View Full Version : infected by trojan.vundo...help please
constantine
2008-09-05, 13:15
i installed spybot and every start up it alert me that registry is changing rundll32.exe blah blah blah.i checked the task manager and found that there are 3 rundll32.exe running.dont know what to do.i think those rundll.exe are malware.cause every startup its changing the registry.help please. new topic as advice with HJT log
heres the log thnx
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:22 PM, on 9/5/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\yphb.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ??????2 - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O2 - BHO: Yahoo!????????????? - {1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4} - C:\Program Files\Yahoo!\Companion\Installs\ypho.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: ??????2 ????? - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IME JPN 2007 Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEJP\IMJPKLMG.EXE /Preload
O4 - HKLM\..\Run: [E-Flyer] "C:\Program Files\Sony\E-Flyer\SubFlyer.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Honey_ko\AppData\Local\Temp\fccdawTn.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun ? Java ????? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219940906756&h=5d5553eda8f27f70a72a7a2ca205363e/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: McAfee Application Installer Cleanup (0278221220608219) (0278221220608219mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\027822~1.EXE
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Smart Network Service (BeService) - Sony Corporation - C:\Program Files\Sony\Smart Network\BeService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\Image Converter 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: TXVDrv Service (TxVDrvSvc) - Texim Corporation. - C:\Program Files\JustSystems\PersonalShelter\TxVDrvSvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 14574 bytes
Hi constantine
Please download Malwarebytes Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) and save it to your desktop.
alternate download link 1 (http://malwarebytes.gt500.org/mbam-setup.exe)
alternate download link 2 (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)
Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here (http://www.malwarebytes.org/mbam/database/mbam-rules.exe) and just double-click on mbam-rules.exe to install.
On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
Download random's system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
Post:
- mbam log
- RSIT logs (taken after mbam run)
constantine
2008-09-08, 15:34
i took a previous partial scan when i first install malwarebytes after reading some of the topics in this forum.heres is the log
Malwarebytes' Anti-Malware 1.26
Database version: 1112
Windows 6.0.6000
9/4/2008 8:34:21 PM
mbam-log-2008-09-04 (20-34-21).txt
Scan type: Full Scan (C:\|)
Objects scanned: 25418
Time elapsed: 4 minute(s), 29 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c85bd9f1-5b95-46da-9f39-979db6b58484} (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c85bd9f1-5b95-46da-9f39-979db6b58484} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\Honey_ko\AppData\Local\Temp\tuvVNHxy.dll (Trojan.Vundo) -> Delete on reboot.
C:\Windows\System32\bYomkhiJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
and tells me to reboot and made a partial scan again here it is
Malwarebytes' Anti-Malware 1.26
Database version: 1112
Windows 6.0.6000
9/4/2008 8:43:52 PM
mbam-log-2008-09-04 (20-43-52).txt
Scan type: Full Scan (C:\|)
Objects scanned: 19717
Time elapsed: 2 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\Honey_ko\AppData\Local\Temp\fccdawTn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
and here is the full scan today
Malwarebytes' Anti-Malware 1.27
Database version: 1128
Windows 6.0.6000
9/8/2008 9:24:14 PM
mbam-log-2008-09-08 (21-24-14).txt
Scan type: Full Scan (C:\|)
Objects scanned: 204999
Time elapsed: 2 hour(s), 24 minute(s), 21 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\end (Trojan.FakeAlert) -> Quarantined and deleted successfully.
constantine
2008-09-08, 15:49
AutoIt Error
Line - 1
Error: Subscript used with non-Array variable.
RSIT wont continue the above message is the error.
dont know what to do.
ill just post a new HJT log.
here it is
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:48:44 PM, on 9/8/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\conime.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\yphb.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ??????2 - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O2 - BHO: Yahoo!????????????? - {1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4} - C:\Program Files\Yahoo!\Companion\Installs\ypho.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: ??????2 ????? - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IME JPN 2007 Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEJP\IMJPKLMG.EXE /Preload
O4 - HKLM\..\Run: [E-Flyer] "C:\Program Files\Sony\E-Flyer\SubFlyer.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Honey_ko\AppData\Local\Temp\fccdawTn.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun ? Java ????? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219940906756&h=5d5553eda8f27f70a72a7a2ca205363e/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Smart Network Service (BeService) - Sony Corporation - C:\Program Files\Sony\Smart Network\BeService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\Image Converter 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: TXVDrv Service (TxVDrvSvc) - Texim Corporation. - C:\Program Files\JustSystems\PersonalShelter\TxVDrvSvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 14330 bytes
thank you
Ok, then we use this instead:
Please download OTViewIt (http://oldtimer.geekstogo.com/OTViewIt.exe) by OldTimer and save it to your Desktop.
Close all applications and windows.
Double-click on the OTViewIt.exeto start OTViewIt.
Place a checkmark in the blue-colored "Scan All Users" checkbox.
Click the blue Run Scan button.
OTViewIt will now start its scan.
When the scan is complete, two text files will be created, OTViewIt.Txt <- this one will be opened in Notepad and Extras.txt, on Desktop.
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of OTViewIt.Txt and the Extras.txt to your post.
constantine
2008-09-08, 16:23
OTviewIt.txt
OTViewIt logfile created on: 9/8/2008 10:18:09 PM - Run 1
OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Users\Honey_ko\Desktop
Windows Vista (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16711)
Locale: 00003409 | Country: フィリピン共和国 | Language: ENP | Date Format: M/d/yyyy
1021.81 Mb Total Physical Memory | 397.99 Mb Available Physical Memory | 38.95% Memory free
2.24 Gb Paging File | 1.17 Gb Available in Paging File | 52.14% Paging File free
Paging file location(s): ?:\pagefile.sys;
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 178.40 Gb Total Space | 85.24 Gb Free Space | 47.78% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 596.02 Gb Total Space | 261.21 Gb Free Space | 43.82% Space Free | Partition Type: FAT32
Computer Name: HONEY_KO-PC
Current User Name: Honey_ko
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On
===== Processes - Non-Microsoft Only =====
[08/18/2008 10:30 AM | 00,211,232 | ---- | M] () - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
[08/18/2008 06:41 PM | 01,832,272 | RHS- | M] (Safer Networking Limited) - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[05/24/2007 12:00 PM | 00,056,096 | ---- | M] (Texim Corporation.) - C:\Program Files\Justsystems\PersonalShelter\TxVDrvSvc.exe
[05/08/2007 01:29 PM | 00,128,592 | ---- | M] ( Yahoo Japan Corporation.) - C:\Program Files\Yahoo!\Companion\Installs\yphb.exe
===== Win32 Services - Non-Microsoft Only =====
(CertPropSvc) Certificate Propagation [Unknown | Stopped]
File not found - %SystemRoot%\system32\svchost.exe
(DcomLaunch) DCOM Server Process Launcher [Unknown | Running]
File not found - %SystemRoot%\system32\svchost.exe
(FLEXnet Licensing Service) FLEXnet Licensing Service [On_Demand | Stopped]
[08/04/2008 09:33 PM | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
(idsvc) Windows CardSpace [Unknown | Stopped]
File not found - %systemroot%\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
(McAfee SiteAdvisor Service) McAfee SiteAdvisor Service [Auto | Running]
[08/18/2008 10:30 AM | 00,211,232 | ---- | M] () - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(MSDTC) Distributed Transaction Coordinator [Unknown | Stopped]
[11/02/2006 10:04 PM | ---D | M] - C:\Windows\System32\Msdtc
(PACSPTISVR) PACSPTISVR [On_Demand | Stopped]
[12/14/2006 01:46 AM | 00,057,344 | ---- | M] () - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
(Schedule) Task Scheduler [Unknown | Running]
File not found - %SystemRoot%\System32\svchost.exe
(SCPolicySvc) Smart Card Removal Policy [Unknown | Stopped]
File not found - %SystemRoot%\system32\svchost.exe
