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\wlanhlp.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\powrprof.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\powercpl.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\newdev.exe
2009-05-30 09:14:16 ----A---- C:\Windows\system32\networkmap.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\mstsc.exe
2009-05-30 09:14:16 ----A---- C:\Windows\system32\lpk.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\icardres.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\iasacct.dll
2009-05-30 09:14:16 ----A---- C:\Windows\system32\authz.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\systemcpl.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\sud.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\pcaui.dll
2009-05-30 09:14:13 ----A---- C:\Windows\system32\connect.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\wpcao.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\wlanpref.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\vdsutil.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\usercpl.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\themeui.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\samlib.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\rpchttp.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\regapi.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\qdvd.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\msinfo32.exe
2009-05-30 09:14:12 ----A---- C:\Windows\system32\mmci.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\autoplay.dll
2009-05-30 09:14:12 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\WMPEncEn.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\tapisrv.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\scksp.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\scesrv.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\psisdecd.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\oleprn.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\mpr.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\feclient.dll
2009-05-30 09:14:11 ----A---- C:\Windows\system32\AudioSes.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\wscisvif.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\rekeywiz.exe
2009-05-30 09:14:10 ----A---- C:\Windows\system32\qedit.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\perfdisk.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\ncryptui.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\iaspolcy.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\hdwwiz.exe
2009-05-30 09:14:10 ----A---- C:\Windows\system32\Faultrep.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\dpapimig.exe
2009-05-30 09:14:10 ----A---- C:\Windows\system32\dot3msm.dll
2009-05-30 09:14:10 ----A---- C:\Windows\system32\certreq.exe
2009-05-30 09:14:09 ----A---- C:\Windows\system32\whealogr.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\TSTheme.exe
2009-05-30 09:14:09 ----A---- C:\Windows\system32\tcpmon.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\spwinsat.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\scecli.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\rasplap.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\rasgcw.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-05-30 09:14:09 ----A---- C:\Windows\system32\fdWSD.dll
2009-05-30 09:14:09 ----A---- C:\Windows\system32\cmmon32.exe
2009-05-30 09:14:08 ----A---- C:\Windows\system32\wiaaut.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\SCardSvr.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\raschap.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\fontext.dll
2009-05-30 09:14:08 ----A---- C:\Windows\system32\conime.exe
2009-05-30 09:14:08 ----A---- C:\Windows\system32\cmdial32.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-05-30 09:14:07 ----A---- C:\Windows\system32\wlanui.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\wlanmsm.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\shwebsvc.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\shsetup.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\rasppp.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\rasmontr.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\oobefldr.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\mscandui.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\modemui.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\dsprop.dll
2009-05-30 09:14:07 ----A---- C:\Windows\system32\dimsroam.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\WSDMon.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\wmpeffects.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\netplwiz.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\dataclen.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\credui.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\chtbrkr.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\blackbox.dll
2009-05-30 09:14:06 ----A---- C:\Windows\system32\AUDIOKSE.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\wscapi.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\wpdwcn.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\wpcsvc.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\thawbrkr.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\sendmail.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\networkexplorer.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\msscp.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\msimtf.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\logagent.exe
