GanjaStar
2008-12-28, 17:51
Hello spybot experts
last moth i was infected and shaba helped me clean up my rig.
http://forums.spybot.info/showthread.php?t=37088
Well just watned to see have my sfing habits improved, or have i been reinfected again :red:
antivir shows clean, and so does kaspersky online scan. Since shaba asked me last time to post both of RSIT logs, here they are.
Please let me know how does it look, no rush, or course :)
=======================================================
info.txt logfile of random's system information tool 1.05 2008-12-28 17:42:34
======Uninstall list======
-->MsiExec /X{AC54E544-3E42-443C-A91D-A00A6974C592}
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{C229589D-CC1A-43FF-9507-CDED3AB85325}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{C229589D-CC1A-43FF-9507-CDED3AB85325}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{ECC3C64B-2A22-48C5-857B-E952D7BE64F5}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{ECC3C64B-2A22-48C5-857B-E952D7BE64F5}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x9 /remove
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Avira AntiVir Personal - Free Antivirus-->D:\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
CCleaner (remove only)-->"D:\CCleaner\uninst.exe"
Creative ALchemy-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x9 /remove
Creative Audio Control Panel-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9 /remove
Creative Console Launcher-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x9 /remove
Creative Sound Blaster Properties x64 Edition-->"C:\Program Files (x86)\Creative Installation Information\SBCONTROL64\Setup.exe" /remove /l0x0009
DH Driver Cleaner.NET-->D:\DriverCleaner\Uninstall.exe
HijackThis 2.0.2-->"C:\Program Files (x86)\trend micro\HijackThis.exe" /uninstall
IrfanView (remove only)-->C:\Program Files (x86)\IrfanView\iv_uninstall.exe
King's Bounty. The Legend (Remove Only)-->"C:\Games\King's Bounty\unins000.exe"
Malwarebytes' Anti-Malware-->"D:\Anti-Malware\unins000.exe"
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{FD052FB9-FE90-4438-B355-15EDC89D8FB1}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
NVIDIA PhysX v8.10.13-->MsiExec.exe /X{AC54E544-3E42-443C-A91D-A00A6974C592}
OpenAL-->"C:\Program Files (x86)\OpenAL\oalinst.exe" /U
Opera 9.63-->MsiExec.exe /X{2C0CD17D-0B06-4700-83FA-7344B868B0A2}
Overlord - Raising Hell-->C:\Program Files (x86)\InstallShield Installation Information\{259A8A5E-2886-4BED-9EF1-D5485282CCC3}\Setup.exe -runfromtemp -l0x0009 -removeonly
Razer Diamondback 3G-->C:\Program Files (x86)\InstallShield Installation Information\{7E659C5C-4DF1-499B-B802-77BAE9ABE4D4}\setup.exe -runfromtemp -l0x0009 -removeonly
RivaTuner v2.21-->"D:\RivaTuner\uninstall.exe"
Sound Blaster X-Fi-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}\SETUP.EXE" -l0x9 /remove
Spybot - Search & Destroy-->"D:\Spybot\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Tomb Raider: Underworld 1.1-->C:\Games\Tomb Raider Underworld\uninst.exe
ViewSonic Windows Vista x64 Signed Files-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FC47C7A5-BE63-11D5-B7C9-005004566E4D}\Setup.exe" -l0x9
Winamp-->"D:\Winamp\UninstWA.exe"
WinRAR archiver-->C:\Program Files (x86)\WinRAR\uninstall.exe
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Security center information======
AS: Windows Defender
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
-----------------EOF-----------------
=====================================================
Logfile of random's system information tool 1.05 (written by random/random)
Run by GanjaStar at 2008-12-28 17:42:26
Microsoft® Windows Vista™ Ultimate Service Pack 1
System drive C: has 60 GB (42%) free of 143 GB
Total RAM: 4094 MB (69% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:42:33 PM, on 12/28/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
D:\Razer\razerhid.exe
D:\RivaTuner\Tools\D3DOverrider\D3DOverrider.exe
D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Opera\opera.exe
C:\Users\GanjaStar\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\GanjaStar.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Diamondback] D:\Razer\razerhid.exe
O4 - HKLM\..\Run: [D3DOverrider] "D:\RivaTuner\Tools\D3DOverrider\D3DOverrider.exe" /s
O4 - HKLM\..\Run: [avgnt] "D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O8 - Extra context menu item: Download all links with IDM - D:\IDM\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\IDM\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\IDM\IEExt.htm
O13 - Gopher Prefix:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PD91Agent - Raxco Software, Inc. - D:\PerfectDisk\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - D:\PerfectDisk\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 4886 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Diamondback"=D:\Razer\razerhid.exe [2007-08-01 147456]
"D3DOverrider"=D:\RivaTuner\Tools\D3DOverrider\D3DOverrider.exe [2008-12-10 53248]
"avgnt"=D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"NoActiveDesktopChanges"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5953aad9-c1b9-11dd-962f-806e6f6e6963}]
shell\AutoRun\command - E:\Viewsonic.exe
======List of files/folders created in the last 1 months======
2008-12-28 17:42:26 ----D---- C:\rsit
2008-12-28 17:22:04 ----D---- C:\ProgramData\Avira
2008-12-28 00:18:51 ----D---- C:\Program Files (x86)\trend micro
2008-12-27 23:48:01 ----D---- C:\Users\GanjaStar\AppData\Roaming\Malwarebytes
2008-12-27 23:47:58 ----D---- C:\ProgramData\Malwarebytes
2008-12-24 05:06:37 ----D---- C:\Windows\system32\AGEIA
2008-12-24 05:06:37 ----D---- C:\Program Files (x86)\AGEIA Technologies
2008-12-23 19:37:46 ----A---- C:\Windows\system32\mon.txt
2008-12-23 19:35:49 ----A---- C:\Windows\VSWizard.ini
2008-12-19 21:06:09 ----D---- C:\ProgramData\Media Center Programs
2008-12-19 01:14:37 ----D---- C:\Users\GanjaStar\AppData\Roaming\Thinstall