(TrustedInstaller) Windows Modules Installer [Unknown | Stopped]
File not found - %SystemRoot%\servicing\TrustedInstaller.exe
(TxVDrvSvc) TXVDrv Service [Auto | Running]
[05/24/2007 12:00 PM | 00,056,096 | ---- | M] (Texim Corporation.) - C:\Program Files\Justsystems\PersonalShelter\TxVDrvSvc.exe
(WdiServiceHost) Diagnostic Service Host [Unknown | Stopped]
File not found - %SystemRoot%\System32\svchost.exe
(WdiSystemHost) Diagnostic System Host [Unknown | Running]
File not found - %SystemRoot%\System32\svchost.exe
===== Driver Services - Non-Microsoft Only =====
(adp94xx) adp94xx [Disabled | Stopped]
[11/02/2006 06:51 PM | 00,420,968 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\adp94xx.sys
(adpahci) adpahci [Disabled | Stopped]
[11/02/2006 06:51 PM | 00,297,576 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\adpahci.sys
(adpu160m) adpu160m [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,098,408 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\adpu160m.sys
(adpu320) adpu320 [Disabled | Stopped]
[11/02/2006 06:51 PM | 00,147,048 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\adpu320.sys
(aic78xx) aic78xx [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,071,272 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\djsvs.sys
(arc) arc [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,067,688 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\arc.sys
(arcsas) arcsas [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,067,688 | ---- | M] (Adaptec, Inc.) - C:\Windows\System32\drivers\arcsas.sys
(athr) Atheros Extensible Wireless LAN device driver [On_Demand | Stopped]
[06/15/2007 09:28 AM | 00,705,024 | ---- | M] (Atheros Communications, Inc.) - C:\Windows\System32\drivers\athr.sys
(blbdrive) blbdrive [Disabled | Stopped]
File not found - C:\Windows\system32\drivers\blbdrive.sys
(BrFiltLo) Brother USB Mass-Storage Lower Filter Driver [On_Demand | Stopped]
[11/02/2006 05:24 PM | 00,013,568 | ---- | M] (Brother Industries, Ltd.) - C:\Windows\System32\drivers\BrFiltLo.sys
(BrFiltUp) Brother USB Mass-Storage Upper Filter Driver [On_Demand | Stopped]
[11/02/2006 05:24 PM | 00,005,248 | ---- | M] (Brother Industries, Ltd.) - C:\Windows\System32\drivers\BrFiltUp.sys
(Brserid) Brother MFC Serial Port Interface Driver (WDM) [Disabled | Stopped]
[11/02/2006 05:25 PM | 00,071,808 | ---- | M] (Brother Industries Ltd.) - C:\Windows\System32\drivers\BrSerId.sys
(BrSerWdm) Brother WDM Serial driver [Disabled | Stopped]
[11/02/2006 05:24 PM | 00,062,336 | ---- | M] (Brother Industries Ltd.) - C:\Windows\System32\drivers\BrSerWdm.sys
(BrUsbMdm) Brother MFC USB Fax Only Modem [Disabled | Stopped]
[11/02/2006 05:24 PM | 00,012,160 | ---- | M] (Brother Industries Ltd.) - C:\Windows\System32\drivers\BrUsbMdm.sys
(BrUsbSer) Brother MFC USB Serial WDM Driver [On_Demand | Stopped]
[11/02/2006 05:24 PM | 00,011,904 | ---- | M] (Brother Industries Ltd.) - C:\Windows\System32\drivers\BrUsbSer.sys
(catchme) catchme [On_Demand | Stopped]
File not found - C:\ComboFix\catchme.sys
(CLFS) Common Log (CLFS) [Unknown | Running]
File not found -
(elxstor) elxstor [Disabled | Stopped]
[11/02/2006 06:51 PM | 00,316,520 | ---- | M] (Emulex) - C:\Windows\System32\drivers\elxstor.sys
(iirsp) iirsp [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) - C:\Windows\System32\drivers\iirsp.sys
(IpInIp) IP in IP Tunnel Driver [On_Demand | Stopped]
File not found - C:\Windows\System32\DRIVERS\ipinip.sys
(iteatapi) ITEATAPI_Service_Install [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) - C:\Windows\System32\drivers\iteatapi.sys
(iteraid) ITERAID_Service_Install [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) - C:\Windows\System32\drivers\iteraid.sys
(ntrigdigi) N-trig HID Tablet Driver [Disabled | Stopped]
[11/02/2006 04:36 PM | 00,020,608 | ---- | M] (N-trig Innovative Technologies) - C:\Windows\System32\drivers\ntrigdigi.sys
(NwlnkFlt) IPX Traffic Filter Driver [On_Demand | Stopped]
File not found - C:\Windows\System32\DRIVERS\nwlnkflt.sys
(NwlnkFwd) IPX Traffic Forwarder Driver [On_Demand | Stopped]
File not found - C:\Windows\System32\DRIVERS\nwlnkfwd.sys
(R5U870FLx86) R5U870 UVC Lower Filter [On_Demand | Running]
[06/28/2007 09:01 AM | 00,075,008 | ---- | M] (Ricoh) - C:\Windows\System32\drivers\R5U870FLx86.sys
(R5U870FUx86) R5U870 UVC Upper Filter [On_Demand | Running]
[06/28/2007 09:01 AM | 00,043,904 | ---- | M] (Ricoh) - C:\Windows\System32\drivers\R5U870FUx86.sys
(regi) regi [Auto | Running]
[04/17/2007 08:09 PM | 00,011,032 | ---- | M] (InterVideo) - C:\Windows\System32\drivers\regi.sys
(SiSRaid2) SiSRaid2 [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,038,504 | ---- | M] (Silicon Integrated Systems Corp.) - C:\Windows\System32\drivers\sisraid2.sys
(SiSRaid4) SiSRaid4 [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,071,784 | ---- | M] (Silicon Integrated Systems) - C:\Windows\System32\drivers\sisraid4.sys
(sptd) sptd [Boot | Running]
[03/08/2008 03:26 PM | 00,716,272 | ---- | M] () - C:\Windows\System32\drivers\sptd.sys
(tenCapture) tenCapture [On_Demand | Running]
[04/21/2007 11:15 PM | 00,009,344 | ---- | M] (Hajo Krabbenh鐪t) - C:\Windows\System32\drivers\tenCapture.sys
(ti21sony) ti21sony [On_Demand | Running]
[06/06/2007 09:00 AM | 00,812,544 | ---- | M] (Texas Instruments) - C:\Windows\System32\drivers\ti21sony.sys
(TxVDrv) TxVDrv [System | Running]
[05/24/2007 12:00 PM | 00,028,064 | ---- | M] (Texim Corporation) - C:\Windows\System32\drivers\TxVDrv.sys
(UIUSys) Conexant Setup API [Disabled | Stopped]
File not found - C:\Windows\System32\DRIVERS\UIUSYS.SYS
(uliahci) uliahci [Disabled | Stopped]
[11/02/2006 06:51 PM | 00,235,112 | ---- | M] (ULi Electronics Inc.) - C:\Windows\System32\drivers\uliahci.sys
(viaide) viaide [Disabled | Stopped]
[11/02/2006 06:49 PM | 00,017,512 | ---- | M] (VIA Technologies, Inc.) - C:\Windows\System32\drivers\viaide.sys
(vsmraid) vsmraid [Disabled | Stopped]
[11/02/2006 06:50 PM | 00,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) - C:\Windows\System32\drivers\vsmraid.sys
(yukonwlh) NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller [On_Demand | Running]
[05/19/2007 09:02 AM | 00,240,128 | ---- | M] (Marvell) - C:\Windows\System32\drivers\yk60x86.sys
========== Run Keys ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher" = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 10:16 PM | 00,039,792 | ---- | M] (Adobe Systems Incorporated)
"Apoint" = C:\Program Files\Apoint\Apoint.exe [06/10/2007 09:12 AM | 00,118,784 | ---- | M] (Alps Electric Co., Ltd.)
"E-Flyer" = "C:\Program Files\Sony\E-Flyer\SubFlyer.exe" [10/16/2006 03:06 PM | 00,456,824 | ---- | M] ()
"ISBMgr.exe" = "C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [06/11/2007 06:27 PM | 00,317,560 | ---- | M] (Sony Corporation)
"mcagent_exe" = C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey [11/01/2007 07:12 PM | 00,582,992 | ---- | M] (McAfee, Inc.)
"McENUI" = C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide [11/30/2007 05:42 AM | 01,164,576 | ---- | M] (McAfee, Inc.)
"NvCplDaemon" = RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup [06/28/2007 09:03 AM | 08,429,568 | ---- | M] (NVIDIA Corporation)
"NvMediaCenter" = RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit [06/28/2007 09:03 AM | 00,081,920 | ---- | M] (NVIDIA Corporation)
"NvSvc" = RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart [06/28/2007 09:04 AM | 00,086,016 | ---- | M] (NVIDIA Corporation)
"PrepareYourVAIO" = C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe [05/16/2007 04:28 PM | 00,477,304 | ---- | M] (Sony Corporation)
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [06/10/2008 04:27 AM | 00,144,784 | ---- | M] (Sun Microsystems, Inc.)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSServer" = rundll32.exe C:\Users\Honey_ko\AppData\Local\Temp\fccdawTn.dll,#1 File not found
"SpybotSD TeaTimer" = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [08/18/2008 06:41 PM | 01,832,272 | RHS- | M] (Safer Networking Limited)
"Yahoo! Pager" = "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet [08/30/2007 05:43 PM | 04,670,704 | ---- | M] (Yahoo! Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" =
"run" = Reg Error: Value run does not exist or could not be read.
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" =
"run" = Reg Error: Value run does not exist or could not be read.
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSServer" = rundll32.exe C:\Users\Honey_ko\AppData\Local\Temp\fccdawTn.dll,#1 File not found
"SpybotSD TeaTimer" = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [08/18/2008 06:41 PM | 01,832,272 | RHS- | M] (Safer Networking Limited)
"Yahoo! Pager" = "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet [08/30/2007 05:43 PM | 04,670,704 | ---- | M] (Yahoo! Inc.)
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"load" = Reg Error: Value load does not exist or could not be read.
"run" = Reg Error: Value run does not exist or could not be read.