2009-05-30 09:14:05 ----A---- C:\Windows\system32\InkEd.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\ifmon.dll
2009-05-30 09:14:05 ----A---- C:\Windows\system32\gpresult.exe
2009-05-30 09:14:05 ----A---- C:\Windows\system32\cipher.exe
2009-05-30 09:14:04 ----A---- C:\Windows\system32\softkbd.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\puiapi.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\olepro32.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\msctfui.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\dmsynth.dll
2009-05-30 09:14:04 ----A---- C:\Windows\system32\Apphlpdm.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\wshbth.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\wmdrmdev.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\WMADMOD.DLL
2009-05-30 09:14:03 ----A---- C:\Windows\system32\version.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\msisip.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\mprapi.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\input.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\fdSSDP.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\fc.exe
2009-05-30 09:14:03 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-05-30 09:14:03 ----A---- C:\Windows\system32\dmusic.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\wsdchngr.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\wmdrmnet.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\rrinstaller.exe
2009-05-30 09:14:02 ----A---- C:\Windows\system32\rasdial.exe
2009-05-30 09:14:02 ----A---- C:\Windows\system32\rasdiag.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\msjint40.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\l2nacp.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\ftp.exe
2009-05-30 09:14:02 ----A---- C:\Windows\system32\eapp3hst.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\cscdll.dll
2009-05-30 09:14:02 ----A---- C:\Windows\system32\cscapi.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\tscupgrd.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\slcinst.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\ocsetup.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\nslookup.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\MSMPEG2ENC.DLL
2009-05-30 09:14:01 ----A---- C:\Windows\system32\MSAC3ENC.DLL
2009-05-30 09:14:01 ----A---- C:\Windows\system32\mmcico.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\mfps.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\ipconfig.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\hbaapi.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\fdWCN.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\fdeploy.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\eappgnui.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\eappcfg.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\dot3cfg.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-05-30 09:14:01 ----A---- C:\Windows\system32\bthudtask.exe
2009-05-30 09:14:01 ----A---- C:\Windows\system32\aaclient.dll
2009-05-30 09:14:00 ----A---- C:\Windows\system32\tsgqec.dll
2009-05-30 09:14:00 ----A---- C:\Windows\system32\mfpmp.exe
2009-05-30 09:14:00 ----A---- C:\Windows\system32\gpupdate.exe
2009-05-30 09:14:00 ----A---- C:\Windows\system32\atmlib.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\wmpps.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\winrnr.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\vdmdbg.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\slwga.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\odbcconf.dll
2009-05-30 09:13:59 ----A---- C:\Windows\system32\NcdProp.dll
2009-05-30 09:13:58 ----A---- C:\Windows\system32\midimap.dll
2009-05-30 09:13:58 ----A---- C:\Windows\system32\atmfd.dll
2009-05-30 09:13:57 ----A---- C:\Windows\system32\spwmp.dll
2009-05-30 09:13:57 ----A---- C:\Windows\system32\dxmasf.dll
2009-05-30 09:13:56 ----A---- C:\Windows\system32\wmploc.DLL
2009-05-30 09:13:56 ----A---- C:\Windows\system32\msimsg.dll
2009-05-30 09:13:56 ----A---- C:\Windows\system32\mferror.dll
2009-05-30 09:13:56 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-05-30 09:13:44 ----A---- C:\Windows\system32\wdscore.dll
2009-05-30 09:13:40 ----A---- C:\Windows\system32\drvstore.dll
2009-05-24 12:04:01 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\HP
2009-05-24 11:59:58 ----D---- C:\Windows\system32\spool
2009-05-24 11:59:29 ----D---- C:\Program Files (x86)\Common Files\HP
2009-05-24 11:59:26 ----D---- C:\Program Files (x86)\Common Files\Hewlett-Packard
2009-05-24 11:59:24 ----D---- C:\Program Files (x86)\Hewlett-Packard
2009-05-24 11:49:57 ----A---- C:\hpzids40.dll
2009-05-24 11:49:56 ----A---- C:\Windows\system32\hpzc35jy.dll
2009-05-24 11:49:56 ----A---- C:\Windows\system32\hpcdmc32.dll
2009-05-24 11:49:29 ----RA---- C:\Windows\hpzshl40.exe
2009-05-24 11:49:29 ----RA---- C:\Windows\hpzmsi01.exe
2009-05-24 11:49:28 ----D---- C:\Windows\braveheart
2009-05-24 11:49:15 ----D---- C:\Program Files (x86)\HP
2009-05-24 11:49:13 ----HD---- C:\Config.Msi

