Computer runs insanely slow, has never been checked for Malware (Resolved) [Archive]

View Full Version : Computer runs insanely slow, has never been checked for Malware (Resolved)

Scofield

2009-07-07, 02:18

Hi and thanks in advance. I have a friends computer that runs slower than any I've ever used. She has never had it checked for infections and I have had great help here before. Just to be able to use the computer I did run ComboFix in safe mode (sorry) but now it is a little faster and at least usable in regular start up mode. I hopefully followed the Before you post... advice well enough. I know she has limewire on here and I will remove it, but at the moment the add/remove programs list does not load. Following is the HJT log file. Thanks! Scofield.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:12:21 PM, on 7/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\vVX3000.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 207.68.176.250 auto.search.msn.com
O1 - Hosts: 64.12.152.18 search.netscape.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {55910916-8B4E-4C1E-9253-CCE296EA71EB} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VX3000] C:\WINNT\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [ProfileWatcher] C:\Program Files\ProfileWatcher\profilewatcher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ComboFix\HIDEC.exe" "C:\WINNT\system32\CF27170.exe" /c RD /S/Q \$RECYCLE.bin \RECYCLER \RECYCLED (file missing)
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O24 - Desktop Component 0: (no name) - http://www.3dwallpaper.com/fg/trinity2k2.jpg

--
End of file - 11341 bytes

katana

2009-07-07, 13:39

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly http://www.countingcows.de/laechel.gif

Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------

Disable Teatimer
We need to disable Teatimer as it may interfere with the cleaning.
Please do not re-enable it until I give instructions.

First step: Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident Second step, For Either Version : Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Click Link >>> HERE <<< Link (http://www.neoshine.co.uk/mina/Downloads/TTWipe.bat) and select "save as" and save it to your desktop
Double click TTWipe.bat
Reboot your machine for the changes to take effect.

----------------------------------------------------------------------------------------
Step 1

Restore Host File

Download HostsXpert v4.1 (http://www.funkytoad.com/download/HostsXpert.zip) and unzip it to your desktop.
Double click on HostsXpert.exe to launch the program.
Click on Restore MS Hosts File to restore your Hosts file to its default condition.
Click on Make ReadOnly to secure it against further infection. (unless you plan to use another host file)
Exit the program.

Visit the Website (http://www.funkytoad.com/content/view/13/31/) for more information.

----------------------------------------------------------------------------------------
Step 2

Download and Run RSIT

Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:

log.txt will be opened maximized.
info.txt will be opened minimized.

Please post the contents of both log.txt and info.txt.

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

RSIT Logs
C:\Combofix.txt

Scofield

2009-07-08, 03:30

Hi Katana and thank you for your help. I have followed you instructions... With HostXpert, when I click on Restore MS host files I get the following message... "ERROR: cannot create file c:\winnt\system32\drivers\etc\hosts"

So I could not go forward with that suggestion.... following are other logs requested...

Logfile of random's system information tool 1.06 (written by random/random)
Run by Owner at 2009-07-07 21:27:17
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 24 GB (60%) free of 39 GB
Total RAM: 254 MB (26% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:46 PM, on 7/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\vVX3000.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\RSIT.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Desktop\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 207.68.176.250 auto.search.msn.com
O1 - Hosts: 64.12.152.18 search.netscape.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {55910916-8B4E-4C1E-9253-CCE296EA71EB} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VX3000] C:\WINNT\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [ProfileWatcher] C:\Program Files\ProfileWatcher\profilewatcher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PEVSystemStart - Unknown owner - cmd /k start /i "/dC:" "C:\ComboFix\HIDEC.exe" "C:\WINNT\system32\CF27170.exe" /c RD /S/Q \$RECYCLE.bin \RECYCLER \RECYCLED (file missing)
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe
O24 - Desktop Component 0: (no name) - http://www.3dwallpaper.com/fg/trinity2k2.jpg