========== Startup Folders ==========
========== BHO's ==========
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
HKLM CLSID: (&Yahoo! Toolbar Helper) - [12/19/2007 06:49 AM | 00,817,936 | ---- | M] (Yahoo! Inc.) C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
HKLM CLSID: (Adobe PDF Reader Link Helper) - [10/22/2006 11:08 PM | 00,062,080 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0DD41AE7-6196-42E7-BDE5-4F393997449E}]
HKLM CLSID: (かんたん登録2) - [05/24/2007 12:00 PM | 01,824,304 | ---- | M] (株式会社ジャストシステム) C:\Program Files\Justsystems\SimpleAutoInput\AtInBnd.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4}]
HKLM CLSID: (Yahoo!ツールバーフィッシング警告) - [05/14/2007 01:19 PM | 00,345,680 | ---- | M] (Yahoo Japan Corporation. ) C:\Program Files\Yahoo!\Companion\Installs\ypho.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}]
HKLM CLSID: (McAfee Phishing Filter) - [11/26/2007 10:46 AM | 00,324,936 | ---- | M] () c:\Program Files\McAfee\MSK\mcapbho.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}]
HKLM CLSID: (Megaupload Toolbar) - [08/01/2007 01:25 AM | 01,933,256 | ---- | M] (MEGAUPLOAD ) C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
HKLM CLSID: (Spybot-S&D IE Protection) - [07/07/2008 09:41 AM | 01,562,448 | ---- | M] (Safer Networking Limited) C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
HKLM CLSID: (Yahoo! IE Services Button) - [12/13/2007 07:09 AM | 00,222,448 | ---- | M] (Yahoo! Inc.) C:\Program Files\Yahoo!\Common\yiesrvc.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
HKLM CLSID: (SSVHelper Class) - [06/10/2008 04:27 AM | 00,509,328 | ---- | M] (Sun Microsystems, Inc.) C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
HKLM CLSID: (scriptproxy) - [11/09/2007 12:09 PM | 00,058,688 | ---- | M] (McAfee, Inc.) C:\Program Files\McAfee\VirusScan\scriptsn.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
HKLM CLSID: (Google Toolbar Helper) - [01/12/2008 10:33 PM | 02,403,392 | R--- | M] (Google Inc.) c:\Program Files\Google\GoogleToolbar1.dll
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
HKLM CLSID: (McAfee SiteAdvisor BHO) - [08/16/2008 10:19 AM | 00,121,120 | ---- | M] () c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll
========== Toolbars ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}"
HKLM CLSID: (McAfee SiteAdvisor Toolbar) - [08/16/2008 10:19 AM | 00,121,120 | ---- | M] () c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}"
HKLM CLSID: (&Google) - [01/12/2008 10:33 PM | 02,403,392 | R--- | M] (Google Inc.) c:\Program Files\Google\GoogleToolbar1.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"
HKLM CLSID: (Megaupload Toolbar) - [08/01/2007 01:25 AM | 01,933,256 | ---- | M] (MEGAUPLOAD ) C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{833CFE4E-05BD-43A3-97A7-A4E80D742F0F}"
HKLM CLSID: (かんたん登録2 ツールバー) - [05/24/2007 12:00 PM | 01,824,304 | ---- | M] (株式会社ジャストシステム) C:\Program Files\Justsystems\SimpleAutoInput\AtInBnd.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
HKLM CLSID: (Yahoo! 工具列) - [12/19/2007 06:49 AM | 00,817,936 | ---- | M] (Yahoo! Inc.) C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
HKLM CLSID: (&Google) - [01/12/2008 10:33 PM | 02,403,392 | R--- | M] (Google Inc.) c:\Program Files\Google\GoogleToolbar1.dll
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"
HKLM CLSID: (Megaupload Toolbar) - [08/01/2007 01:25 AM | 01,933,256 | ---- | M] (MEGAUPLOAD ) C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
HKLM CLSID: (Yahoo! 工具列) - [12/19/2007 06:49 AM | 00,817,936 | ---- | M] (Yahoo! Inc.) C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
HKLM CLSID: (&Google) - [01/12/2008 10:33 PM | 02,403,392 | R--- | M] (Google Inc.) c:\Program Files\Google\GoogleToolbar1.dll
"{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"
HKLM CLSID: (Megaupload Toolbar) - [08/01/2007 01:25 AM | 01,933,256 | ---- | M] (MEGAUPLOAD ) C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
HKLM CLSID: (Yahoo! 工具列) - [12/19/2007 06:49 AM | 00,817,936 | ---- | M] (Yahoo! Inc.) C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
========== AppInit_Dlls ==========
========== HKLM Security Providers ==========
========== HKLM Winlogon Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell]
= Explorer.exe
>Explorer.exe - [01/11/2008 11:23 PM | 02,923,520 | ---- | M] (Microsoft Corporation) C:\Windows\explorer.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit]
= C:\Windows\system32\userinit.exe,
>C:\Windows\system32\userinit.exe - [11/02/2006 06:45 PM | 00,024,576 | ---- | M] (Microsoft Corporation) C:\Windows\System32\userinit.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet]
= rundll32 shell32,Control_RunDLL "sysdm.cpl"
>rundll32 shell32 - [04/24/2008 01:51 PM | 11,315,712 | ---- | M] (Microsoft Corporation) C:\Windows\System32\shell32.dll
>Control_RunDLL "sysdm.cpl" - [11/02/2006 06:44 PM | 00,238,080 | ---- | M] (Microsoft Corporation) C:\Windows\System32\sysdm.cpl
========== User's Winlogon Settings ==========
========== Winlogon Notify Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VESWinlogon]
"DllName" = C:\Windows\System32\VESWinlogon.dll [04/25/2007 12:45 PM | 00,098,304 | ---- | M] (Sony Corporation)
========== Policies ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveAutoRun" = 67108863
"NoDriveTypeAutoRun" = 255
"NoDrives" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"ConsentPromptBehaviorAdmin" = 2
"ConsentPromptBehaviorUser" = 1
"EnableInstallerDetection" = 1
"EnableLUA" = 1
"EnableSecureUIAPaths" = 1
"EnableVirtualization" = 1
"PromptOnSecureDesktop" = 1
"ValidateAdminCodeSignatures" = 0
"dontdisplaylastusername" = 0
"legalnoticecaption" =
"legalnoticetext" =
"scforceoption" = 0
"shutdownwithoutlogon" = 1
"undockwithoutlogon" = 1
"FilterAdministratorToken" = 0
"DisableRegistryTools" = 0
"HideLegacyLogonScripts" = 0
"HideLogoffScripts" = 0
"RunLogonScriptSync" = 1
"RunStartupScriptSync" = 0
"HideStartupScripts" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats]
"CF_TEXT" = 1
"CF_BITMAP" = 2
"CF_OEMTEXT" = 7
"CF_DIB" = 8
"CF_PALETTE" = 9
"CF_UNICODETEXT" = 13
"CF_DIBV5" = 17
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun" = 145
"NoDrives" = 0
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"HideLegacyLogonScripts" = 0
"HideLogoffScripts" = 0
"RunLogonScriptSync" = 1
"RunStartupScriptSync" = 0
"HideStartupScripts" = 0
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
Unable to open key or key not present!
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
Unable to open key or key not present!
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
Unable to open key or key not present!
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
Unable to open key or key not present!
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun" = 145
"NoDrives" = 0
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run]
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"HideLegacyLogonScripts" = 0
"HideLogoffScripts" = 0
"RunLogonScriptSync" = 1
"RunStartupScriptSync" = 0
"HideStartupScripts" = 0
========== Lsa Authentication Packages ==========
========== Lsa Security Packages ==========
========== Desktop Components ==========
========== Safeboot Options ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]
"AlternateShell" = cmd.exe
========== Disabled MsConfig Items ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = iTunesHelper
"hkey" = HKLM
"command" = C:\Program Files\iTunes\iTunesHelper.exe [01/15/2008 03:22 AM | 00,267,048 | ---- | M] (Apple Inc.)
"inimapping" = 0
"YEAR" = 2008
"MONTH" = 8
"DAY" = 24
"HOUR" = 20
"MINUTE" = 30
"SECOND" = 43
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = QuickTime Task
"hkey" = HKLM
"command" = C:\Program Files\QuickTime\QTTask.exe [05/27/2008 10:50 AM | 00,413,696 | ---- | M] (Apple Inc.)
"inimapping" = 0
"YEAR" = 2008
"MONTH" = 8
"DAY" = 24
"HOUR" = 20
"MINUTE" = 30
"SECOND" = 43
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RegistryMechanic]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = RegistryMechanic
"hkey" = HKCU
"command" = C:\Program Files\Registry Mechanic\RMTray.exe [07/03/2008 10:37 AM | 00,812,952 | ---- | M] (PC Tools)
"inimapping" = 0
"YEAR" = 2008
"MONTH" = 8
"DAY" = 24
"HOUR" = 18
"MINUTE" = 44
"SECOND" = 45
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = TkBellExe
"hkey" = HKLM
"command" = C:\Program Files\Common Files\Real\Update_OB\realsched.exe [02/10/2008 10:44 PM | 00,185,896 | ---- | M] (RealNetworks, Inc.)
"inimapping" = 0
"YEAR" = 2008
"MONTH" = 8
"DAY" = 24
"HOUR" = 20
"MINUTE" = 30
"SECOND" = 43
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]
"key" = SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"item" = WinampAgent
"hkey" = HKLM
"command" = C:\Program Files\Winamp\winampa.exe [01/16/2008 07:54 AM | 00,037,376 | ---- | M] ()
"inimapping" = 0
"YEAR" = 2008
"MONTH" = 8
"DAY" = 24
"HOUR" = 20
"MINUTE" = 30
"SECOND" = 44
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]
"startup" = 2
"services" = 0
========== CDRom AutoRun Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1
========== Autorun Files on Drives ==========
autoexec.bat [REM Dummy file for NTVDM | ]
[09/19/2006 06:43 AM | 00,000,024 | ---- | M] () C:\autoexec.bat [ NTFS ]
========== MountPoints2 ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{08f53041-3aa2-11dd-96dc-001a804aae31}\Shell]
"" = None
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a64a3f03-23e4-11dd-9daf-001a804aae31}\Shell]
"" = None
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d4d228c7-6e9f-11dd-9b87-001a804aae31}\Shell]
"" = None
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dee97652-3f21-11dc-962a-001a8016a7a5}\Shell]
"" = None
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dee97658-3f21-11dc-962a-001a8016a7a5}\Shell]
"" = None
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\Shell]
========== DNS Name Servers ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{4587B32F-996C-4BC2-B4D0-47F69E87CAE7}]
Servers: | Description: Marvell Yukon 88E8036 PCI-E Fast Ethernet Controller
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{9288698F-A729-48D4-B407-1193A3ACC368}]
Servers: | Description: Intel(R) Wireless WiFi Link 4965AGN
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{FFE9EC16-2006-47A1-888A-DFCCEBA843A2}]
Servers: | Description:
========== Hosts File ==========
HOSTS File = (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
First 25 entries...