======List of files/folders modified in the last 1 months======

2009-06-15 09:43:17 ----D---- C:\Windows\Prefetch
2009-06-15 09:43:16 ----D---- C:\Windows\Temp
2009-06-15 09:43:05 ----D---- C:\Windows\System32
2009-06-15 09:43:04 ----D---- C:\Windows\inf
2009-06-15 09:43:01 ----RD---- C:\Program Files (x86)
2009-06-15 08:05:04 ----D---- C:\Windows
2009-06-14 15:47:54 ----D---- C:\Windows\SysWOW64
2009-06-14 14:31:45 ----D---- C:\Windows\system32\drivers
2009-06-14 14:31:44 ----HD---- C:\ProgramData
2009-06-14 13:26:26 ----SHD---- C:\Windows\Installer
2009-06-14 10:23:52 ----SHD---- C:\System Volume Information
2009-06-14 07:41:31 ----SD---- C:\Users\Gwen E. Murray\AppData\Roaming\Microsoft
2009-06-13 21:21:59 ----D---- C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire
2009-06-09 19:19:04 ----D---- C:\Windows\Microsoft.NET
2009-06-09 19:11:37 ----D---- C:\Windows\system32\migration
2009-06-09 19:11:37 ----D---- C:\Program Files (x86)\Internet Explorer
2009-06-09 19:11:33 ----D---- C:\Windows\ehome
2009-06-09 19:07:58 ----D---- C:\Windows\winsxs
2009-06-09 19:07:28 ----D---- C:\Program Files (x86)\Microsoft Works
2009-05-30 10:15:39 ----RSD---- C:\Windows\assembly
2009-05-30 09:51:46 ----D---- C:\Windows\rescache
2009-05-30 09:39:38 ----SHD---- C:\Boot
2009-05-30 09:39:05 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Sidebar
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Photo Gallery
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Media Player
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Mail
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Windows Calendar
2009-05-30 09:31:43 ----D---- C:\Program Files (x86)\Common Files\System
2009-05-30 09:31:42 ----D---- C:\Windows\servicing
2009-05-30 09:31:28 ----D---- C:\Windows\system32\XPSViewer
2009-05-30 09:31:28 ----D---- C:\Windows\system32\sk-SK
2009-05-30 09:31:28 ----D---- C:\Windows\system32\lv-LV
2009-05-30 09:31:28 ----D---- C:\Windows\system32\ko-KR
2009-05-30 09:31:28 ----D---- C:\Windows\system32\hr-HR
2009-05-30 09:31:28 ----D---- C:\Windows\system32\et-EE
2009-05-30 09:31:28 ----D---- C:\Windows\system32\da-DK
2009-05-30 09:31:25 ----D---- C:\Windows\system32\en-US
2009-05-30 09:31:22 ----D---- C:\Windows\system32\oobe
2009-05-30 09:31:22 ----D---- C:\Windows\system32\it-IT
2009-05-30 09:31:22 ----D---- C:\Windows\system32\el-GR
2009-05-30 09:31:22 ----D---- C:\Windows\system32\de-DE
2009-05-30 09:31:19 ----D---- C:\Windows\system32\zh-CN
2009-05-30 09:31:19 ----D---- C:\Windows\system32\sv-SE
2009-05-30 09:31:19 ----D---- C:\Windows\system32\sr-Latn-CS
2009-05-30 09:31:19 ----D---- C:\Windows\system32\SLUI
2009-05-30 09:31:19 ----D---- C:\Windows\system32\setup
2009-05-30 09:31:19 ----D---- C:\Windows\system32\ru-RU
2009-05-30 09:31:19 ----D---- C:\Windows\system32\pt-PT
2009-05-30 09:31:19 ----D---- C:\Windows\system32\hu-HU
2009-05-30 09:31:19 ----D---- C:\Windows\system32\he-IL
2009-05-30 09:31:19 ----D---- C:\Windows\system32\fr-FR
2009-05-30 09:31:19 ----D---- C:\Windows\system32\fi-FI
2009-05-30 09:31:19 ----D---- C:\Windows\system32\en
2009-05-30 09:31:19 ----D---- C:\Windows\system32\cs-CZ
2009-05-30 09:31:19 ----D---- C:\Windows\system32\AdvancedInstallers
2009-05-30 09:31:18 ----D---- C:\Windows\system32\zh-TW
2009-05-30 09:31:18 ----D---- C:\Windows\system32\uk-UA
2009-05-30 09:31:18 ----D---- C:\Windows\system32\tr-TR
2009-05-30 09:31:18 ----D---- C:\Windows\system32\th-TH
2009-05-30 09:31:18 ----D---- C:\Windows\system32\sl-SI
2009-05-30 09:31:18 ----D---- C:\Windows\system32\ro-RO
2009-05-30 09:31:18 ----D---- C:\Windows\system32\pl-PL
2009-05-30 09:31:18 ----D---- C:\Windows\system32\manifeststore
2009-05-30 09:31:18 ----D---- C:\Windows\system32\ja-JP
2009-05-30 09:31:18 ----D---- C:\Windows\system32\es-ES
2009-05-30 09:31:18 ----D---- C:\Windows\system32\bg-BG
2009-05-30 09:31:17 ----D---- C:\Windows\system32\wbem
2009-05-30 09:31:17 ----D---- C:\Windows\system32\nl-NL
2009-05-30 09:31:17 ----D---- C:\Windows\system32\nb-NO
2009-05-30 09:31:16 ----D---- C:\Windows\system32\pt-BR
2009-05-30 09:31:16 ----D---- C:\Windows\system32\migwiz
2009-05-30 09:31:16 ----D---- C:\Windows\system32\lt-LT
2009-05-30 09:31:16 ----D---- C:\Windows\system32\ar-SA
2009-05-30 09:30:52 ----D---- C:\Windows\IME
2009-05-30 09:30:08 ----RSD---- C:\Windows\Fonts
2009-05-30 09:30:06 ----D---- C:\Windows\AppPatch
2009-05-30 09:28:22 ----D---- C:\Windows\system32\RTCOM
2009-05-24 12:46:24 ----D---- C:\Windows\system32\Macromed
2009-05-24 12:44:19 ----SD---- C:\Windows\Downloaded Program Files
2009-05-24 12:03:57 ----A---- C:\Windows\win.ini
2009-05-24 11:59:31 ----D---- C:\Windows\twain_32
2009-05-24 11:59:29 ----D---- C:\Program Files (x86)\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys []
R1 MPFP;MPFP; C:\Windows\System32\Drivers\Mpfp.sys []
R2 RtNdPt60;Realtek NDIS Protocol Driver; C:\Windows\system32\DRIVERS\RtNdPt60.sys []
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys []
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys []
R3 dc3d;USBCCGP filter driver (dc3d); C:\Windows\system32\DRIVERS\dc3d.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys []
R3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys []
R3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys []
R3 mfesmfk;McAfee Inc. mfesmfk; C:\Windows\system32\drivers\mfesmfk.sys []
R3 NuidFltr;NUID filter driver; C:\Windows\system32\DRIVERS\NuidFltr.sys []
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys []
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys []
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys []
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys []
S3 Dot4Scan;Scan Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Scan.sys []
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys []
S3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032e.sys []
S3 mferkdk;McAfee Inc. mferkdk; C:\Windows\system32\drivers\mferkdk.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys []
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys []
S3 RimUsb;BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys []
S3 StillCam;Still Serial Digital Camera Driver; C:\Windows\system32\DRIVERS\serscan.sys []
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iastor.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []
 