--
End of file - 11320 bytes

======Scheduled tasks folder======

C:\WINNT\tasks\Norton AntiVirus - Scan my computer - Owner.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D1C4E81-A32A-416b-BCDB-33B3EF3617D3}]
Need2Find Bar BHO - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29}]
Comcast Toolbar - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2006-11-07 1821184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 324416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
ST - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
MSNToolBandBHO - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - C:\Program Files\Norton AntiVirus\NavShExt.dll [2004-08-18 210048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{55910916-8B4E-4C1E-9253-CCE296EA71EB}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - MSN - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - C:\Program Files\Norton AntiVirus\NavShExt.dll [2004-08-18 210048]
{4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - Comcast Toolbar - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2006-11-07 1821184]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinTools"=C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe []
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe [2005-09-26 100056]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2004-08-13 58488]
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]
"HostManager"=C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe [2006-09-25 50736]
"AOLDialer"=C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [2006-10-23 71216]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]
"VX3000"=C:\WINNT\vVX3000.exe [2006-06-29 707376]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2006-06-29 269104]
"ProfileWatcher"=C:\Program Files\ProfileWatcher\profilewatcher.exe []
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496]
"ddoctorv2"=C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe [2008-04-24 202560]
""= []
"KernelFaultCheck"=C:\WINNT\system32\dumprep 0 -k []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Program Files\MSN Messenger\msnmsgr.exe [2006-07-29 5354792]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2006-10-13 20058152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\5arqlfks]
C:\WINNT\System32\5arqlfks.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
C:\Program Files\PhoneTools\CapFax.EXE [2001-11-07 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2004-08-13 58488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
C:\Program Files\Common Files\CMEII\CMESys.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadWare]
C:\Program Files\DownloadWare\dw.exe /H []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EbatesMoeMoneyMaker]
wjview /cp:p C:\Program Files\EbatesMoeMoneyMaker\System\Code Main lp: C:\Program Files\EbatesMoeMoneyMaker []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C84 Series]
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE [2003-05-27 99840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eZmmod]
C:\PROGRA~1\ezula\mmod.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
C:\WINNT\GWMDMMSG.exe [2002-08-06 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
C:\WINNT\GWMDMpi.exe [2002-08-06 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Homeland Network]
C:\Program Files\HomelandNetwork\HomelandNetwork.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
C:\WINNT\system32\SK9910DM.EXE [2001-01-03 66048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINNT\System32\hkcmd.exe [2002-09-09 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINNT\System32\igfxtray.exe [2002-09-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
C:\Program Files\Internet Optimizer\optimize.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
C:\Program Files\Kazaa\kazaa.exe /SYSTRAY []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Keyboard Preload Check]
C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:Keyboard Preload Check []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsass]
c:\winnt\ntconfig\windows\bootup\sysconfig\lsass.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Gateway]
C:\Program Files\Media Gateway\MediaGateway.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media-Search]
C:\Program Files\msnet\v9\msnet.EXE /H []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaFace Integration]
C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe [2003-08-18 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaLoads Installer]
C:\Program Files\DownloadWare\dw.exe /H []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [2002-07-16 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
C:\Program Files\Microsoft Money\System\mnyexpr.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe [2004-08-13 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe [2006-07-29 5354792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]
rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PromulGate]
C:\Program Files\DelFin\PromulGate\PgMonitr.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
C:\Program Files\REGSHAVE\REGSHAVE.EXE [2002-02-04 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaveNow]
C:\Program Files\SaveNow\SaveNow.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search-Exe]
C:\Program Files\se\v11\se.EXE /H []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPS]
C:\PROGRA~1\Toolbar\TBPS.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Trvtphw]
C:\Program Files\Cbljuz\Bzwr.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updmgr]
C:\Program Files\Common files\updmgr\updmgr.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebRebates0]
C:\Program Files\Web_Rebates\WebRebates0.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowEnhancer]
C:\Program Files\winex\v2\winex.EXE /U []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
C:\PROGRA~1\AMERIC~2.0\aoltray.exe [2003-08-15 36953]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
C:\PROGRA~1\COMMON~1\GMT\GMT.exe /startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg SchedulerV2.exe]
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\PowerReg SchedulerV2.exe []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