127.0.0.1 localhost
::1 localhost
========== Files/Folders - Created Within 30 days ==========
[08/20/2008 07:48 PM | ---D | C] - C:\file
[08/24/2008 07:38 PM | ---D | C] - C:\QooBox
[09/04/2008 09:21 PM | ---D | C] - C:\ComboFix
[09/08/2008 09:35 PM | ---D | C] - C:\rsit
[08/23/2008 01:10 AM | 00,773,120 | ---- | C] () - C:\Windows\System32\NEROINSTAEC43759.DB
[08/28/2008 08:16 PM | 00,143,360 | ---- | C] (Inner Media, Inc.) - C:\Windows\System32\dunzip32.dll
[08/28/2008 08:17 PM | 00,015,261 | ---- | C] () - C:\Windows\System32\Config.MPF
[09/07/2008 09:54 PM | 00,107,888 | ---- | C] (Sony DADC Austria AG.) - C:\Windows\System32\CmdLineExt.dll
[08/22/2008 06:56 PM | -H-D | C] - C:\Windows\PIF
[08/23/2008 01:09 AM | 00,000,000 | ---- | C] () - C:\Windows\Irremote.ini
[08/24/2008 06:44 PM | ---D | C] - C:\Windows\pss
[09/04/2008 09:21 PM | 00,028,672 | ---- | C] (NirSoft) - C:\Windows\Nircmd.exe
[09/04/2008 09:21 PM | 00,049,152 | ---- | C] () - C:\Windows\VFind.exe
[09/04/2008 09:21 PM | 00,068,096 | ---- | C] () - C:\Windows\zip.exe
[09/04/2008 09:21 PM | 00,080,412 | ---- | C] () - C:\Windows\grep.exe
[09/04/2008 09:21 PM | 00,089,504 | ---- | C] (Smallfrogs Studio) - C:\Windows\fdsv.exe
[09/04/2008 09:21 PM | 00,098,816 | ---- | C] () - C:\Windows\sed.exe
[09/04/2008 09:21 PM | 00,136,704 | ---- | C] (SteelWerX) - C:\Windows\swsc.exe
[09/04/2008 09:21 PM | 00,161,792 | ---- | C] (SteelWerX) - C:\Windows\swreg.exe
[09/04/2008 09:21 PM | 00,212,480 | ---- | C] (SteelWerX) - C:\Windows\swxcacls.exe
[09/07/2008 11:36 PM | 00,000,533 | ---- | C] () - C:\Windows\eReg.dat
[08/28/2008 08:14 PM | 00,000,338 | ---- | C] () - C:\Windows\tasks\McQcTask.job
[08/28/2008 08:14 PM | 00,000,346 | ---- | C] () - C:\Windows\tasks\McDefragTask.job
[08/16/2008 05:36 PM | ---D | C] - C:\ProgramData\Ubisoft
[08/16/2008 07:52 PM | ---D | C] - C:\ProgramData\Nero
[08/22/2008 12:10 AM | ---D | C] - C:\ProgramData\McAfee
[08/22/2008 12:22 AM | ---D | C] - C:\ProgramData\Avg8
[08/28/2008 08:17 PM | ---D | C] - C:\ProgramData\SiteAdvisor
[08/30/2008 07:44 PM | ---D | C] - C:\ProgramData\Azureus
[08/31/2008 03:03 PM | ---D | C] - C:\ProgramData\Spybot - Search & Destroy
[09/04/2008 07:17 PM | ---D | C] - C:\ProgramData\Malwarebytes
[08/09/2008 10:56 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\Camfrog
[08/10/2008 06:25 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\DivX
[08/16/2008 07:58 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\Nero
[08/18/2008 12:15 AM | 00,000,244 | ---- | C] () - C:\Users\Honey_ko\AppData\Roaming\default.pls
[08/22/2008 12:46 AM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\Justsystem
[08/23/2008 04:20 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\uTorrent
[08/30/2008 07:44 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\Azureus
[09/04/2008 07:17 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\Malwarebytes
[09/07/2008 09:46 PM | ---D | C] - C:\Users\Honey_ko\AppData\Roaming\gnupg
[09/07/2008 09:54 PM | RH-D | C] - C:\Users\Honey_ko\AppData\Roaming\SecuROM
[08/16/2008 08:04 PM | ---D | C] - C:\Users\Honey_ko\AppData\Local\Ahead
[08/16/2008 08:49 PM | ---D | C] - C:\Users\Honey_ko\AppData\Local\Nero
[09/05/2008 01:33 AM | 04,208,599 | -H-- | C] () - C:\Users\Honey_ko\AppData\Local\IconCache.db
[09/07/2008 04:13 AM | ---D | C] - C:\Users\Honey_ko\AppData\Local\My Games
[08/27/2008 12:44 AM | ---D | C] - C:\Users\Public\Documents\Battlefield 2
[08/24/2008 08:16 PM | 19,629,1774 | ---- | C] () - C:\Users\Honey_ko\Documents\Registry_Backup_824.reg
[08/24/2008 09:21 PM | ---D | C] - C:\Users\Honey_ko\Documents\Download
[08/30/2008 07:46 PM | ---D | C] - C:\Users\Honey_ko\Documents\Azureus Downloads
[09/07/2008 04:13 AM | ---D | C] - C:\Users\Honey_ko\Documents\My Games
[09/06/2008 10:23 PM | 00,001,117 | ---- | C] () - C:\Users\Public\Desktop\Launch Sid Meier's Civilization 4.lnk
[09/06/2008 10:46 PM | 00,001,105 | ---- | C] () - C:\Users\Public\Desktop\Launch Sid Meier's Civilization 4 - Warlords.lnk
[09/06/2008 11:17 PM | 00,002,288 | ---- | C] () - C:\Users\Public\Desktop\Sid Meier's Civilization 4 - Beyond the Sword.lnk
[08/14/2008 06:49 PM | 00,000,104 | ---- | C] () - C:\Users\Honey_ko\Desktop\recycle bin.lnk
[09/05/2008 01:27 AM | 00,001,874 | ---- | C] () - C:\Users\Honey_ko\Desktop\HijackThis.lnk
[09/06/2008 01:31 AM | 00,001,964 | ---- | C] () - C:\Users\Honey_ko\Desktop\Camfrog Video Chat 5.1.lnk
[09/08/2008 06:49 PM | 00,304,189 | ---- | C] () - C:\Users\Honey_ko\Desktop\RSIT.exe
[08/24/2008 06:48 PM | 00,000,769 | ---- | C] () - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
[08/16/2008 07:52 PM | ---D | C] - C:\Program Files\Common Files\Nero
[08/24/2008 02:39 PM | ---D | C] - C:\Program Files\Common Files\Wise Installation Wizard
[08/28/2008 08:14 PM | ---D | C] - C:\Program Files\Common Files\McAfee
[08/09/2008 10:56 PM | ---D | C] - C:\Program Files\Camfrog
[08/10/2008 01:59 AM | ---D | C] - C:\Program Files\Apple Software Update
[08/10/2008 02:02 AM | ---D | C] - C:\Program Files\QuickTime
[08/16/2008 07:52 PM | ---D | C] - C:\Program Files\Nero
[08/21/2008 09:16 PM | ---D | C] - C:\Program Files\Registry Mechanic
[08/21/2008 10:10 PM | ---D | C] - C:\Program Files\Fake Voice
[08/21/2008 10:12 PM | ---D | C] - C:\Program Files\Personal Voice Changer Driver
[08/26/2008 11:05 PM | ---D | C] - C:\Program Files\EA GAMES
[08/28/2008 08:14 PM | ---D | C] - C:\Program Files\McAfee.com
[08/28/2008 08:19 PM | ---D | C] - C:\Program Files\File Recover
[08/28/2008 09:45 PM | ---D | C] - C:\Program Files\Runtime Software
[08/31/2008 03:03 PM | ---D | C] - C:\Program Files\Spybot - Search & Destroy
[09/04/2008 07:17 PM | ---D | C] - C:\Program Files\Malwarebytes' Anti-Malware
[09/05/2008 01:27 AM | ---D | C] - C:\Program Files\Trend Micro
========== Files - Modified Within 30 days ==========
[08/22/2008 07:56 PM | 00,108,526 | ---- | M] () - C:\Windows\System32\perfc009.dat
[08/22/2008 07:56 PM | 00,108,526 | ---- | M] () - C:\Windows\System32\perfc011.dat
[08/22/2008 07:56 PM | 00,400,162 | ---- | M] () - C:\Windows\System32\perfh011.dat
[08/22/2008 07:56 PM | 00,617,648 | ---- | M] () - C:\Windows\System32\perfh009.dat
[08/22/2008 07:56 PM | 01,211,398 | ---- | M] () - C:\Windows\System32\PerfStringBackup.INI
[09/07/2008 09:54 PM | 00,107,888 | ---- | M] (Sony DADC Austria AG.) - C:\Windows\System32\CmdLineExt.dll
[09/08/2008 06:29 PM | 00,015,261 | ---- | M] () - C:\Windows\System32\Config.MPF
[09/08/2008 09:25 PM | 00,003,584 | -H-- | M] () - C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[09/08/2008 09:25 PM | 00,003,584 | -H-- | M] () - C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[08/23/2008 01:09 AM | 00,000,000 | ---- | M] () - C:\Windows\Irremote.ini
[08/24/2008 06:38 PM | 00,000,749 | RH-- | M] () - C:\Windows\WindowsShell.Manifest
[09/04/2008 09:29 PM | 00,000,215 | ---- | M] () - C:\Windows\system.ini
[09/07/2008 11:36 PM | 00,000,533 | ---- | M] () - C:\Windows\eReg.dat
[09/08/2008 01:28 AM | 00,000,012 | ---- | M] () - C:\Windows\bthservsdp.dat
[09/08/2008 06:25 PM | 00,067,584 | --S- | M] () - C:\Windows\bootstat.dat
[08/29/2008 12:55 AM | 00,000,346 | ---- | M] () - C:\Windows\tasks\McDefragTask.job
[09/01/2008 01:00 AM | 00,000,338 | ---- | M] () - C:\Windows\tasks\McQcTask.job
[09/08/2008 06:25 PM | 00,000,006 | -H-- | M] () - C:\Windows\tasks\SA.DAT
[08/18/2008 12:15 AM | 00,000,244 | ---- | M] () - C:\Users\Honey_ko\AppData\Roaming\default.pls
[09/07/2008 06:05 PM | 00,063,556 | ---- | M] () - C:\Users\Honey_ko\AppData\Roaming\nvModes.dat
[09/08/2008 09:26 PM | 00,063,556 | ---- | M] () - C:\Users\Honey_ko\AppData\Roaming\nvModes.001
[08/31/2008 10:16 PM | 00,023,040 | ---- | M] () - C:\Users\Honey_ko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[09/03/2008 12:03 AM | 00,002,032 | ---- | M] () - C:\Users\Honey_ko\AppData\Local\d3d9caps.dat
[09/08/2008 01:27 AM | 04,208,599 | -H-- | M] () - C:\Users\Honey_ko\AppData\Local\IconCache.db
[08/24/2008 06:38 PM | 00,000,280 | -HS- | M] () - C:\Users\Public\Documents\desktop.ini
[08/24/2008 09:23 PM | 19,629,1774 | ---- | M] () - C:\Users\Honey_ko\Documents\Registry_Backup_824.reg
[08/24/2008 06:38 PM | 00,000,174 | -HS- | M] () - C:\Users\Public\Desktop\desktop.ini
[09/06/2008 10:57 PM | 00,001,117 | ---- | M] () - C:\Users\Public\Desktop\Launch Sid Meier's Civilization 4.lnk
[09/06/2008 11:01 PM | 00,001,105 | ---- | M] () - C:\Users\Public\Desktop\Launch Sid Meier's Civilization 4 - Warlords.lnk
[09/06/2008 11:17 PM | 00,002,288 | ---- | M] () - C:\Users\Public\Desktop\Sid Meier's Civilization 4 - Beyond the Sword.lnk
[08/22/2008 01:34 AM | 00,000,104 | ---- | M] () - C:\Users\Honey_ko\Desktop\recycle bin.lnk
[09/05/2008 01:28 AM | 00,001,874 | ---- | M] () - C:\Users\Honey_ko\Desktop\HijackThis.lnk
[09/06/2008 01:31 AM | 00,001,964 | ---- | M] () - C:\Users\Honey_ko\Desktop\Camfrog Video Chat 5.1.lnk
[09/08/2008 09:43 PM | 00,304,189 | ---- | M] () - C:\Users\Honey_ko\Desktop\RSIT.exe
[08/24/2008 06:38 PM | 00,000,174 | -HS- | M] () - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
< End of report >
constantine
2008-09-08, 16:25
Extras.txt