RSIT Log.txt (Part 2)


======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AERTFilters;Andrea RT Filters Service; C:\Windows\system32\AERTSr64.exe []
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe []
R2 Bonjour Service;Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-08-22 214016]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R2 HPSLPSVC;HP Network Devices Support; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [2009-02-11 210216]
R2 mcmscsvc;McAfee Services; C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe [2009-03-25 797864]
R2 McNASvc;McAfee Network Agent; c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe [2009-01-09 2482848]
R2 McProxy;McAfee Proxy Service; c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-01-09 359952]
R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-03-25 153920]
R2 MpfService;McAfee Personal Firewall Service; C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe [2009-03-19 884360]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files (x86)\McAfee\MSK\MskSrver.exe [2009-01-09 26640]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-20 21504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-20 21504]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\bcmwltry.exe []
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R3 iPod Service;iPod Service; C:\Program Files (x86)\iPod\bin\iPodService.exe [2009-04-02 656168]
R3 McSysmon;McAfee SystemGuards; C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe [2009-03-24 606736]
S2 Roxio Upnp Server 9;Roxio Upnp Server 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe [2007-07-24 358896]
S2 RoxLiveShare9;LiveShare P2P Server 9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe [2007-08-16 309744]
S2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2007-08-16 166384]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-10-23 69632]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-03-30 89920]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-11-09 651720]
S3 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-27 182768]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 MBackMonitor;MBackMonitor; C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe [2009-01-09 68112]
S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-04-01 696848]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-20 19968]
S3 QBFCService;Intuit QuickBooks FCS; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [2006-11-09 65536]
S3 Roxio UPnP Renderer 9;Roxio UPnP Renderer 9; C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe [2007-07-24 88560]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-08-16 1092080]
S3 stllssvr;stllssvr; C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]
S4 QBCFMonitorService;QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [2008-03-18 20480]