C:\Documents and Settings\Owner\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINNT\system32\igfxsrvc.dll [2002-09-09 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINNT\system32\WgaLogon.dll [2006-06-19 702768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Toolbar\TBPS.exe"="C:\Program Files\Toolbar\TBPS.exe:*:Enabled:WebSearch Toolbar"
"C:\Program Files\Toolbar\PIB.exe"="C:\Program Files\Toolbar\PIB.exe:*:Enabled:WebSearch Toolbar"
"C:\Program Files\Toolbar\TBPSSvc.exe"="C:\Program Files\Toolbar\TBPSSvc.exe:*:Enabled:WebSearch Toolbar Service"
"C:\Program Files\Toolbar\radio.exe"="C:\Program Files\Toolbar\radio.exe:*:Enabled:WebSearch Toolbar Plugin"
"C:\Program Files\Toolbar\WSG.exe"="C:\Program Files\Toolbar\WSG.exe:*:Enabled:WebSearch Toolbar Plugin"
"C:\Program Files\America Online 9.0a\waol.exe"="C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:America Online 9.0a"
"C:\Program Files\Morpheus\Morpheus.exe"="C:\Program Files\Morpheus\Morpheus.exe:*:Enabled:M5Shell"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL Connectivity Service"
"C:\Program Files\Common Files\AOL\1158460677\EE\aolsoftware.exe"="C:\Program Files\Common Files\AOL\1158460677\EE\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\Program Files\Kazaa\kazaa.exe"="C:\Program Files\Kazaa\kazaa.exe:*:Enabled:Kazaa"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

======List of files/folders created in the last 1 months======

2009-07-07 21:27:17 ----D---- C:\rsit
2009-07-06 20:09:02 ----D---- C:\Program Files\ERUNT
2009-07-06 19:36:02 ----SHD---- C:\RECYCLER
2009-07-06 18:37:43 ----D---- C:\WINNT\temp
2009-07-06 18:37:39 ----A---- C:\ComboFix.txt
2009-07-06 18:12:06 ----A---- C:\Boot.bak
2009-07-06 18:11:56 ----RASHD---- C:\cmdcons
2009-07-06 18:08:48 ----A---- C:\WINNT\zip.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWXCACLS.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWSC.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWREG.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\sed.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\PEV.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\NIRCMD.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\grep.exe
2009-07-06 18:08:41 ----D---- C:\WINNT\ERDNT
2009-07-06 18:08:40 ----SD---- C:\ComboFix
2009-07-06 18:08:34 ----D---- C:\Qoobox
2009-07-05 13:25:19 ----A---- C:\WINNT\wininit.ini
2009-07-05 12:39:27 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-07-05 12:39:27 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 12:31:28 ----A---- C:\WINNT\ntbtlog.txt
2009-07-05 12:10:57 ----HDC---- C:\WINNT\$NtUninstallKB956390$
2009-07-05 11:48:57 ----D---- C:\Documents and Settings\All Users\Application Data\Comcast