OTViewIt Extras logfile created on: 9/8/2008 10:18:09 PM - Run 1
OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Users\Honey_ko\Desktop
Windows Vista (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16711)
Locale: 00003409 | Country: フィリピン共和国 | Language: ENP | Date Format: M/d/yyyy
1021.81 Mb Total Physical Memory | 397.99 Mb Available Physical Memory | 38.95% Memory free
2.24 Gb Paging File | 1.17 Gb Available in Paging File | 52.14% Paging File free
Paging file location(s): ?:\pagefile.sys;
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 178.40 Gb Total Space | 85.24 Gb Free Space | 47.78% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
Drive I: | 596.02 Gb Total Space | 261.21 Gb Free Space | 43.82% Space Free | Partition Type: FAT32
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
Unable to open key or key not present!
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
File not found
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] - "%1" %*
.cmd [@ = cmdfile] - "%1" %*
.com [@ = ComFile] - "%1" %*
.exe [@ = exefile] - "%1" %*
.pif [@ = piffile] - "%1" %*
.scr [@ = scrfile] - "%1" /S
========== Winsock2 Catalogs ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\]
NameSpace_Catalog5\Catalog_Entries\000000000007 [mdnsNSP] - [07/24/2007 03:17 PM | 00,147,456 | ---- | M] (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll
Protocol_Catalog9\Catalog_Entries\000000000001 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000002 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000003 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000004 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000005 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000006 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000007 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000008 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000009 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000010 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000011 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000012 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000013 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000014 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000015 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000016 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000017 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000018 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000019 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000020 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000021 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000022 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000023 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000024 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000025 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000026 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000027 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000028 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000029 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000030 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000031 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000032 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000033 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
Protocol_Catalog9\Catalog_Entries\000000000034 - [12/08/2006 12:22 PM | 00,366,160 | ---- | M] (デジタルアーツ株式会社) C:\Windows\System32\iflsp.dll
========== HKEY_LOCAL_MACHINE Protocol Defaults ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - Default Protocols
ldap - 4 = Restricted sites (Not a Default Protocol)
news - 4 = Restricted sites (Not a Default Protocol)
nntp - 4 = Restricted sites (Not a Default Protocol)
oecmd - 4 = Restricted sites (Not a Default Protocol)
snews - 4 = Restricted sites (Not a Default Protocol)
========== HKEY_CURRENT_USER Protocol Defaults ==========
========== HKEY_USERS Protocol Defaults ==========
========== HKEY_USERS Protocol Defaults ==========
========== HKEY_USERS Protocol Defaults ==========
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults] - Default Protocols
@ivt - @ivt protocol not assigned
file - file protocol not assigned
ftp - ftp protocol not assigned
http - http protocol not assigned
https - https protocol not assigned
shell - shell protocol not assigned
========== HKEY_USERS Protocol Defaults ==========
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults] - Default Protocols
@ivt - @ivt protocol not assigned
file - file protocol not assigned
ftp - ftp protocol not assigned
http - http protocol not assigned
https - https protocol not assigned
shell - shell protocol not assigned
========== HKEY_USERS Protocol Defaults ==========
========== Protocol Handlers ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\]
sacore:{5513F07E-936B-4E52-9B00-067394E91CC5} [HKLM - McAfee SACore Protocol Handler]
[08/16/2008 10:19 AM | 00,121,120 | ---- | M] () c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll
skype4com:{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} [HKLM - IEProtocolHandler Class]
[05/09/2007 09:44 AM | 01,828,440 | R--- | M] (Skype Technologies) C:\Program Files\Common Files\Skype\Skype4COM.dll
========== Protocol Filters ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{009E7FB7-1775-4D89-8956-F5C9A1C019FC}" = DSD Playback Plug-in
"{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}" = Sony Video Shared Library
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{0312BD0D-A1FE-4E1A-9208-D436F566D867}" = VAIO Azure Float Wallpaper
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.1203
"{0405E51E-9582-4207-8F38-AC44201D3808}" = VeohTV BETA
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{05FBEE3C-CFAA-47D2-96C4-866201D34C03}" = ATLAS 翻訳パーソナル 2007 LE
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0AAE6279-45D3-4E87-A8C5-0E6F29BC2C32}" = VAIO Content Importer VAIO Content Exporter
"{0B59411E-1900-463C-AE64-AA106BB2BD58}" = えいご漬け 改訂版（体験版）
"{0B8B8160-11F9-4175-A4A4-DCAE95941727}" = 筆ぐるめ Ver.14
"{0C082BF0-39C5-4C0F-8BEF-D91F7411B11E}" =
"{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}" = Security Update for CAPICOM (KB931906)
"{11ECD186-E01F-4464-B685-8EC3AB8CD07C}" = AI将棋 Version 14 体験版
"{120B7381-2F44-4F7D-B86E-A70FE8904E3C}" = Yahoo!ウィジェットエンジン
"{156E4680-CA1F-4D45-AE9F-D6731E37C175}" = FeliCa Port Software
"{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}" = VAIO Launcher
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD BD for VAIO
"{2063C2E8-3812-4BBD-9998-6610F80C1DD4}" = VAIO Media AC3 Decoder 1.0
"{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}" = Rhapsody Player Engine
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23377817-F262-429B-BACD-11C6C60F89E7}" = 乗換案内VER.5
"{235915A8-1C0D-4920-95EA-FE8B773E5F57}" = VAIO Teal Whisper Wallpaper
"{23825B69-36DF-4DAD-9CFD-118D11D80F16}" = VAIO Content Folder Setting
"{29262C96-A8B9-467B-ADA9-592974677D6E}" = VAIO Content Metadata XML Interface Library
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}" = Wireless Switch Setting Utility
"{2A2FF7F5-6F0E-4A5D-A881-39365E718BD6}" = VAIO Cozy Orange Wallpaper
"{304880B2-B3C2-4C61-8618-D04D96BEDF68}" = VAIO Tender Yellow Wallpaper
"{3248F0A8-6813-11D6-A77B-00B0D0150030}" = J2SE Runtime Environment 5.0 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{326DC400-1FC4-4D7D-946D-06D1EAB93200}" = VAIOナビ
"{32E4F0D2-C135-475E-A841-1D59A0D22989}" = Sid Meier's Civilization 4 - Beyond the Sword
"{359DF682-BC8F-429D-AB6D-3C8002099F38}" = VAIO Content Metadata Intelligent Analyzing Manager
"{37477865-A3F1-4772-AD43-AAFC6BCFF99F}" = MSXML 4.0 SP2 (KB927978)
"{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}" = Skype Plugin Manager
"{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}" = Adobe Photoshop CS3
"{3E4B349F-10B5-4586-9D99-489A90A8B228}" = Sid Meier's Civilization 4 - Warlords
"{3FD0FED4-77D7-4CBD-98E1-0061B17C29E5}" = BIGLOBEで光ブロードバンド
"{42359172-BE45-4F95-BBD7-3796FDCE1208}" =
"{4377F918-E6C9-4ECA-A7F5-754B310B7ED8}" = Sid Meier's Civilization 4
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{48820099-ED7D-424B-890C-9A82EF00656D}" = VAIO Update 3
"{48D2C608-6E46-4978-A2D4-67E34F95E971}" = かんたん登録2
"{4EA55D20-27FB-45D7-8726-147E8A5F6C62}" = VAIO MusicBox
"{500162A0-4DD5-460A-BAFD-895AAE48C532}" = VAIO Media Content Collection 6.0
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{533D0A8A-D7E7-4F15-BC9E-FF2916A6BAA7}" = DSD Direct Player
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{560F6B2E-F0DF-44E5-8190-A4A161F0E205}" = VAIO Media 6.1
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}" = VAIO Media (再配布) 6.0
"{5A7D4B48-6D72-435D-8C19-96E998FF953B}" = ホットスポット キャンペーンツール
"{5BEB5AA0-7B78-4D85-8D98-F84CA1E063E9}" = かざポン for VAIO
"{5E862EC5-40B2-4A7E-A87D-B504E141318A}" = スクリーンセーバーロック2
"{6332AFF1-9D9A-429C-AA03-F82749FA4F49}" = SonicStage Mastering Studio
"{63BE6BE8-C96D-4CCD-B6E3-416FEC883D59}" = i-フィルター 4
"{6846389C-BAC0-4374-808E-B120F86AF5D7}" = Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