-----------------EOF-----------------
 
RSIT Info.txt follows:

info.txt logfile of random's system information tool 1.06 2009-06-15 09:43:19

======Uninstall list======

-->C:\PROGRA~2\Yahoo!\Common\UNYT_W~1.EXE
-->MsiExec.exe /I{2BE0C605-9BEC-434D-9FAE-931194E72414}
-->MsiExec.exe /I{48A669A9-76FA-4CA8-BFD5-00C125AC4166}
-->MsiExec.exe /I{71EEA108-09C9-4D81-8FA2-D48C70681242}
-->MsiExec.exe /I{726A362E-EBFD-4C3F-8664-6593C2B08386}
-->MsiExec.exe /I{943CB81D-11B9-401E-8305-752528D00AA1}
-->MsiExec.exe /I{E75F019D-98A0-4B39-B1A8-3A01400D2A18}
-->MsiExec.exe /X{F664EDB9-59DF-452A-A3D7-085ED1B8D374}
Acrobat.com-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe Acrobat 9 Standard - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-BA7E-000000000004}
Adobe Acrobat 9 Standard - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-BA7E-000000000004}
Adobe AIR-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe GoLive CS (ENG)-->"C:\Program Files (x86)\InstallShield Installation Information\{D3E4251D-8364-4698-B0E0-A7C799384403}\setup.exe"
Adobe Photoshop 6.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files (x86)\Adobe\Photoshop 6.0\Uninst.isu" -c"C:\Program Files (x86)\Adobe\Photoshop 6.0\Uninst.dll"
Adobe Reader 9.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Adobe SVG Viewer-->C:\Windows\IsUninst.exe -f"C:\Windows\System32\Adobe\SVG Viewer\Uninst.isu"
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x9
Banctec Service Agreement-->MsiExec.exe /I{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}
Berlitz Before You Know It Flash Cards-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CDAE8C87-E61A-43FB-A59A-0AAF6077D0DD}\setup.exe" -l0x9
Berlitz Learning System - Spanish-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{16AA1AC2-07FA-46CF-8D3C-441D9E17EB33}\setup.exe" -l0x9
BlackBerry Desktop Software 4.3-->MsiExec.exe /I{D793A12F-E362-48BB-B332-1DA5E936B52D}
BlackBerry Desktop Software 4.3-->MsiExec.exe /i{D793A12F-E362-48BB-B332-1DA5E936B52D}
Browser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}
Browser Address Error Redirector-->regsvr32 /u /s "C:\Program Files (x86)\Dell\BAE\BAE.dll"
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Contextual Tool Precisead-->C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
Dell Best of Web-->MsiExec.exe /I{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}
Dell Getting Started Guide-->MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}
Dell Video Chat (remove only)-->C:\Program Files (x86)\Dell Video Chat\uninst.exe
Dell-eBay-->MsiExec.exe /I{B935C985-A17F-484B-8470-09E4FC27DC26}
EDocs-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}\setup.exe"
ERUNT 1.1j-->"C:\Program Files (x86)\ERUNT\unins000.exe"
Google Toolbar for Internet Explorer-->"C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HijackThis 2.0.2-->"C:\Program Files (x86)\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT=""
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
Infragisticsv62Install-->MsiExec.exe /X{14D6D5E1-5425-4BD1-BAFB-C26C053DC0AF}
Infragisticsv62Install-->MsiExec.exe /X{5C01E990-F14D-4E3C-A009-29F3640F034B}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Lernout & Hauspie TruVoice American English TTS Engine-->RunDll32 advpack.dll,LaunchINFSection C:\Windows\INF\tv_enua.inf, Uninstall
Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
McAfee SecurityCenter-->C:\Program Files (x86)\McAfee\MSC\mcuninst.exe
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0000-1000-0000000FF1CE} /uninstall {E64BA721-2310-4B55-BE5A-2925F9706192}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-002A-0409-1000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0116-0409-1000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Professional 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROR /dll OSETUP.DLL