======List of files/folders modified in the last 1 months======

2009-07-07 21:27:24 ----D---- C:\WINNT\Prefetch
2009-07-07 21:22:06 ----RD---- C:\Program Files
2009-07-07 21:20:27 ----D---- C:\Documents and Settings\Owner\Application Data\ComcastToolbar
2009-07-07 21:13:01 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-07-07 21:10:42 ----D---- C:\WINNT\system32\ias
2009-07-07 21:06:34 ----D---- C:\Program Files\Common Files
2009-07-07 21:05:22 ----A---- C:\WINNT\SchedLgU.Txt
2009-07-07 20:46:13 ----D---- C:\Documents and Settings\Owner\Application Data\Skype
2009-07-06 18:37:45 ----D---- C:\WINNT\system32
2009-07-06 18:37:43 ----AD---- C:\WINNT
2009-07-06 18:33:55 ----RSHD---- C:\WINNT\system32\dllcache
2009-07-06 18:33:40 ----D---- C:\WINNT\system32\CatRoot2
2009-07-06 18:29:20 ----A---- C:\WINNT\system.ini
2009-07-06 18:22:07 ----SD---- C:\WINNT\Downloaded Program Files
2009-07-06 18:18:06 ----D---- C:\WINNT\system32\drivers
2009-07-06 18:18:06 ----D---- C:\WINNT\AppPatch
2009-07-06 18:12:06 ----RASH---- C:\boot.ini
2009-07-05 13:27:47 ----D---- C:\WINNT\isrvs
2009-07-05 12:31:24 ----D---- C:\Config.Msi
2009-07-05 12:24:15 ----HD---- C:\WINNT\inf
2009-07-05 12:17:58 ----D---- C:\Program Files\Internet Explorer
2009-07-05 12:05:55 ----D---- C:\WINNT\system32\CatRoot
2009-07-05 12:00:52 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2009-07-05 11:53:52 ----D---- C:\WINNT\system32\CatRoot_bak
2009-07-05 11:52:34 ----SHD---- C:\WINNT\Installer
2009-07-05 11:52:31 ----D---- C:\WINNT\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINNT\system32\drivers\ialmsbw.sys [2002-09-16 91678]
R1 Cdr4_xp;Cdr4_xp; C:\WINNT\system32\drivers\Cdr4_xp.sys [2003-01-12 61424]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2003-01-12 23420]
R1 intelppm;Intel Processor Driver; C:\WINNT\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton AntiVirus\SAVRTPEL.SYS []
R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0; C:\WINNT\System32\DRIVERS\Sk9920nt.sys [2000-09-12 6208]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R2 ASCTRM;ASCTRM; C:\WINNT\system32\drivers\ASCTRM.sys [2002-12-09 8552]
R2 MASPINT;MASPINT; C:\WINNT\system32\drivers\MASPINT.sys [2000-03-29 8096]
R2 RioPNP;RioPNP; C:\WINNT\system32\drivers\RioPNP.sys [2000-06-06 6736]
R2 symlcbrd;symlcbrd; \??\C:\WINNT\System32\drivers\symlcbrd.sys []
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINNT\system32\drivers\ialmkchw.sys [2002-09-16 71514]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINNT\System32\DRIVERS\e100b325.sys [2002-02-25 139776]
R3 GTWModem;GTW V.92 Voicemodem; C:\WINNT\System32\DRIVERS\GWMDM.sys [2002-08-06 1107680]
R3 ialm;ialm; C:\WINNT\System32\DRIVERS\ialmnt5.sys [2002-09-16 79323]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINNT\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 MxlW2k;MxlW2k; C:\WINNT\system32\drivers\MxlW2k.sys [2003-01-03 28276]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070919.037\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070919.037\NavEx15.Sys []
R3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINNT\system32\drivers\NMSCFG.SYS []
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton AntiVirus\SAVRT.SYS []
R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000; C:\WINNT\System32\DRIVERS\Sk99202k.sys [2000-09-11 7552]
R3 smwdm;smwdm; C:\WINNT\system32\drivers\smwdm.sys [2002-04-04 459944]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINNT\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 wanatw;WAN Miniport (ATW); C:\WINNT\System32\DRIVERS\wanatw4.sys [2003-01-10 33588]
S1 SYMTDI;SYMTDI; C:\WINNT\System32\Drivers\SYMTDI.SYS [2005-04-05 267192]