"{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}" = VAIO Content Importer / VAIO Content Exporter
"{69333A04-5134-40A5-A055-9166A7AA1EC8}" =
"{69351E9E-23ED-41D5-B146-EDBF83C63B66}" = VAIO Content Metadata Manager Setting
"{69E7A57D-89ED-4C16-A37C-AA53EF059F9A}" = かざしてログオン
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B1F20F2-6321-4669-A58C-33DF8E7517FF}" = VAIO Entertainment Platform
"{6D2576EC-A0E9-418A-A09A-409933A3B6F4}" = VAIO Camera Capture Utility
"{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}" = VAIO Movie Story Template Data
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = バイオの設定
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{785EB1D4-ECEC-4195-99B4-73C47E187721}" = VAIO Media Integrated Server 6.1
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{802889F8-6AF5-45A5-9764-CA5B999E50FC}" = VAIO Power Management
"{802AE695-3C5A-48A2-99B4-066298E659A8}" = Smart Network
"{82D5BACA-3619-4D34-99DB-3A65CFB4DA33}" = DSD Direct
"{86579038-5AD4-4399-A34C-C6E2E57539E9}" = 大富豪Plus5 体験版
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A0401AB-20DB-4A74-BD56-EAFC643CD660}" =
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DF01556-CD47-418B-88AA-CBCADA8A8D6F}" = ドラネットキッズ入学準備 体験版
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8FC56444-161D-43B4-A662-F18F2E4A2A32}" = VAIO Content Metadata Manager Setting
"{90120000-0016-0411-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Japanese) 2007
"{90120000-0016-0411-0000-0000000FF1CE}_PERSONALR_{A8A812AE-3CBE-47AA-B910-5F0230CCF993}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0411-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Japanese) 2007
"{90120000-001A-0411-0000-0000000FF1CE}_PERSONALR_{A8A812AE-3CBE-47AA-B910-5F0230CCF993}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0411-0000-0000000FF1CE}" = Microsoft Office Word MUI (Japanese) 2007
"{90120000-001B-0411-0000-0000000FF1CE}_PERSONALR_{A8A812AE-3CBE-47AA-B910-5F0230CCF993}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PERSONALR_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0411-0000-0000000FF1CE}" = Microsoft Office Proof (Japanese) 2007
"{90120000-001F-0411-0000-0000000FF1CE}_PERSONALR_{EA692029-ACE6-48E9-9FDE-A190C874EBE1}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0028-0411-0000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2007
"{90120000-0028-0411-0000-0000000FF1CE}_PERSONALR_{00027B64-55FE-4FAF-9E2B-BB6EF3DB7B8F}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0411-0000-0000000FF1CE}" = Microsoft Office Proofing (Japanese) 2007
"{90120000-006E-0411-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Japanese) 2007
"{90120000-006E-0411-0000-0000000FF1CE}_PERSONALR_{2D70F4C9-F740-482A-B13E-1ACE06862FCD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-0033-0000-0000-0000000FF1CE}" = Microsoft Office Personal 2007
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{1AFF2298-CC00-4A3B-866A-C62B8373794E}" = Security Update for 2007 Microsoft Office System (KB951596)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{4AD3A076-427C-491F-A5B7-7D1DE788A756}" = Update for Microsoft Office Outlook 2007 (KB952142)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{6BAD036C-261F-4BEF-96CF-C20678D07A41}" = Security Update for Visio 2007 (KB947590)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{7399DD71-8E24-4E60-B6A8-6CED89C0AC26}" = Security Update for Microsoft Office Excel 2007 (KB951546)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{A420F522-7395-4872-9882-C591B4B92278}" = Update for Office 2007 (KB946691)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{AD72BABE-C733-4FCF-9674-4314466191B9}" = Security Update for Microsoft Office Word 2007 (KB950113)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-0033-0000-0000-0000000FF1CE}_PERSONALR_{D9806966-6AA1-4B55-9528-6748E37CEE86}" = Update for Outlook 2007 Junk Email Filter (kb955433)
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{961B89D8-D2AA-4A5F-935D-B43159AF6DA6}" = VAIO オンラインカスタマー登録
"{97BCD719-6ECB-458F-97D6-F38D2E07375E}" = VAIO Aqua Breeze Wallpaper
"{97D86AAF-0473-4457-A35F-066C84E83CB0}" = e-Sword
"{98FC7A64-774B-49B5-B046-4B4EBC053FA9}" = VAIO MusicBox Sample Music
"{9AB83A3C-604D-4B4F-AA25-A23A3FC39844}" = ArcSoft Magic-i Visual Effects Installer
"{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}" = SonicStage Mastering Studio Plugins
"{9C665D73-1F28-470A-AB62-5A45B8B4172C}" = 時事通信社 医学・健康コンテンツ
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9E407618-D9CD-4F39-9490-9ED45294073D}" = Click to DVD 2.0.05 Menu Data
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A4D784B7-2F15-4506-A5DF-F903E84BDD09}" = ホットスポット 自動設定ツール
"{A5F3B2A6-CB42-11D6-9161-00E02975BB40}" = 一太郎ﾋﾞｭｰｱ
"{A63E7492-A0BC-4BB9-89A7-352965222380}" = VAIO Original Function Setting
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = Setting Utility Series
"{A90C03D6-08E1-4C59-B93B-6919A6C0AC19}" = TSP_CODEC
"{A991D480-1349-4FDD-983C-19241910A9E1}" = Microsoft Office ナビ 2007
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1041-7B44-A81200000003}" = Adobe Reader 8.1.2 - Japanese
"{AC76BA86-7AD7-1041-7B44-A81200000003}_Adobe Reader 8.1.2 - Japanese" = Adobe Reader 8.1.2 Security Update 1 (KB403742)
"{AD650226-3335-45BB-9640-D8C973366A1A}" = パーソナルシェルター
"{ADAB8F0D-D35B-4792-80A0-EF8749D8CF74}" = VAIO Guide Movie Components
"{AE4870C0-B7B7-404C-98B4-FE581CAC3BC0}" = AI囲碁 Version 15 体験版
"{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}" = VAIO Media Registration Tool 6.1
"{AFB6AFBA-88B1-48A7-AF52-BA59BA5F183B}" = Image Converter 3
"{AFBA0609-EB70-43CB-B11C-294EDADFA101}" =
"{B06FE058-3C46-40D1-9298-E43CB6CA35C9}" = Click to DVD Menu Data 1.0 for BD
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}" = VAIO Movie Story
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B59B3DA8-06F8-4B4C-AE94-5180753EF108}" = VAIO Floral Dusk Wallpaper
"{B5E2DF30-1061-4DB4-AF28-08996C8E5680}" = VAIO Content Metadata XML Interface Library
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Easy Media Creator Home
"{B85C4D19-6CEB-48CF-BD98-C887AC8C6F94}" = iTunes
"{B8C8E26C-D3DD-4B5B-A4A5-2BD5922C5169}" = バイオ電子マニュアル
"{B971BB45-3FEC-4464-BF4F-B3203EC17BE2}" = タイピング競馬 体験版
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BA3DEA87-8E99-4CD4-8FEA-D31B86635D4F}" = AI麻雀 Version 9 体験版
"{C04E32E0-0416-434D-AFB9-6969D703A9EF}" = MSXML 4.0 SP2 (KB936181)
"{C121D295-D9C5-4002-A970-4479D5850818}" = AQUAZONE OpenWater 体験版
"{C1EF6A20-86EF-4709-A660-5EB9E51BF0A0}" = VAIO Media Registration Tool
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C523D256-313D-4866-B36A-F3DE528246EF}" = MSXML 4.0 SP2 (KB941833)
"{C99E6F22-FD0E-4D6E-925A-268AD1C050D6}" = its-moNavi PC
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D30F9503-071B-4354-827D-C72D8E75BB05}" = Edy Viewer
"{D3B16DA0-1E93-11D5-A26F-009027CB933C}" = So-netサービス紹介
"{D8AB8F0C-CEEB-4A29-8EF5-219B064813F4}" = Apple Mobile Device Support
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DDCA9C0A-55CE-4CBB-A1B8-16A98AC3268F}" = ホットスポット ユーティリティツール
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}" = SonicStage Mastering Studio オーディオフィルタ機能
"{E58AB36F-9D50-4969-9228-AC24270741BF}" = VAIO Content Metadata Intelligent Analyzing Manager
"{E5E329DF-6C0D-4B6C-8D96-AF0B3F2A40DA}" = バイオ電子マニュアル データベース
"{E66BB7B9-EC7B-45A6-B479-AD43A9B32AA0}" = SonicStage Mastering Studio
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E6AD2F37-3B4A-4EEC-ACDB-28BC08A81648}" = ドラネット小学一年生 体験版
"{E809063C-51A3-4269-8984-D1EB742F2151}" = Click to DVD BD 3.0.23
"{EB697C8C-5D58-4858-B0F2-B11E00355E5F}" = VAIO Media Registration Tool
"{EBE55E74-AF94-47BB-849B-C79F236C65F4}" = VAIO Movie Story
"{EC37A846-53AC-4DA7-98FA-76A4E74AA900}" = SonicStage Mastering Studio オーディオフィルタ機能 カスタムプリセット
"{ED46C765-9EB0-4D4A-AD6C-29CF7E8007B0}" = SFCard Viewer 2
"{EFF25239-571D-44EC-B811-7A4CCBBB05B3}" = VAIO データリストアツール
"{F0BA88CC-16A7-4C89-8276-437E8F01F476}" = VAIO Media
"{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}" = VAIO Event Service
"{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager
"{F270F1FB-9FD9-4A50-B9D8-9503D76A41F1}" = VAIO infoboard
"{F41C96F8-3D72-4F94-9E9E-0B4E8F2B0C61}" = かざそうFeliCa
"{F570A6CC-53ED-4AA9-8B08-551CD3E38D8B}" =
"{F7115A55-F470-4169-A728-88CAF7928615}" = VAIO Update Extension
"{FAA6B94E-78A7-489C-B2DB-050D9FEBFADA}" = VAIO Content Metadata Intelligent Analyzing Manager
"{FD836E74-7923-4174-A055-F97CD0F3BB46}" =
"{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}" = Adobe Setup
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Adobe_719d6f144d0c086a0dfa7ff76bb9ac1" = Adobe Photoshop CS3
"Camfrog 5.1" = Camfrog Video Chat 5.1
"Chikka Messenger V4" = Chikka Messenger V4
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_104D0200" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"HijackThis" = HijackThis 2.0.2
"Imikimi Plugin" = Imikimi Plugin
"InstallShield_{0405E51E-9582-4207-8F38-AC44201D3808}" = VeohTV BETA
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD BD for VAIO
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"KB931906" = Security Update for CAPICOM (KB931906)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MegauploadToolbar" = Megaupload Toolbar