2008-12-18 02:25:59 ----A---- C:\Windows\system32\mshtml.dll
2008-12-17 16:18:31 ----A---- C:\Windows\system32\cttele32.dll
2008-12-17 16:18:25 ----A---- C:\Windows\system32\CmdRtr.DLL
2008-12-17 16:18:25 ----A---- C:\Windows\system32\APOMngr.DLL
2008-12-17 16:17:28 ----A---- C:\Windows\system32\AppSetup.exe
2008-12-13 10:43:19 ----A---- C:\Windows\system32\mfc71.dll
2008-12-13 10:43:19 ----A---- C:\Windows\system32\gdiplus.dll
2008-12-12 18:35:17 ----D---- C:\Users\GanjaStar\AppData\Roaming\IrfanView
2008-12-12 18:12:21 ----D---- C:\Windows\system32\xlive
2008-12-12 18:12:21 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2008-12-12 17:17:38 ----A---- C:\Windows\system32\XAudio2_2.dll
2008-12-12 17:17:38 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2008-12-12 17:17:37 ----A---- C:\Windows\system32\xactengine3_2.dll
2008-12-12 17:17:37 ----A---- C:\Windows\system32\d3dx10_39.dll
2008-12-12 17:17:37 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2008-12-12 17:17:36 ----A---- C:\Windows\system32\D3DX9_39.dll
2008-12-12 16:19:18 ----D---- C:\Users\GanjaStar\AppData\Roaming\InstallShield Installation Information
2008-12-12 16:15:49 ----A---- C:\Windows\system32\_AxShlEx.dll
2008-12-11 19:22:48 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2008-12-11 08:37:48 ----A---- C:\Windows\system32\tzres.dll
2008-12-11 08:36:32 ----A---- C:\Windows\system32\EncDec.dll
2008-12-11 08:36:31 ----A---- C:\Windows\system32\psisdecd.dll
2008-12-11 08:36:28 ----A---- C:\Windows\system32\Apphlpdm.dll
2008-12-11 08:36:27 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2008-12-11 08:36:22 ----A---- C:\Windows\system32\urlmon.dll
2008-12-11 08:36:22 ----A---- C:\Windows\system32\ieframe.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\wininet.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\mstime.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\jsproxy.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\iertutil.dll
2008-12-11 08:36:17 ----A---- C:\Windows\system32\mf.dll
2008-12-11 08:36:16 ----A---- C:\Windows\system32\WMVCORE.DLL
2008-12-11 08:36:16 ----A---- C:\Windows\system32\WMNetMgr.dll
2008-12-11 08:36:16 ----A---- C:\Windows\system32\logagent.exe
2008-12-11 08:36:12 ----A---- C:\Windows\system32\shell32.dll
2008-12-11 08:36:09 ----A---- C:\Windows\system32\gdi32.dll
2008-12-11 08:36:09 ----A---- C:\Windows\system32\explorer.exe
2008-12-11 08:36:09 ----A---- C:\Windows\explorer.exe
2008-12-09 20:20:11 ----AD---- C:\ProgramData\TEMP
2008-12-09 13:52:01 ----A---- C:\Windows\system32\PnkBstrB.exe
2008-12-09 13:51:53 ----A---- C:\Windows\system32\PnkBstrA.exe
2008-12-08 18:25:14 ----D---- C:\ProgramData\Spybot - Search & Destroy
2008-12-06 10:49:59 ----SHD---- C:\Windows\Installer
2008-12-06 08:18:29 ----D---- C:\Users\GanjaStar\AppData\Roaming\InstallShield
2008-12-04 17:46:28 ----D---- C:\Users\GanjaStar\AppData\Roaming\Winamp
2008-12-04 08:02:24 ----A---- C:\Windows\GSetup.ini
2008-12-04 07:19:32 ----D---- C:\Windows\Minidump
2008-12-04 05:14:34 ----D---- C:\Windows\Debug
2008-12-04 05:11:43 ----D---- C:\Windows\SoftwareDistribution
2008-12-04 05:10:43 ----D---- C:\Windows\CSC
2008-12-04 05:09:38 ----D---- C:\Windows\Prefetch
2008-12-04 05:09:35 ----SHD---- C:\System Volume Information
2008-12-04 05:08:43 ----D---- C:\Windows\Panther
2008-12-04 05:08:30 ----RAS---- C:\BOOTSECT.BAK
2008-12-04 05:08:28 ----SHD---- C:\Boot
2008-12-04 04:15:01 ----RHD---- C:\Users\GanjaStar\AppData\Roaming\SecuROM
2008-12-04 04:11:03 ----A---- C:\Windows\system32\XAudio2_3.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\xactengine3_3.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\D3DX9_40.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\d3dx10_40.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2008-12-04 04:11:02 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2008-12-04 04:02:33 ----D---- C:\Users\GanjaStar\AppData\Roaming\Macromedia
2008-12-04 04:02:33 ----D---- C:\Users\GanjaStar\AppData\Roaming\Adobe
2008-12-04 04:00:40 ----A---- C:\Windows\system32\msvcr71.dll
2008-12-04 04:00:40 ----A---- C:\Windows\system32\msvcp71.dll
2008-12-04 04:00:37 ----D---- C:\Windows\system32\Adobe
2008-12-04 04:00:32 ----D---- C:\Windows\system32\Macromed
2008-12-04 03:56:21 ----D---- C:\Users\GanjaStar\AppData\Roaming\Creative
2008-12-04 03:35:41 ----A---- C:\Windows\Updreg.EXE
2008-12-04 03:33:51 ----A---- C:\Windows\Ctregrun.exe
2008-12-04 03:31:53 ----HD---- C:\Program Files (x86)\Creative Installation Information
2008-12-04 03:31:53 ----D---- C:\Program Files (x86)\Common Files\Creative
2008-12-04 03:31:47 ----D---- C:\Program Files (x86)\Common Files\Creative Labs Shared
2008-12-04 03:31:42 ----D---- C:\ProgramData\Creative
2008-12-04 03:31:40 ----D---- C:\Program Files (x86)\Creative
2008-12-04 03:31:29 ----D---- C:\Program Files (x86)\OpenAL
2008-12-04 03:31:29 ----A---- C:\Windows\system32\wrap_oal.dll
2008-12-04 03:31:29 ----A---- C:\Windows\system32\OpenAL32.dll
2008-12-04 03:31:09 ----D---- C:\Windows\system32\Data
2008-12-04 03:31:09 ----A---- C:\Windows\system32\INRES.DLL
2008-12-04 03:31:02 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2008-12-04 03:31:00 ----D---- C:\Program Files (x86)\Common Files\InstallShield
2008-12-04 03:20:01 ----D---- C:\ProgramData\Raxco
2008-12-04 03:05:40 ----D---- C:\Users\GanjaStar\AppData\Roaming\WinRAR
2008-12-04 03:03:28 ----D---- C:\Program Files (x86)\WinRAR
2008-12-04 02:56:40 ----D---- C:\Users\GanjaStar\AppData\Roaming\IDM
2008-12-04 02:56:40 ----D---- C:\Users\GanjaStar\AppData\Roaming\DMCache
2008-12-04 02:50:09 ----D---- C:\Program Files (x86)\IrfanView