S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINNT\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 ATWPKT2;ATWPKT2; \??\C:\WINNT\system32\drivers\ATWPKT2.SYS []
S3 BCMModem;BCM V.90 56K Modem; C:\WINNT\System32\DRIVERS\BCMDM.sys [2001-08-17 871388]
S3 Bridge;MAC Bridge; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
S3 BridgeMP;MAC Bridge Miniport; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
S3 catchme;catchme; \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\WINNT\system32\GTNDIS5.SYS []
S3 HidUsb;Microsoft HID Class Driver; C:\WINNT\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Mouse HID Driver; C:\WINNT\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 PCDRDRV;Pcdr Helper Driver; \??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys []
S3 PcdrNt;PcdrNt; C:\WINNT\System32\drivers\PcdrNt.sys [2002-11-21 44192]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service; C:\WINNT\system32\drivers\usbscan.sys [2004-08-04 15104]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 SYMDNS;SYMDNS; C:\WINNT\System32\Drivers\SYMDNS.SYS [2005-04-05 11512]
S3 SYMFW;SYMFW; C:\WINNT\System32\Drivers\SYMFW.SYS [2005-04-05 173208]
S3 SYMIDS;SYMIDS; C:\WINNT\System32\Drivers\SYMIDS.SYS [2005-04-05 36984]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20090707.004\symidsco.sys []
S3 SYMNDIS;SYMNDIS; C:\WINNT\System32\Drivers\SYMNDIS.SYS [2005-04-05 47192]
S3 SYMREDRV;SYMREDRV; C:\WINNT\System32\Drivers\SYMREDRV.SYS [2005-04-05 17976]
S3 usbaudio;USB Audio Driver (WDM); C:\WINNT\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINNT\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 VX3000;VX-3000; C:\WINNT\system32\DRIVERS\VX3000.sys [2006-06-29 1966256]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver; C:\WINNT\System32\DRIVERS\rt2500usb.sys [2004-05-07 79616]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINNT\System32\drivers\ws2ifsl.sys [2002-08-29 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AOL TopSpeedMonitor;AOL TopSpeed Monitor; C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe [2004-10-15 100016]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2004-08-13 197752]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2004-08-13 164984]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; C:\Program Files\Norton AntiVirus\navapsvc.exe [2004-08-18 176768]
R2 NMSSvc;Intel(R) NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
R2 NPFMntor;Norton AntiVirus Firewall Monitor Service; C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe [2004-08-18 46208]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS [2002-08-19 57388]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2005-04-05 206552]
R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2004-07-21 173160]
R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2005-09-26 817304]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINNT\system32\wdfmgr.exe [2005-01-28 38912]
R2 WANMiniportService;WAN Miniport (ATW) Service; C:\WINNT\wanmpsvc.exe [2003-08-27 65536]
S2 AOL ACS;AOL Connectivity Service; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2006-10-23 46640]
S2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-29 187184]
S2 PEVSystemStart;PEVSystemStart; cmd /k start /i /dC: C:\ComboFix\HIDEC.exe C:\WINNT\system32\CF27170.exe /c RD /S/Q \$RECYCLE.bin \RECYCLER \RECYCLED []
S2 SBService;ScriptBlocking Service; C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe [2004-08-18 66688]
S3 ccPwdSvc;Symantec Password Validation; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2004-08-13 78968]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 SAVScan;SAVScan; C:\Program Files\Norton AntiVirus\SAVScan.exe [2004-07-23 197864]
S3 usnsvc;Messenger Sharing USN Journal Reader service; C:\WINNT\system32\svchost.exe [2004-08-04 14336]