"Microsoft Office Navi 2007 12.0.2213.0" = Microsoft Office ナビ 2007
"Mozilla Firefox (2.0.0.16)" = Mozilla Firefox (2.0.0.16)
"MSC" = McAfee SecurityCenter
"NFRMPCViewer_is1" = NFRMプレーヤ NFRMPCViewer 1.1.0
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-15-19-01
"PERSONALR" = Microsoft Office Personal 2007
"Picasa2" = Picasa 2
"PolderbitSRecorder" = PolderbitS Sound Recorder and Editor
"RealPlayer 6.0" = RealPlayer
"Registry Mechanic_is1" = Registry Mechanic 8.0
"Skype_is1" = Skype 3.2
"Total Video Converter 3.11_is1" = Total Video Converter 3.11
"VLC media player" = VideoLAN VLC media player 0.8.6d
"Winamp" = Winamp
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! 工具列
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"YInstHelper" = Yahoo! Install Manager
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
========== HKEY_USERS Uninstall List ==========
========== HKEY_USERS Uninstall List ==========
========== HKEY_USERS Uninstall List ==========
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-766686520-3888453914-2297560788-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 9/7/2008 12:53:19 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = VSS
Description =
Error - 9/7/2008 12:54:12 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = System Restore
Description =
Error - 9/7/2008 2:27:41 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = VSS
Description =
Error - 9/7/2008 2:37:21 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Application Error
Description = ????????????????? BF1942.exe?????? 0.0.0.0???? ???? 0x400fa74a???????????????
BFCPRT.dll?????? 6.0.6000.16386???? ???? 0x4549bdc9?????? 0xc0000135???????? 0x00008fc7?
????
ID 0x908?????????????? 0x01c910f738f78d60?
Error - 9/7/2008 2:37:42 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Application Error
Description = ????????????????? BF1942.exe?????? 0.0.0.0???? ???? 0x400fa74a???????????????
BFCPRT.dll?????? 6.0.6000.16386???? ???? 0x4549bdc9?????? 0xc0000135???????? 0x00008fc7?
????
ID 0x1f50?????????????? 0x01c910f74635b830?
Error - 9/7/2008 2:44:28 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = VSS
Description =
Error - 9/8/2008 9:26:46 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = WerSvc
Description =
Error - 9/8/2008 9:39:15 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = VSS
Description =
Error - 9/8/2008 9:54:51 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = VSS
Description =
Error - 9/8/2008 9:57:33 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = VSS
Description =
[ DFS Replication Events ]
[ HardwareEvents Events ]
[ Internet Explorer Events ]
[ Key Management Service Events ]
[ Media Center Events ]
[ ODiag Events ]
[ OSession Events ]
Error - 8/11/2008 2:02:25 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 94
seconds with 60 seconds of active time. This session ended with a crash.
Error - 8/11/2008 2:03:45 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6300.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 73
seconds with 60 seconds of active time. This session ended with a crash.
Error - 8/20/2008 11:05:14 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 23
seconds with 0 seconds of active time. This session ended with a crash.
Error - 8/20/2008 11:05:49 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 3
seconds with 0 seconds of active time. This session ended with a crash.
Error - 8/21/2008 2:41:15 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 132
seconds with 0 seconds of active time. This session ended with a crash.
Error - 8/24/2008 11:19:55 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 11
seconds with 0 seconds of active time. This session ended with a crash.
Error - 8/30/2008 4:31:18 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 20
seconds with 0 seconds of active time. This session ended with a crash.
Error - 8/30/2008 4:31:47 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.
Error - 8/30/2008 4:39:27 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2
seconds with 0 seconds of active time. This session ended with a crash.
Error - 9/5/2008 11:20:29 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Microsoft Office 12 Sessions
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6323.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 22
seconds with 0 seconds of active time. This session ended with a crash.
[ Security Events ]
[ System Events ]
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:14:40 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/4/2008 12:17:34 PM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = DCOM
Description =
Error - 9/5/2008 9:20:43 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
Error - 9/5/2008 9:21:08 AM - Computer Name = Honey_ko-PC - User Name = User SID not found - Source = Service Control Manager
Description =
< End of report >
We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
Please download the OTMoveIt2 by OldTimer (http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe).
Save it to your desktop.
Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
C:\ProgramData\Azureus
C:\Users\Honey_ko\AppData\Roaming\uTorrent
C:\Users\Honey_ko\AppData\Roaming\Azureus
C:\Users\Honey_ko\Documents\Azureus Downloads
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer
Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
constantine
2008-09-08, 18:07
here it is
C:\ProgramData\Azureus moved successfully.
C:\Users\Honey_ko\AppData\Roaming\uTorrent moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\torrents moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\tmp moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\shares moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\plugins moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\net moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\media\azpd moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\media moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\logs moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\dht\net3 moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\dht moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus\active moved successfully.
C:\Users\Honey_ko\AppData\Roaming\Azureus moved successfully.
C:\Users\Honey_ko\Documents\Azureus Downloads moved successfully.
< HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\MSServer deleted successfully.
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09092008_000601
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.
constantine
2008-09-08, 18:15
ill do it first thing tommorow when i get back from work..
its kinda late here...:oops:
thank you so much:):):)
No problem, take your time :)
constantine
2008-09-09, 15:42
i had to stop sa scan process cuz i forgot the external hard drive to unplug while scanning my computer.i had to stop cuz it will take forever if i dont.it has 300gb of file in it.:eek::eek::eek:
the threat it found came from my old files.i wonder why my antivirus didnt see that.
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, September 9, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, September 09, 2008 07:51:38
Records in database: 1203063
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
I:\
Scan statistics:
Files scanned: 176584
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 02:44:59
File name / Threat name / Threats count
C:\Users\Honey_ko\Downloads\ipod\LimeWire galing\TOTALLY HIP TRACK.wma Infected: Trojan-Downloader.WMA.Wimad.k 1
C:\Users\Honey_ko\Downloads\ipod\LimeWire galing\Wicked Remix (douche).wma Infected: Trojan-Downloader.WMA.Wimad.k 1
The scan was stopped by the user.
heres the new HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:41:38 PM, on 9/9/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\yphb.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ??????2 - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O2 - BHO: Yahoo!????????????? - {1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4} - C:\Program Files\Yahoo!\Companion\Installs\ypho.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: ??????2 ????? - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IME JPN 2007 Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEJP\IMJPKLMG.EXE /Preload
O4 - HKLM\..\Run: [E-Flyer] "C:\Program Files\Sony\E-Flyer\SubFlyer.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun ? Java ????? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219940906756&h=5d5553eda8f27f70a72a7a2ca205363e/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Smart Network Service (BeService) - Sony Corporation - C:\Program Files\Sony\Smart Network\BeService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\Image Converter 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: TXVDrv Service (TxVDrvSvc) - Texim Corporation. - C:\Program Files\JustSystems\PersonalShelter\TxVDrvSvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 14025 bytes
i did start a new scan with kaspersky this time without the external hard drive will post it when its done.