2008-12-03 22:13:49 ----A---- C:\Windows\system32\XAudio2_1.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\xactengine3_1.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\D3DX9_38.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\d3dx10_38.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\XAudio2_0.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\xactengine3_0.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\xactengine2_10.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\D3DX9_37.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\d3dx10_37.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\xactengine2_9.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx9_36.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx9_35.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx10_36.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx10_35.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\xinput1_3.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\xactengine2_8.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\xactengine2_7.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\d3dx9_34.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\d3dx10_34.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\d3dx10_33.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\xactengine2_6.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\xactengine2_5.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\xactengine2_4.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\x3daudio1_1.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\d3dx9_33.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\d3dx9_32.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\d3dx10.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xinput1_2.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xinput1_1.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xactengine2_3.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xactengine2_2.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xactengine2_1.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\d3dx9_31.dll
2008-12-03 22:13:43 ----A---- C:\Windows\system32\d3dx9_30.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\xactengine2_0.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\x3daudio1_0.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_29.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_28.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_27.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_26.dll
2008-12-03 22:13:41 ----A---- C:\Windows\system32\d3dx9_25.dll
2008-12-03 22:13:41 ----A---- C:\Windows\system32\d3dx9_24.dll
2008-12-03 22:01:36 ----D---- C:\Program Files (x86)\Common Files\Steam
2008-12-03 21:11:31 ----D---- C:\Users\GanjaStar\AppData\Roaming\Opera
2008-12-03 21:08:45 ----D---- C:\Games
2008-12-03 20:58:17 ----D---- C:\Program Files (x86)\Intel
2008-12-03 20:58:17 ----A---- C:\Windows\system32\CSVer.dll
2008-12-03 20:58:10 ----D---- C:\Intel
2008-12-03 20:55:17 ----D---- C:\ProgramData\NVIDIA
2008-12-03 20:39:17 ----A---- C:\Windows\system32\thawbrkr.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\SearchFilterHost.exe
2008-12-03 20:39:17 ----A---- C:\Windows\system32\propsys.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\propdefs.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\offfilt.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msstrc.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\mssprxy.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\mssitlb.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msshsq.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msshooks.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msscb.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\mimefilt.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\korwbrkr.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\chsbrkr.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\xmlfilter.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\tquery.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2008-12-03 20:39:16 ----A---- C:\Windows\system32\SearchIndexer.exe
2008-12-03 20:39:16 ----A---- C:\Windows\system32\rtffilt.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\nlhtml.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssvp.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssrch.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssphtb.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssph.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\msscntrs.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\chtbrkr.dll
2008-12-03 20:31:27 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2008-12-03 20:31:26 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2008-12-03 20:31:18 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\wshext.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\wscript.exe
2008-12-03 20:30:16 ----A---- C:\Windows\system32\vbscript.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\scrrun.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\scrobj.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\jscript.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\cscript.exe
2008-12-03 20:30:15 ----A---- C:\Windows\system32\inetcomm.dll
2008-12-03 20:30:08 ----A---- C:\Windows\system32\gameux.dll
2008-12-03 20:30:03 ----A---- C:\Windows\system32\srclient.dll
2008-12-03 20:30:03 ----A---- C:\Windows\system32\kbd106n.dll
2008-12-03 20:29:59 ----A---- C:\Windows\system32\connect.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\wmpeffects.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\winipsec.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\polstore.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2008-12-03 20:29:54 ----A---- C:\Windows\system32\msxml3.dll
2008-12-03 20:29:53 ----A---- C:\Windows\system32\win32spl.dll
2008-12-03 20:29:53 ----A---- C:\Windows\system32\msxml6.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\wshqos.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\traffic.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\rpcrt4.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\pacerprf.dll