-----------------EOF-----------------

Scofield

2009-07-08, 03:31

Log two.....

info.txt logfile of random's system information tool 1.06 2009-07-07 21:27:55

======Uninstall list======

(B) MS-C wordfinder-->"C:\Program Files\msnet\v9\msnet.EXE" /R F
-->C:\WINNT\IsUninst.exe -fC:\WINNT\orun32.isu
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{39DA87A1-0B26-4562-A70C-2A6147366E47}\Setup.exe"
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9F765BD0-B900-4EDE-A90B-61C8A9E95C42}\Setup.exe"
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAD59025-5B73-4E12-B789-0028C5A573C2}\Setup.exe"
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINNT\INF\PCHealth.inf
Adobe Acrobat 5.0-->C:\WINNT\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 9 ActiveX-->C:\WINNT\System32\Macromed\Flash\UninstFl.exe -q
Adobe Reader 7.0.8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
AOL Coach Version 1.0(Build:20030807.3)-->C:\Program Files\Common Files\aolshare\Coach\AolCInUn.exe
AOL Coach Version 2.0(Build:20041026.5 en)-->C:\Program Files\Common Files\AolCoach\en_en\AolCInUn.exe -lang=en_en -ext=UDP
AOL Uninstaller (Choose which Products to Remove)-->C:\Program Files\Common Files\AOL\uninstaller.exe
AOL You've Got Pictures Screensaver-->C:\Program Files\Common Files\AOL\Screensaver\uninst_ygpss.exe
BM Win app-->"C:\Program Files\winex\v2\winex.EXE" /R B
BMSE dbl-->"C:\Program Files\se\v11\se.EXE" /R B
ccCommon-->MsiExec.exe /I{DC367608-64A7-4BF7-92F4-8BAA25BA02DB}
CGI-lid-->"C:\Program Files\winex\v2\winex.EXE" /R W
Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
Comcast Toolbar-->C:\Program Files\ComcastToolbar\uninstall.exe
Creative Jukebox Driver-->C:\Program Files\Creative\Jukebox Driver\DrvUnins.exe /s
DelFin Media Viewer-->C:\WINNT\unvise32.exe C:\Program Files\DelFin\PromulGate\uninstal.log
Desktop Doctor-->MsiExec.exe /I{D87149B3-7A1D-4548-9CBF-032B791E5908}
Do More-->C:\WINNT\IsUninst.exe -f"C:\Program Files\Gateway\Do More\Uninst.isu"
DVD-->"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
Easy CD Creator 5 Platinum-->MsiExec.exe /I{8851E12C-0EF9-11D4-A788-009027ABA5D0}
Enhanced MediaLoads-->"C:\Program Files\MediaLoads Enhanced\install.exe" "C:\Program Files\MediaLoads Enhanced\ME2.DLL",Uninstall
Enhanced search-->"C:\Program Files\winex\v2\winex.EXE" /R S
EPSON Printer Software-->C:\WINNT\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
Film Factory-->C:\WINNT\IsUninst.exe -f"C:\Program Files\EPSON Software\Film Factory\Uninst.isu"
FinePixViewer Ver.4.2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ED4D80-8294-11D5-96CD-0040266301AD}\SETUP.EXE"
FUJIFILM USB Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE"
Gateway Rhapsody-->"C:\Program Files\Gateway Rhapsody\Unwise32.exe" C:\PROGRA~1\GATEWA~1\Install.log
Gateway Rhapsody-->"C:\Program Files\SIFXINST\SIFXINST.EXE" /UnapplyFile 20BBF229-A337-40AD-9FEB-2C98CDA53D1C /Prompt
GTW V.92 Voicemodem-->C:\WINNT\GWMDMU.exe verbose
Help Features-->"C:\Program Files\winex\v2\winex.EXE" /R H
Help Finder-->"C:\Program Files\winex\v2\winex.EXE" /R E
HijackThis 2.0.2-->"C:\Documents and Settings\Owner\Desktop\HijackThis.exe" /uninstall
Homeland Network-->"C:\Program Files\HomelandNetwork\HomelandNetwork.exe" /Uninstall
IE Help-->"C:\Program Files\se\v11\se.EXE" /R F
IE Win-enhancer-->"C:\Program Files\winex\v2\winex.EXE" /R I
IEC system-->"C:\Program Files\se\v11\se.EXE" /R I
ImageMixer VCD2 for FinePix-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{934E9442-D305-4ACF-AD87-A6C11D677CB9}\setup.exe"
Intel(R) PRO Ethernet Adapter and Software-->Prounstl.exe
Intel(R) PROSet II-->MsiExec.exe /I{01A4AEDE-F219-49A2-B855-16A016EAF9A4}
Internet Worm Protection-->MsiExec.exe /I{2908F0CB-C1D4-447F-97A2-CFC135C9F8D4}
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
LimeWire 4.14.8-->"C:\Program Files\LimeWire\uninstall.exe"
LiveReg (Symantec Corporation)-->C:\Program Files\Common Files\Symantec Shared\LiveReg\VCSetup.exe /REMOVE
LiveUpdate 3.0 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
MediaFACE 4.01 Image Library-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{82AF77BC-423D-42DA-BE5B-FFCA04752181} /l1033
MediaFACE 4.01-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{41979C2F-34B8-4F92-8111-B13C5864682D} /l1033
MediaLoads-->"C:\Program Files\MediaLoads\v1\ml.exe" /R
Microsoft .NET Framework (English) v1.0.3705-->C:\WINNT\Microsoft.NET\Framework\Install.exe /u /p Microsoft .NET Framework Full v1.0.3705 (1033)
Microsoft .NET Framework (English)-->MsiExec.exe /X{B43357AA-3A6D-4D94-B56E-43C44D09E548}
Microsoft Encarta Encyclopedia Standard 2003-->MsiExec.exe /I{03410014-3975-4267-9F39-1DC4745090B7}
Microsoft LifeCam-->MsiExec.exe /X{4DEE75B1-B201-4DA3-A50F-007CDB00DA23}
Microsoft Office 2000 Small Business-->MsiExec.exe /I{00030409-78E1-11D2-B60F-006097C998E7}
Microsoft Picture It! Photo 7.0-->MsiExec.exe /I{369B36BE-3D64-4641-9AEA-808D436FE132}
Microsoft Streets and Trips 2002-->MsiExec.exe /I{12BDDF23-B1DB-49C8-92D3-3E6841CCED61}