Microsoft Office Professional 2007-->MsiExec.exe /X{91120000-0014-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
PowerDVD-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -l0x9 -cluninstall
QuickBooks Pro 2007-->msiexec.exe /I {71EEA108-09C9-4D81-8FA2-D48C70681242} UNIQUE_NAME="pro" QBFULLNAME="QuickBooks Pro 2007" ADDREMOVE=1
QuickBooks Product Listing Service-->MsiExec.exe /I{55584E16-4D70-44EE-93DD-F144E8B7D4B7}
Quicken 2007-->MsiExec.exe /X{0D2E80C8-0875-43EB-9623-47118E2DFBCA}
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek Ethernet Network Card Diagnostic tool for Windows Vista-->C:\Program Files (x86)\InstallShield Installation Information\{1FECF5F8-8E75-432C-9FF7-1C04F1956B54}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek High Definition Audio Driver-->RtlUpd64.exe -r -m -nrg2709
RON Too1 Precisead-->C:\Windows\system32\ypkvbbfoombcatdic.exe
Roxio Creator Audio-->MsiExec.exe /I{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}
Roxio Creator Copy-->MsiExec.exe /I{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}
Roxio Creator Data-->MsiExec.exe /I{08E81ABD-79F7-49C2-881F-FD6CB0975693}
Roxio Creator DE-->C:\ProgramData\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe /x {09760D42-E223-42AD-8C3E-55B47D0DDAC3}
Roxio Creator DE-->MsiExec.exe /I{ED439A64-F018-4DD4-8BA5-328D85AB09AB}
Roxio Creator Tools-->MsiExec.exe /I{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}
Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio Media Manager-->MsiExec.exe /X{303379C9-8610-4CCF-AF37-C4BF8998C591}
Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spybot - Search & Destroy-->"C:\Program Files (x86)\Spybot - Search & Destroy\unins000.exe"
SupportSoft Assisted Service-->MsiExec.exe /I{5A3F6A80-7913-475E-8B96-477A952CFA43}
UltraTax 2000-->C:\WinCSI\UT00\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2001-->C:\WinCSI\UT01\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2002-->C:\WinCSI\UT02\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2003-->C:\WinCSI\UT03\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax 2004-->C:\WinCSI\UT04\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2005-->C:\WinCSI\UT05\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2006-->C:\WinCSI\UT06\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2007-->C:\WinCSI\UT07\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax CS 2008-->C:\WinCSI\UT08\UTUNINST.EXE -OUTW -PC:\WinCSI
UltraTax Font Installer-->MsiExec.exe /I{7699AA03-8A8C-489E-AF9D-A76A5E97E879}
UltraTax Planner-->C:\WinCSI\UTP\PLUNINST.EXE -OUTP -PC:\WinCSI
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Outlook 2007 Junk Email Filter (kb970012)-->msiexec /package {91120000-0014-0000-0000-0000000FF1CE} /uninstall {DC4A962B-9EC2-469C-BC9C-87312ADAEE81}
Yahoo! Toolbar-->C:\PROGRA~2\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: Office-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958644(Security Update) is not applicable for this system
Record Number: 8240
Source Name: Microsoft-Windows-Servicing
Time Written: 20081023221558.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958644(Security Update) is not applicable for this system
Record Number: 8239
Source Name: Microsoft-Windows-Servicing
Time Written: 20081023221557.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 4374
Message: Windows Servicing identified that package KB958644(Security Update) is not applicable for this system
Record Number: 8233
Source Name: Microsoft-Windows-Servicing
Time Written: 20081023221557.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 15016
Message: Unable to initialize the security package Kerberos for server side authentication. The data field contains the error number.
Record Number: 8133
Source Name: Microsoft-Windows-HttpEvent
Time Written: 20081023221112.918360-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 4001
Message: WLAN AutoConfig service has successfully stopped.