2008-12-03 20:29:26 ----A---- C:\Windows\system32\dataclen.dll
2008-12-03 20:29:19 ----A---- C:\Windows\system32\quartz.dll
2008-12-03 20:29:19 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2008-12-03 20:29:17 ----A---- C:\Windows\system32\es.dll
2008-12-03 20:29:16 ----A---- C:\Windows\system32\wshrm.dll
2008-12-03 20:27:33 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2008-12-03 20:27:33 ----A---- C:\Windows\system32\WindowsCodecs.dll
2008-12-03 20:27:33 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2008-12-03 20:27:32 ----A---- C:\Windows\system32\netapi32.dll
2008-12-03 20:26:41 ----A---- C:\Windows\system32\Faultrep.dll
2008-12-03 20:22:16 ----A---- C:\Windows\system32\wups.dll
2008-12-03 20:22:16 ----A---- C:\Windows\system32\wudriver.dll
2008-12-03 20:22:16 ----A---- C:\Windows\system32\wuapi.dll
2008-12-03 20:22:10 ----A---- C:\Windows\system32\wuwebv.dll
2008-12-03 20:22:10 ----A---- C:\Windows\system32\wuapp.exe
2008-12-03 20:17:07 ----D---- C:\Users\GanjaStar\AppData\Roaming\Identities
2008-12-03 20:17:03 ----SD---- C:\Users\GanjaStar\AppData\Roaming\Microsoft
2008-12-03 20:17:03 ----D---- C:\Users\GanjaStar\AppData\Roaming\Media Center Programs
======List of files/folders modified in the last 1 months======
2008-12-28 17:41:16 ----D---- C:\Windows\Temp
2008-12-28 17:31:46 ----D---- C:\Windows\System32
2008-12-28 17:31:46 ----D---- C:\Windows\inf
2008-12-28 17:26:14 ----SD---- C:\ProgramData\Microsoft
2008-12-28 17:22:04 ----HD---- C:\ProgramData
2008-12-28 17:22:04 ----D---- C:\Windows\system32\drivers
2008-12-28 16:55:25 ----D---- C:\Windows
2008-12-28 00:18:51 ----RD---- C:\Program Files (x86)
2008-12-27 09:07:47 ----D---- C:\Windows\SysWOW64
2008-12-26 20:01:54 ----RSD---- C:\Windows\assembly
2008-12-20 00:01:19 ----D---- C:\Windows\LiveKernelReports
2008-12-19 01:15:14 ----SHD---- C:\$Recycle.Bin
2008-12-18 02:26:09 ----D---- C:\Windows\winsxs
2008-12-17 00:50:45 ----SD---- C:\Windows\Downloaded Program Files
2008-12-11 19:22:48 ----D---- C:\Program Files (x86)\Common Files
2008-12-11 08:57:50 ----D---- C:\Windows\rescache
2008-12-11 08:55:04 ----D---- C:\Windows\Microsoft.NET
2008-12-11 08:41:37 ----D---- C:\Windows\system32\en-US
2008-12-11 08:41:37 ----D---- C:\Windows\ehome
2008-12-11 08:41:37 ----D---- C:\Windows\AppPatch
2008-12-04 04:01:42 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2008-12-04 03:31:42 ----RD---- C:\Program Files
2008-12-03 22:13:36 ----D---- C:\Windows\Logs
2008-12-03 20:53:32 ----D---- C:\Windows\Help
2008-12-03 20:42:00 ----D---- C:\Windows\PolicyDefinitions
2008-12-03 20:41:57 ----D---- C:\Windows\system32\migration
2008-12-03 20:16:53 ----RD---- C:\Users
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys []
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []
R2 DefragFS;DefragFS; C:\Windows\system32\drivers\DefragFS.sys []
R3 CT20XUT.SYS;CT20XUT.SYS; C:\Windows\System32\drivers\CT20XUT.SYS []
R3 ctac32k;Creative AC3 Software Decoder; C:\Windows\system32\drivers\ctac32k.sys []
R3 ctaud2k;Creative Audio Driver (WDM); C:\Windows\system32\drivers\ctaud2k.sys []
R3 CTEXFIFX.SYS;CTEXFIFX.SYS; C:\Windows\System32\drivers\CTEXFIFX.SYS []
R3 CTHWIUT.SYS;CTHWIUT.SYS; C:\Windows\System32\drivers\CTHWIUT.SYS []
R3 ctprxy2k;Creative Proxy Driver; C:\Windows\system32\drivers\ctprxy2k.sys []
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\Windows\system32\drivers\ctsfm2k.sys []
R3 emupia;E-mu Plug-in Architecture Driver; C:\Windows\system32\drivers\emupia2k.sys []
R3 ha20x2k;Creative 20X HAL Driver; C:\Windows\system32\drivers\ha20x2k.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []
R3 ossrv;Creative OS Services Driver; C:\Windows\system32\drivers\ctoss2k.sys []
R3 Razerlow;Razer Pro|Solutions; C:\Windows\system32\drivers\DB3G.sys []
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
R3 xnacc;XBOX 360 Controller For Windows Driver Service; C:\Windows\system32\DRIVERS\xnacc.sys []
S3 ALSysIO;ALSysIO; \??\C:\Users\GANJAS~1\AppData\Local\Temp\ALSysIO64.sys []
S3 ays6mreb;ays6mreb; C:\Windows\system32\drivers\ays6mreb.sys []
S3 CT20XUT;CT20XUT; C:\Windows\system32\drivers\CT20XUT.SYS []
S3 CTEXFIFX;CTEXFIFX; C:\Windows\system32\drivers\CTEXFIFX.SYS []
S3 CTHWIUT;CTHWIUT; C:\Windows\system32\drivers\CTHWIUT.SYS []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys []
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2008-12-04 20544]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys []
S3 RivaTuner64;RivaTuner64; \??\D:\RivaTuner\RivaTuner64.sys [2008-12-12 19952]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; D:\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; D:\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2008-12-09 66872]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2008-12-27 202040]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-01-21 93696]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2008-12-04 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2008-12-04 79360]
S3 PD91Agent;PD91Agent; D:\PerfectDisk\PD91Agent.exe [2008-09-09 1101064]
S3 PD91Engine;PD91Engine; D:\PerfectDisk\PD91Engine.exe [2008-09-09 1285384]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2008-12-03 104944]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe []
S4 CscService;Offline Files; C:\Windows\System32\svchost.exe [2008-01-21 21504]
S4 CTAudSvcService;Creative Audio Service; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [2008-10-31 307200]
S4 UmRdpService;Terminal Services UserMode Port Redirector; C:\Windows\System32\svchost.exe [2008-01-21 21504]
-----------------EOF-----------------
last moth i was infected and shaba helped me clean up my rig.
http://forums.spybot.info/showthread.php?t=37088
Well just watned to see have my sfing habits improved, or have i been reinfected again :red:
antivir shows clean, and so does kaspersky online scan. Since shaba asked me last time to post both of RSIT logs, here they are.