OK, I'll be waiting for that scan report :)
constantine
2008-09-09, 18:10
finally here it is
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, September 10, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, September 09, 2008 07:51:38
Records in database: 1203063
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
Scan statistics:
Files scanned: 176594
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 02:32:38
File name / Threat name / Threats count
C:\Users\Honey_ko\Downloads\ipod\LimeWire galing\TOTALLY HIP TRACK.wma Infected: Trojan-Downloader.WMA.Wimad.k 1
C:\Users\Honey_ko\Downloads\ipod\LimeWire galing\Wicked Remix (douche).wma Infected: Trojan-Downloader.WMA.Wimad.k 1
The selected area was scanned.
and HJT log again
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:50 AM, on 9/10/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\yphb.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ??????2 - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O2 - BHO: Yahoo!????????????? - {1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4} - C:\Program Files\Yahoo!\Companion\Installs\ypho.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: ??????2 ????? - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IME JPN 2007 Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEJP\IMJPKLMG.EXE /Preload
O4 - HKLM\..\Run: [E-Flyer] "C:\Program Files\Sony\E-Flyer\SubFlyer.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun ? Java ????? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219940906756&h=5d5553eda8f27f70a72a7a2ca205363e/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Smart Network Service (BeService) - Sony Corporation - C:\Program Files\Sony\Smart Network\BeService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\Image Converter 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: TXVDrv Service (TxVDrvSvc) - Texim Corporation. - C:\Program Files\JustSystems\PersonalShelter\TxVDrvSvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 14027 bytes
Delete this folder:
C:\Users\Honey_ko\Downloads\ipod\LimeWire galing
Empty Recycle Bin.
Still problems?
constantine
2008-09-09, 19:00
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:50 AM, on 9/10/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\yphb.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
i got 3 rundll32.exe running processes in task manager
as far as i remember before getting infected it has none
2 of it has a path windows/system32
and the other dont have
any idea why is that
and before the first time i run malwarebytes those rundll32.exe also runs under the directory of my video driver.all in all before i has 6 rundll32.exe running and now 3 of those are still running
any solutions to that???
Reason is here:
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
For each one of those there is a need for rundll32.exe process.
So that is not dangerous but normal :)
constantine
2008-09-09, 19:51
ahhhhh now i know why....:):):)
so am i clean now????
what else should i do???
and maybe tommorow ill post a topic bout my moms computer
i run spybot and found 48 problems most of it are highjacker keylogger and virtumunde
would you mind helping me with that????
Yes :)
You can start a new thread for that, please.
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Next we remove all used tools.
Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Disable and Enable System Restore. - If you are using Windows Vista then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re-enable system restore here:
Windows Vista System Restore Guide (http://www.bleepingcomputer.com/tutorials/tutorial143.html)
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://forums.spybot.info/showthread.php?t=279)
Happy surfing and stay clean! :bigthumb:
constantine
2008-09-09, 20:06
thank you so much:):police::)
the only problem now is the system restore and internet explorer
i kinda have a japanese os and am not japanese :laugh: well figure it out somehow.:euro::rolleyes:
thank you so much again:laugh::laugh:
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.
constantine
2008-09-17, 13:14
what should i do
everytime i start my laptop theres this error RunDLL
i cant read much of the error cuz its written in japanase cuz my OS is japanese
but the error says what the problem is and its the MSSERVER its a .dll something
its the one we remove but when i went to msconfig its still running that dll how can i remove it in my msconfig
i think msconfig still trying to run that process but its not there anymore
so how can i fix it???
thank you so much
Try this.
We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
Download ResetTeaTimer.bat to the Desktop
http://downloads.subratam.org/ResetTeaTimer.bat
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer (and preventing TeaTimer to restore them upon reactivation).
Open HijackThis, click do a system scan only and checkmark this:
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Honey_ko\AppData\Local\Temp\fccdawTn.dll,#1
Close all windows including browser and press fix checked.
Reboot.
Re-enable TeaTimer.
Post back a fresh HijackThis log.
constantine
2008-09-17, 13:27
i uninstall spybot and reinstall it before i PM you
should i download that teatimer.bat??
or continue to the next step???
If TeaTimer isn't running, you can skip that part.
If it is, then not.
constantine
2008-09-17, 15:07
after my unit got infected my internet explorer got so slow.opening google takes 20sec.it almost has nothing to load on that page but it takes 10 to 20 sec to load and sometimes when i open ie it hangs.huhuhuhu:sad::sad::sad:
i did all what you said
heres the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:30 PM, on 9/17/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\system32\conime.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Chikka Messenger\Chikka v.4\ChikkaLauncher.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ??????2 - {0DD41AE7-6196-42E7-BDE5-4F393997449E} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O2 - BHO: Yahoo!????????????? - {1F68E72C-50E5-44B8-8F56-6A54D3AF1DA4} - C:\Program Files\Yahoo!\Companion\Installs\ypho.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: ??????2 ????? - {833CFE4E-05BD-43A3-97A7-A4E80D742F0F} - C:\PROGRA~1\JUSTSY~1\SIMPLE~1\AtInBnd.dll
O3 - Toolbar: Yahoo! 工具列 - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [PrepareYourVAIO] C:\Program Files\Sony\Prepare your VAIO\PYVAlert.exe
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [IME JPN 2007 Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEJP\IMJPKLMG.EXE /Preload
O4 - HKLM\..\Run: [E-Flyer] "C:\Program Files\Sony\E-Flyer\SubFlyer.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun ? Java ????? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\iflsp.dll
O13 - Gopher Prefix:
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1219940906756&h=5d5553eda8f27f70a72a7a2ca205363e/&filename=jinstall-6u7-windows-i586-jc.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Smart Network Service (BeService) - Sony Corporation - C:\Program Files\Sony\Smart Network\BeService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\Image Converter 3\ICScsiSV.exe
O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMonLauncher.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 3\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe
O23 - Service: TXVDrv Service (TxVDrvSvc) - Texim Corporation. - C:\Program Files\JustSystems\PersonalShelter\TxVDrvSvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Media Content Collection (VAIOMediaPlatform-UCLS-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe
O23 - Service: VAIO Media Content Collection (HTTP) (VAIOMediaPlatform-UCLS-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Content Collection (UPnP) (VAIOMediaPlatform-UCLS-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 13859 bytes
constantine
2008-09-17, 15:25
waaaaaaaaaaaaaaaaaaaaaaaaa
after the hjt fix i restart and the error still there i go to msconfig and its still there so i did scan again with hjt and again its there.did i did something wrong.huhuhuhu.
1. Open Notepad and copy/paste the code box below into a new text file.
regedit /e peek1.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg"
regedit /e peek2.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder"
type peek1.txt >> startup.txt
type peek2.txt >> startup.txt
del peek*.txt
start notepad startup.txt
2. Save the file as msconfig2.bat by choosing save as *All Files, and save it to your Desktop.
3. Locate msconfig2.bat on your Desktop and double-click on it to run.
4. When done, it will create a file named startup.txt on your Desktop and notepad will open with a list of disabled startup entries in MSConfig.
5. Copy/Paste that text log in your next reply.
constantine
2008-09-17, 15:43
i redo what you instructed me to do and reboot and the errors gone
but i still did what you ask me to do and heres the startup.txt
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"
"YEAR"=dword:000007d8
"MONTH"=dword:00000008
"DAY"=dword:00000018
"HOUR"=dword:00000014
"MINUTE"=dword:0000001e
"SECOND"=dword:0000002b
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="QuickTime Task"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
"inimapping"="0"
"YEAR"=dword:000007d8
"MONTH"=dword:00000008
"DAY"=dword:00000018
"HOUR"=dword:00000014
"MINUTE"=dword:0000001e
"SECOND"=dword:0000002b
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RegistryMechanic]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RegistryMechanic"
"hkey"="HKCU"
"command"="C:\\Program Files\\Registry Mechanic\\RMTray.exe /H"
"inimapping"="0"
"YEAR"=dword:000007d8
"MONTH"=dword:00000008
"DAY"=dword:00000018
"HOUR"=dword:00000012
"MINUTE"=dword:0000002c
"SECOND"=dword:0000002d
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="TkBellExe"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"
"YEAR"=dword:000007d8
"MONTH"=dword:00000008
"DAY"=dword:00000018
"HOUR"=dword:00000014
"MINUTE"=dword:0000001e
"SECOND"=dword:0000002b
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="WinampAgent"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Winamp\\winampa.exe\""
"inimapping"="0"
"YEAR"=dword:000007d8
"MONTH"=dword:00000008
"DAY"=dword:00000018
"HOUR"=dword:00000014
"MINUTE"=dword:0000001e
"SECOND"=dword:0000002c
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]
Great :)
Still some issues left?
constantine
2008-09-20, 18:51
sorry been busy
my laptops ok i think :laugh:
well theres issue with my moms pc
could you take a look??
really appreciate it thanks for the help?
Great :)
EDIT: shelf life seems to have replied.
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.