Microsoft Word 2002-->MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
Microsoft Works 2003 Setup Launcher-->C:\Program Files\Microsoft Works Suite 2003\Setup\Launcher.exe d:\
Microsoft Works 7.0-->MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
Microsoft Works Suite Add-in for Microsoft Word-->MsiExec.exe /I{7EE9DE0D-9228-4C33-B80E-FDD1773600DF}
MicroStaff WINASPI-->C:\MWASPI\uninst.exe
mIRC-->"c:\winnt\ntconfig\windows\bootup\sysconfig\lsass.exe" -uninstall
MS B Help-->"C:\Program Files\msnet\v9\msnet.EXE" /R B
MS IE assistant-->"C:\Program Files\msnet\v9\msnet.EXE" /R I
MS.C help-->"C:\Program Files\msnet\v9\msnet.EXE" /R E
MSN Music Assistant-->rundll32 advpack.dll,LaunchINFSection C:\WINNT\INF\msninst.inf,Uninstall
MSN Toolbar-->C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\mtbs.exe c
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MUSICMATCH Jukebox-->C:\WINNT\IsUninst.exe -f"C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\Uninst.isu" -cC:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.dll
MUSTEK 1200 UB v2.1-->C:\WINNT\TWAIN_32\1200UB\UNINST.EXE
Need2Find Bar-->rundll32 C:\PROGRA~1\NEED2F~1\bar\1.bin\Nd2fnBar.dll,O
NOMAD Jukebox 3 Driver-->C:\Program Files\Creative\Jukebox 3 Drivers\DrvUnins.exe /s
Norton AntiVirus 2005 (Symantec Corporation)-->C:\Program Files\Common Files\Symantec Shared\SymSetup\{C6F5B6CF-609C-428E-876F-CA83176C021B}.exe /X
Norton AntiVirus 2005-->MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
Norton AntiVirus Help-->MsiExec.exe /I{34EEB1F5-E939-40A1-A6BA-957282A4B2C8}
Norton AntiVirus Parent MSI-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton AntiVirus SYMLT MSI-->MsiExec.exe /I{D1FF75E7-DD42-4CFD-B052-20B3FFF4EDB8}
Norton WMI Update-->MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4}
PC-Doctor for Windows-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1F7CCFA3-D926-4882-B2A5-A0217ED25597}\Setup.exe"
PhotoParade Player-->"C:\Program Files\PhotoParade\Uninstall PhotoParade Player.exe" "PhotoParade.exe"
PS/2 Millennium Keyboard-->SKUninst.exe SK_PS2MillenniumKeyboard
QuickTime-->C:\WINNT\unvise32qt.exe C:\WINNT\System32\QuickTime\Uninstall.log
RAW FILE CONVERTER LE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D680C913-5955-469D-9D88-C1940F7506D6}\SETUP.EXE" -l0x9
RealPlayer Basic-->C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
Rhapsody Player Engine-->MsiExec.exe /I{30C2FCD0-FF7B-4FFA-8DDE-43A22E01A1E7}
SE Assistant-->"C:\Program Files\se\v11\se.EXE" /R H
SE Help-->"C:\Program Files\se\v11\se.EXE" /R E
Search Assistant-->"C:\Program Files\se\v11\se.EXE" /R W
Search Function-->"C:\Program Files\se\v11\se.EXE" /R S
Search MS.C-->"C:\Program Files\msnet\v9\msnet.EXE" /R S
Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINNT\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINNT\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)-->"C:\WINNT\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINNT\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINNT\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows Media Player 8 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP8$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)-->"C:\WINNT\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)-->"C:\WINNT\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)-->"C:\WINNT\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)-->"C:\WINNT\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896424)-->"C:\WINNT\$NtUninstallKB896424$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)-->"C:\WINNT\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)-->"C:\WINNT\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)-->"C:\WINNT\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)-->"C:\WINNT\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)-->"C:\WINNT\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)-->"C:\WINNT\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)-->"C:\WINNT\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)-->"C:\WINNT\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)-->"C:\WINNT\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)-->"C:\WINNT\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)-->"C:\WINNT\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911567)-->"C:\WINNT\$NtUninstallKB911567$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)-->"C:\WINNT\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912919)-->"C:\WINNT\$NtUninstallKB912919$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)-->"C:\WINNT\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)-->"C:\WINNT\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)-->"C:\WINNT\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917159)-->"C:\WINNT\$NtUninstallKB917159$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917344)-->"C:\WINNT\$NtUninstallKB917344$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917422)-->"C:\WINNT\$NtUninstallKB917422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)-->"C:\WINNT\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