Please let me know how does it look, no rush, or course :)
=======================================================
info.txt logfile of random's system information tool 1.05 2008-12-28 17:42:34
======Uninstall list======
-->MsiExec /X{AC54E544-3E42-443C-A91D-A00A6974C592}
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{C229589D-CC1A-43FF-9507-CDED3AB85325}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{C229589D-CC1A-43FF-9507-CDED3AB85325}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{CC3D3A93-C433-4329-AC3A-7EFC52A332C2}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{ECC3C64B-2A22-48C5-857B-E952D7BE64F5}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{ECC3C64B-2A22-48C5-857B-E952D7BE64F5}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FBFF2411-D066-4D24-BCE0-893086009E1B}\setup.exe" -l0x9 /remove
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Avira AntiVir Personal - Free Antivirus-->D:\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
CCleaner (remove only)-->"D:\CCleaner\uninst.exe"
Creative ALchemy-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{12321490-F573-4815-B6CC-7ABEF18C9AC4}\setup.exe" -l0x9 /remove
Creative Audio Control Panel-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{17E96A7F-AFE3-4171-87B1-583E376319E8}\setup.exe" -l0x9 /remove
Creative Console Launcher-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{888347B3-AEC5-4BB5-8BAB-781D72A57C73}\setup.exe" -l0x9 /remove
Creative Sound Blaster Properties x64 Edition-->"C:\Program Files (x86)\Creative Installation Information\SBCONTROL64\Setup.exe" /remove /l0x0009
DH Driver Cleaner.NET-->D:\DriverCleaner\Uninstall.exe
HijackThis 2.0.2-->"C:\Program Files (x86)\trend micro\HijackThis.exe" /uninstall
IrfanView (remove only)-->C:\Program Files (x86)\IrfanView\iv_uninstall.exe
King's Bounty. The Legend (Remove Only)-->"C:\Games\King's Bounty\unins000.exe"
Malwarebytes' Anti-Malware-->"D:\Anti-Malware\unins000.exe"
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4AA3D64E-9EC3-4B0F-AB91-5885AC55641F}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{FD052FB9-FE90-4438-B355-15EDC89D8FB1}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
NVIDIA PhysX v8.10.13-->MsiExec.exe /X{AC54E544-3E42-443C-A91D-A00A6974C592}
OpenAL-->"C:\Program Files (x86)\OpenAL\oalinst.exe" /U
Opera 9.63-->MsiExec.exe /X{2C0CD17D-0B06-4700-83FA-7344B868B0A2}
Overlord - Raising Hell-->C:\Program Files (x86)\InstallShield Installation Information\{259A8A5E-2886-4BED-9EF1-D5485282CCC3}\Setup.exe -runfromtemp -l0x0009 -removeonly
Razer Diamondback 3G-->C:\Program Files (x86)\InstallShield Installation Information\{7E659C5C-4DF1-499B-B802-77BAE9ABE4D4}\setup.exe -runfromtemp -l0x0009 -removeonly
RivaTuner v2.21-->"D:\RivaTuner\uninstall.exe"
Sound Blaster X-Fi-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\Professional\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}\SETUP.EXE" -l0x9 /remove
Spybot - Search & Destroy-->"D:\Spybot\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Tomb Raider: Underworld 1.1-->C:\Games\Tomb Raider Underworld\uninst.exe
ViewSonic Windows Vista x64 Signed Files-->RunDll32 C:\PROGRA~2\COMMON~1\InstallShield\engine\6\Intel 32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{FC47C7A5-BE63-11D5-B7C9-005004566E4D}\Setup.exe" -l0x9
Winamp-->"D:\Winamp\UninstWA.exe"
WinRAR archiver-->C:\Program Files (x86)\WinRAR\uninstall.exe
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Security center information======
AS: Windows Defender
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
-----------------EOF-----------------
=====================================================
Logfile of random's system information tool 1.05 (written by random/random)
Run by GanjaStar at 2008-12-28 17:42:26
Microsoft® Windows Vista™ Ultimate Service Pack 1
System drive C: has 60 GB (42%) free of 143 GB
Total RAM: 4094 MB (69% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:42:33 PM, on 12/28/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
D:\Razer\razerhid.exe
D:\RivaTuner\Tools\D3DOverrider\D3DOverrider.exe
D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe
D:\Opera\opera.exe
C:\Users\GanjaStar\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\GanjaStar.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Diamondback] D:\Razer\razerhid.exe
O4 - HKLM\..\Run: [D3DOverrider] "D:\RivaTuner\Tools\D3DOverrider\D3DOverrider.exe" /s
O4 - HKLM\..\Run: [avgnt] "D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O8 - Extra context menu item: Download all links with IDM - D:\IDM\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\IDM\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\IDM\IEExt.htm
O13 - Gopher Prefix:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - D:\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - D:\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PD91Agent - Raxco Software, Inc. - D:\PerfectDisk\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - D:\PerfectDisk\PD91Engine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 4886 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Diamondback"=D:\Razer\razerhid.exe [2007-08-01 147456]
"D3DOverrider"=D:\RivaTuner\Tools\D3DOverrider\D3DOverrider.exe [2008-12-10 53248]
"avgnt"=D:\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-06-12 266497]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"NoActiveDesktopChanges"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5953aad9-c1b9-11dd-962f-806e6f6e6963}]
shell\AutoRun\command - E:\Viewsonic.exe
======List of files/folders created in the last 1 months======
2008-12-28 17:42:26 ----D---- C:\rsit
2008-12-28 17:22:04 ----D---- C:\ProgramData\Avira
2008-12-28 00:18:51 ----D---- C:\Program Files (x86)\trend micro
2008-12-27 23:48:01 ----D---- C:\Users\GanjaStar\AppData\Roaming\Malwarebytes
2008-12-27 23:47:58 ----D---- C:\ProgramData\Malwarebytes
2008-12-24 05:06:37 ----D---- C:\Windows\system32\AGEIA
2008-12-24 05:06:37 ----D---- C:\Program Files (x86)\AGEIA Technologies