Record Number: 8119
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20081023014326.328800-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

=====Application event log=====

Computer Name: Office-PC
Event Code: 10
Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 554
Source Name: Microsoft-Windows-WMI
Time Written: 20081023225017.000000-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 4621
Message: The COM+ Event System could not remove the EventSystem.EventSubscription object {AA44355E-6911-4447-BA5D-6720480579AF}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 80070005.
Record Number: 534
Source Name: Microsoft-Windows-EventSystem
Time Written: 20081023224713.000000-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 10
Message: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
Record Number: 522
Source Name: Microsoft-Windows-WMI
Time Written: 20081023221245.000000-000
Event Type: Error
User:

Computer Name: Office-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3087769141-909178524-1917751892-1000:
Process 588 (\Device\HarddiskVolume3\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-3087769141-909178524-1917751892-1000

Record Number: 503
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20081023014324.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: Office-PC
Event Code: 3013
Message: The entry <C:\USERS\GWEN E. MURRAY\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\ACCESSORIES\SYSTEM TOOLS\DESKTOP.INI> in the hash map cannot be updated.

Context: Windows Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Record Number: 491
Source Name: Microsoft-Windows-Search
Time Written: 20081023011101.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: Office-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: DHWKLLH1$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x26c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 438
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012213.022800-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: DHWKLLH1$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x26c
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 437
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012213.022800-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 4616
Message: The system time was changed.

Subject:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5

Process Information:
Process ID: 0x424
Name: C:\Windows\System32\svchost.exe

Previous Time: 9:21:58 PM 10/22/2008
New Time: 9:22:03 PM 10/22/2008

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
Record Number: 436
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012203.061756-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 4616
Message: The system time was changed.

Subject:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5

Process Information:
Process ID: 0x424
Name: C:\Windows\System32\svchost.exe

Previous Time: 9:22:03 PM 10/22/2008
New Time: 9:22:03 PM 10/22/2008

This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer.
Record Number: 435
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081023012203.061000-000
Event Type: Audit Success
User:

Computer Name: Office-PC
Event Code: 1102
Message: The audit log was cleared.
Subject:
Security ID: S-1-5-21-3087769141-909178524-1917751892-1000
Account Name: Gwen E. Murray
Domain Name: Office-PC
Logon ID: 0xd4f16
Record Number: 434
Source Name: Microsoft-Windows-Eventlog
Time Written: 20081023010859.874858-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\DLLShared\;C:\Program Files (x86)\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files (x86)\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=1707
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
"RoxioCentral"=C:\Program Files (x86)\Common Files\Roxio Shared\9.0\Roxio Central33\
"CLASSPATH"=.;C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------
 
Download OTMoveIt by Old Timer and save it to your Desktop.
  • Double-click OTM.exe. (Vista users, please right click on OTM.exe and select "Run as an Administrator")
  • Copy the lines in the codebox below.
Code:
:files
C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
C:\Windows\system32\ypkvbbfoombcatdic.exe
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire
  • Return to OTMoveIt, right click in the Paste Instructions for Items to be Moved window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.
  • Close OTMoveIt
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
 
Completed without re-booting.

========== FILES ==========
C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe moved successfully.
C:\Windows\system32\ypkvbbfoombcatdic.exe moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\themes\windows_theme moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\themes moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\promotion moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\certificate moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire\.AppSpecialShare moved successfully.
C:\Users\Gwen E. Murray\AppData\Roaming\LimeWire moved successfully.

OTM by OldTimer - Version 2.1.0.1 log created on 06152009_131739
 
Please go to Kaspersky website and perform an online antivirus scan.

  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply along with a fresh HijackThis log.
 
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Monday, June 15, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 64-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Monday, June 15, 2009 12:27:39
Records in database: 2345167
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Files scanned: 246325
Threat name: 6
Infected objects: 10
Suspicious objects: 0
Duration of the scan: 02:39:27


File name / Threat name / Threats count
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:NetTool.Win32.Portscan.c 1
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 2
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 4
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Users\Gwen E. Murray\Documents\Downloads\DELL drivers\UBCD4WinV310.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1

The selected area was scanned.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:02:22 PM, on 6/15/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Users\Gwen E. Murray\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~2\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files (x86)\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~2\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Unknown owner - C:\Windows\system32\AERTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBackMonitor - McAfee - C:\Program Files (x86)\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~2\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~2\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~2\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files (x86)\McAfee\MSK\MskSrver.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files (x86)\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12968 bytes
 
Does that mean that we reasonably believe the "infection" is gone?

Also, there are three items still appearing in the Add/Remove Programs List - Contextual Tool PreciseAd, Ron Too1 Precisead, and Support Soft Assisted Service. I know the first two are related to the malware, not sure of the third.

Prior to the removal techniques, when I tried to use Add/Remove it would pop-up with a warning about losing some rights and then ask for a verification code as displayed on the screen to be entered.

How can I remove these items?

Thanks!!!!!!!
 
They are likely just names on the list.

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

uninstall-man.jpg


5. Choose those entries and click Delete this entry.
 
Well they should not if files are not there.

Are these files still there?

C:\Windows\system32\b53645c8-33e7-312c-a874-ad7fde53373c.exe
C:\Windows\system32\ypkvbbfoombcatdic.exe
 
The files are not there. However, there are still 4 entries in my Registry with "precisead" and there are 2 new files in Windows\systems32 --

File Name: 7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

File Name: 7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

Thanks!
 
Back
Top