2008-12-23 19:37:46 ----A---- C:\Windows\system32\mon.txt
2008-12-23 19:35:49 ----A---- C:\Windows\VSWizard.ini
2008-12-19 21:06:09 ----D---- C:\ProgramData\Media Center Programs
2008-12-19 01:14:37 ----D---- C:\Users\GanjaStar\AppData\Roaming\Thinstall
2008-12-18 02:25:59 ----A---- C:\Windows\system32\mshtml.dll
2008-12-17 16:18:31 ----A---- C:\Windows\system32\cttele32.dll
2008-12-17 16:18:25 ----A---- C:\Windows\system32\CmdRtr.DLL
2008-12-17 16:18:25 ----A---- C:\Windows\system32\APOMngr.DLL
2008-12-17 16:17:28 ----A---- C:\Windows\system32\AppSetup.exe
2008-12-13 10:43:19 ----A---- C:\Windows\system32\mfc71.dll
2008-12-13 10:43:19 ----A---- C:\Windows\system32\gdiplus.dll
2008-12-12 18:35:17 ----D---- C:\Users\GanjaStar\AppData\Roaming\IrfanView
2008-12-12 18:12:21 ----D---- C:\Windows\system32\xlive
2008-12-12 18:12:21 ----D---- C:\Program Files (x86)\Microsoft Games for Windows - LIVE
2008-12-12 17:17:38 ----A---- C:\Windows\system32\XAudio2_2.dll
2008-12-12 17:17:38 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2008-12-12 17:17:37 ----A---- C:\Windows\system32\xactengine3_2.dll
2008-12-12 17:17:37 ----A---- C:\Windows\system32\d3dx10_39.dll
2008-12-12 17:17:37 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2008-12-12 17:17:36 ----A---- C:\Windows\system32\D3DX9_39.dll
2008-12-12 16:19:18 ----D---- C:\Users\GanjaStar\AppData\Roaming\InstallShield Installation Information
2008-12-12 16:15:49 ----A---- C:\Windows\system32\_AxShlEx.dll
2008-12-11 19:22:48 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2008-12-11 08:37:48 ----A---- C:\Windows\system32\tzres.dll
2008-12-11 08:36:32 ----A---- C:\Windows\system32\EncDec.dll
2008-12-11 08:36:31 ----A---- C:\Windows\system32\psisdecd.dll
2008-12-11 08:36:28 ----A---- C:\Windows\system32\Apphlpdm.dll
2008-12-11 08:36:27 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2008-12-11 08:36:22 ----A---- C:\Windows\system32\urlmon.dll
2008-12-11 08:36:22 ----A---- C:\Windows\system32\ieframe.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\wininet.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\mstime.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\jsproxy.dll
2008-12-11 08:36:21 ----A---- C:\Windows\system32\iertutil.dll
2008-12-11 08:36:17 ----A---- C:\Windows\system32\mf.dll
2008-12-11 08:36:16 ----A---- C:\Windows\system32\WMVCORE.DLL
2008-12-11 08:36:16 ----A---- C:\Windows\system32\WMNetMgr.dll
2008-12-11 08:36:16 ----A---- C:\Windows\system32\logagent.exe
2008-12-11 08:36:12 ----A---- C:\Windows\system32\shell32.dll
2008-12-11 08:36:09 ----A---- C:\Windows\system32\gdi32.dll
2008-12-11 08:36:09 ----A---- C:\Windows\system32\explorer.exe
2008-12-11 08:36:09 ----A---- C:\Windows\explorer.exe
2008-12-09 20:20:11 ----AD---- C:\ProgramData\TEMP
2008-12-09 13:52:01 ----A---- C:\Windows\system32\PnkBstrB.exe
2008-12-09 13:51:53 ----A---- C:\Windows\system32\PnkBstrA.exe
2008-12-08 18:25:14 ----D---- C:\ProgramData\Spybot - Search & Destroy
2008-12-06 10:49:59 ----SHD---- C:\Windows\Installer
2008-12-06 08:18:29 ----D---- C:\Users\GanjaStar\AppData\Roaming\InstallShield
2008-12-04 17:46:28 ----D---- C:\Users\GanjaStar\AppData\Roaming\Winamp
2008-12-04 08:02:24 ----A---- C:\Windows\GSetup.ini
2008-12-04 07:19:32 ----D---- C:\Windows\Minidump
2008-12-04 05:14:34 ----D---- C:\Windows\Debug
2008-12-04 05:11:43 ----D---- C:\Windows\SoftwareDistribution
2008-12-04 05:10:43 ----D---- C:\Windows\CSC
2008-12-04 05:09:38 ----D---- C:\Windows\Prefetch
2008-12-04 05:09:35 ----SHD---- C:\System Volume Information
2008-12-04 05:08:43 ----D---- C:\Windows\Panther
2008-12-04 05:08:30 ----RAS---- C:\BOOTSECT.BAK
2008-12-04 05:08:28 ----SHD---- C:\Boot
2008-12-04 04:15:01 ----RHD---- C:\Users\GanjaStar\AppData\Roaming\SecuROM
2008-12-04 04:11:03 ----A---- C:\Windows\system32\XAudio2_3.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\xactengine3_3.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\D3DX9_40.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\d3dx10_40.dll
2008-12-04 04:11:03 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2008-12-04 04:11:02 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2008-12-04 04:02:33 ----D---- C:\Users\GanjaStar\AppData\Roaming\Macromedia
2008-12-04 04:02:33 ----D---- C:\Users\GanjaStar\AppData\Roaming\Adobe
2008-12-04 04:00:40 ----A---- C:\Windows\system32\msvcr71.dll
2008-12-04 04:00:40 ----A---- C:\Windows\system32\msvcp71.dll
2008-12-04 04:00:37 ----D---- C:\Windows\system32\Adobe
2008-12-04 04:00:32 ----D---- C:\Windows\system32\Macromed
2008-12-04 03:56:21 ----D---- C:\Users\GanjaStar\AppData\Roaming\Creative
2008-12-04 03:35:41 ----A---- C:\Windows\Updreg.EXE
2008-12-04 03:33:51 ----A---- C:\Windows\Ctregrun.exe
2008-12-04 03:31:53 ----HD---- C:\Program Files (x86)\Creative Installation Information
2008-12-04 03:31:53 ----D---- C:\Program Files (x86)\Common Files\Creative
2008-12-04 03:31:47 ----D---- C:\Program Files (x86)\Common Files\Creative Labs Shared
2008-12-04 03:31:42 ----D---- C:\ProgramData\Creative
2008-12-04 03:31:40 ----D---- C:\Program Files (x86)\Creative
2008-12-04 03:31:29 ----D---- C:\Program Files (x86)\OpenAL
2008-12-04 03:31:29 ----A---- C:\Windows\system32\wrap_oal.dll
2008-12-04 03:31:29 ----A---- C:\Windows\system32\OpenAL32.dll
2008-12-04 03:31:09 ----D---- C:\Windows\system32\Data
2008-12-04 03:31:09 ----A---- C:\Windows\system32\INRES.DLL
2008-12-04 03:31:02 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2008-12-04 03:31:00 ----D---- C:\Program Files (x86)\Common Files\InstallShield
2008-12-04 03:20:01 ----D---- C:\ProgramData\Raxco
2008-12-04 03:05:40 ----D---- C:\Users\GanjaStar\AppData\Roaming\WinRAR
2008-12-04 03:03:28 ----D---- C:\Program Files (x86)\WinRAR
2008-12-04 02:56:40 ----D---- C:\Users\GanjaStar\AppData\Roaming\IDM
2008-12-04 02:56:40 ----D---- C:\Users\GanjaStar\AppData\Roaming\DMCache
2008-12-04 02:50:09 ----D---- C:\Program Files (x86)\IrfanView
2008-12-03 22:13:49 ----A---- C:\Windows\system32\XAudio2_1.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\xactengine3_1.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\D3DX9_38.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\d3dx10_38.dll
2008-12-03 22:13:49 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\XAudio2_0.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\xactengine3_0.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\xactengine2_10.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\D3DX9_37.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\d3dx10_37.dll
2008-12-03 22:13:48 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\xactengine2_9.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx9_36.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx9_35.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx10_36.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\d3dx10_35.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2008-12-03 22:13:47 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\xinput1_3.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\xactengine2_8.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\xactengine2_7.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\d3dx9_34.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\d3dx10_34.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\d3dx10_33.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2008-12-03 22:13:46 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\xactengine2_6.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\xactengine2_5.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\xactengine2_4.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\x3daudio1_1.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\d3dx9_33.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\d3dx9_32.dll
2008-12-03 22:13:45 ----A---- C:\Windows\system32\d3dx10.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xinput1_2.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xinput1_1.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xactengine2_3.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xactengine2_2.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\xactengine2_1.dll
2008-12-03 22:13:44 ----A---- C:\Windows\system32\d3dx9_31.dll
2008-12-03 22:13:43 ----A---- C:\Windows\system32\d3dx9_30.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\xactengine2_0.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\x3daudio1_0.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_29.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_28.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_27.dll
2008-12-03 22:13:42 ----A---- C:\Windows\system32\d3dx9_26.dll
2008-12-03 22:13:41 ----A---- C:\Windows\system32\d3dx9_25.dll
2008-12-03 22:13:41 ----A---- C:\Windows\system32\d3dx9_24.dll
2008-12-03 22:01:36 ----D---- C:\Program Files (x86)\Common Files\Steam
2008-12-03 21:11:31 ----D---- C:\Users\GanjaStar\AppData\Roaming\Opera
2008-12-03 21:08:45 ----D---- C:\Games
2008-12-03 20:58:17 ----D---- C:\Program Files (x86)\Intel
2008-12-03 20:58:17 ----A---- C:\Windows\system32\CSVer.dll
2008-12-03 20:58:10 ----D---- C:\Intel
2008-12-03 20:55:17 ----D---- C:\ProgramData\NVIDIA
2008-12-03 20:39:17 ----A---- C:\Windows\system32\thawbrkr.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\SearchFilterHost.exe
2008-12-03 20:39:17 ----A---- C:\Windows\system32\propsys.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\propdefs.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\offfilt.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msstrc.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\mssprxy.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\mssitlb.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msshsq.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msshooks.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\msscb.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\mimefilt.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\korwbrkr.dll
2008-12-03 20:39:17 ----A---- C:\Windows\system32\chsbrkr.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\xmlfilter.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\tquery.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2008-12-03 20:39:16 ----A---- C:\Windows\system32\SearchIndexer.exe
2008-12-03 20:39:16 ----A---- C:\Windows\system32\rtffilt.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\nlhtml.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssvp.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssrch.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssphtb.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\mssph.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\msscntrs.dll
2008-12-03 20:39:16 ----A---- C:\Windows\system32\chtbrkr.dll
2008-12-03 20:31:27 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2008-12-03 20:31:26 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2008-12-03 20:31:18 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\wshext.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\wscript.exe
2008-12-03 20:30:16 ----A---- C:\Windows\system32\vbscript.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\scrrun.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\scrobj.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\jscript.dll
2008-12-03 20:30:16 ----A---- C:\Windows\system32\cscript.exe
2008-12-03 20:30:15 ----A---- C:\Windows\system32\inetcomm.dll
2008-12-03 20:30:08 ----A---- C:\Windows\system32\gameux.dll
2008-12-03 20:30:03 ----A---- C:\Windows\system32\srclient.dll
2008-12-03 20:30:03 ----A---- C:\Windows\system32\kbd106n.dll
2008-12-03 20:29:59 ----A---- C:\Windows\system32\connect.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\wmpeffects.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\winipsec.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\polstore.dll
2008-12-03 20:29:58 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2008-12-03 20:29:54 ----A---- C:\Windows\system32\msxml3.dll
2008-12-03 20:29:53 ----A---- C:\Windows\system32\win32spl.dll
2008-12-03 20:29:53 ----A---- C:\Windows\system32\msxml6.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\wshqos.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\traffic.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\rpcrt4.dll
2008-12-03 20:29:51 ----A---- C:\Windows\system32\pacerprf.dll
2008-12-03 20:29:26 ----A---- C:\Windows\system32\dataclen.dll
2008-12-03 20:29:19 ----A---- C:\Windows\system32\quartz.dll
2008-12-03 20:29:19 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2008-12-03 20:29:17 ----A---- C:\Windows\system32\es.dll
2008-12-03 20:29:16 ----A---- C:\Windows\system32\wshrm.dll
2008-12-03 20:27:33 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2008-12-03 20:27:33 ----A---- C:\Windows\system32\WindowsCodecs.dll
2008-12-03 20:27:33 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2008-12-03 20:27:32 ----A---- C:\Windows\system32\netapi32.dll
2008-12-03 20:26:41 ----A---- C:\Windows\system32\Faultrep.dll
2008-12-03 20:22:16 ----A---- C:\Windows\system32\wups.dll
2008-12-03 20:22:16 ----A---- C:\Windows\system32\wudriver.dll
2008-12-03 20:22:16 ----A---- C:\Windows\system32\wuapi.dll
2008-12-03 20:22:10 ----A---- C:\Windows\system32\wuwebv.dll
2008-12-03 20:22:10 ----A---- C:\Windows\system32\wuapp.exe
2008-12-03 20:17:07 ----D---- C:\Users\GanjaStar\AppData\Roaming\Identities
2008-12-03 20:17:03 ----SD---- C:\Users\GanjaStar\AppData\Roaming\Microsoft
2008-12-03 20:17:03 ----D---- C:\Users\GanjaStar\AppData\Roaming\Media Center Programs
======List of files/folders modified in the last 1 months======
2008-12-28 17:41:16 ----D---- C:\Windows\Temp
2008-12-28 17:31:46 ----D---- C:\Windows\System32
2008-12-28 17:31:46 ----D---- C:\Windows\inf
2008-12-28 17:26:14 ----SD---- C:\ProgramData\Microsoft
2008-12-28 17:22:04 ----HD---- C:\ProgramData
2008-12-28 17:22:04 ----D---- C:\Windows\system32\drivers
2008-12-28 16:55:25 ----D---- C:\Windows
2008-12-28 00:18:51 ----RD---- C:\Program Files (x86)
2008-12-27 09:07:47 ----D---- C:\Windows\SysWOW64
2008-12-26 20:01:54 ----RSD---- C:\Windows\assembly
2008-12-20 00:01:19 ----D---- C:\Windows\LiveKernelReports
2008-12-19 01:15:14 ----SHD---- C:\$Recycle.Bin
2008-12-18 02:26:09 ----D---- C:\Windows\winsxs
2008-12-17 00:50:45 ----SD---- C:\Windows\Downloaded Program Files
2008-12-11 19:22:48 ----D---- C:\Program Files (x86)\Common Files
2008-12-11 08:57:50 ----D---- C:\Windows\rescache
2008-12-11 08:55:04 ----D---- C:\Windows\Microsoft.NET
2008-12-11 08:41:37 ----D---- C:\Windows\system32\en-US
2008-12-11 08:41:37 ----D---- C:\Windows\ehome
2008-12-11 08:41:37 ----D---- C:\Windows\AppPatch
2008-12-04 04:01:42 ----D---- C:\Program Files (x86)\Common Files\microsoft shared
2008-12-04 03:31:42 ----RD---- C:\Program Files
2008-12-03 22:13:36 ----D---- C:\Windows\Logs
2008-12-03 20:53:32 ----D---- C:\Windows\Help
2008-12-03 20:42:00 ----D---- C:\Windows\PolicyDefinitions
2008-12-03 20:41:57 ----D---- C:\Windows\system32\migration
2008-12-03 20:16:53 ----RD---- C:\Users
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys []
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []
R2 DefragFS;DefragFS; C:\Windows\system32\drivers\DefragFS.sys []
R3 CT20XUT.SYS;CT20XUT.SYS; C:\Windows\System32\drivers\CT20XUT.SYS []
R3 ctac32k;Creative AC3 Software Decoder; C:\Windows\system32\drivers\ctac32k.sys []
R3 ctaud2k;Creative Audio Driver (WDM); C:\Windows\system32\drivers\ctaud2k.sys []
R3 CTEXFIFX.SYS;CTEXFIFX.SYS; C:\Windows\System32\drivers\CTEXFIFX.SYS []
R3 CTHWIUT.SYS;CTHWIUT.SYS; C:\Windows\System32\drivers\CTHWIUT.SYS []
R3 ctprxy2k;Creative Proxy Driver; C:\Windows\system32\drivers\ctprxy2k.sys []
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\Windows\system32\drivers\ctsfm2k.sys []
R3 emupia;E-mu Plug-in Architecture Driver; C:\Windows\system32\drivers\emupia2k.sys []
R3 ha20x2k;Creative 20X HAL Driver; C:\Windows\system32\drivers\ha20x2k.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []
R3 ossrv;Creative OS Services Driver; C:\Windows\system32\drivers\ctoss2k.sys []
R3 Razerlow;Razer Pro|Solutions; C:\Windows\system32\drivers\DB3G.sys []
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys []
R3 xnacc;XBOX 360 Controller For Windows Driver Service; C:\Windows\system32\DRIVERS\xnacc.sys []
S3 ALSysIO;ALSysIO; \??\C:\Users\GANJAS~1\AppData\Local\Temp\ALSysIO64.sys []
S3 ays6mreb;ays6mreb; C:\Windows\system32\drivers\ays6mreb.sys []
S3 CT20XUT;CT20XUT; C:\Windows\system32\drivers\CT20XUT.SYS []
S3 CTEXFIFX;CTEXFIFX; C:\Windows\system32\drivers\CTEXFIFX.SYS []
S3 CTHWIUT;CTHWIUT; C:\Windows\system32\drivers\CTHWIUT.SYS []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys []
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2008-12-04 20544]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys []
S3 RivaTuner64;RivaTuner64; \??\D:\RivaTuner\RivaTuner64.sys [2008-12-12 19952]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; D:\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-15 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; D:\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-15 151297]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2008-12-09 66872]
R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2008-12-27 202040]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-01-21 93696]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2008-12-04 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2008-12-04 79360]
S3 PD91Agent;PD91Agent; D:\PerfectDisk\PD91Agent.exe [2008-09-09 1101064]
S3 PD91Engine;PD91Engine; D:\PerfectDisk\PD91Engine.exe [2008-09-09 1285384]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2008-12-03 104944]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe []
S4 CscService;Offline Files; C:\Windows\System32\svchost.exe [2008-01-21 21504]
S4 CTAudSvcService;Creative Audio Service; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [2008-10-31 307200]
S4 UmRdpService;Terminal Services UserMode Port Redirector; C:\Windows\System32\svchost.exe [2008-01-21 21504]
-----------------EOF-----------------