)-->"C:\WINNT\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918899)-->"C:\WINNT\$NtUninstallKB918899$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)-->"C:\WINNT\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)-->"C:\WINNT\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920214)-->"C:\WINNT\$NtUninstallKB920214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)-->"C:\WINNT\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)-->"C:\WINNT\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)-->"C:\WINNT\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921398)-->"C:\WINNT\$NtUninstallKB921398$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)-->"C:\WINNT\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921883)-->"C:\WINNT\$NtUninstallKB921883$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922616)-->"C:\WINNT\$NtUninstallKB922616$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922760)-->"C:\WINNT\$NtUninstallKB922760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)-->"C:\WINNT\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)-->"C:\WINNT\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)-->"C:\WINNT\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINNT\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923694)-->"C:\WINNT\$NtUninstallKB923694$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)-->"C:\WINNT\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924191)-->"C:\WINNT\$NtUninstallKB924191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)-->"C:\WINNT\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)-->"C:\WINNT\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)-->"C:\WINNT\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925454)-->"C:\WINNT\$NtUninstallKB925454$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925486)-->"C:\WINNT\$NtUninstallKB925486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)-->"C:\WINNT\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)-->"C:\WINNT\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)-->"C:\WINNT\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)-->"C:\WINNT\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)-->"C:\WINNT\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928090)-->"C:\WINNT\$NtUninstallKB928090$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)-->"C:\WINNT\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)-->"C:\WINNT\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)-->"C:\WINNT\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929969)-->"C:\WINNT\$NtUninstallKB929969$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)-->"C:\WINNT\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)-->"C:\WINNT\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931768)-->"C:\WINNT\$NtUninstallKB931768$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)-->"C:\WINNT\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)-->"C:\WINNT\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933566)-->"C:\WINNT\$NtUninstallKB933566$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)-->"C:\WINNT\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)-->"C:\WINNT\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)-->"C:\WINNT\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)-->"C:\WINNT\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937143)-->"C:\WINNT\$NtUninstallKB937143$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938127)-->"C:\WINNT\$NtUninstallKB938127$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)-->"C:\WINNT\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB939653)-->"C:\WINNT\$NtUninstallKB939653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)-->"C:\WINNT\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)-->"C:\WINNT\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINNT\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)-->"C:\WINNT\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB942615)-->"C:\WINNT\$NtUninstallKB942615$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)-->"C:\WINNT\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)-->"C:\WINNT\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)-->"C:\WINNT\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944338-v2)-->"C:\WINNT\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944533)-->"C:\WINNT\$NtUninstallKB944533$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)-->"C:\WINNT\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)-->"C:\WINNT\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"C:\WINNT\$NtUninstallKB956390$\spuninst\spuninst.exe"
Select CashBack-->C:\WINNT\vcp41t2q.exe
Shockwave-->C:\WINNT\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINNT\System32\Macromed\SHOCKW~1\Install.log
Sidebar Search-->"C:\Program Files\se\v11\se.EXE" /R R
Skype 2.5-->"C:\Program Files\Skype\Phone\unins000.exe"
SPBBC-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Symantec Script Blocking Installer-->MsiExec.exe /I{D327AFC9-7BAA-473A-8319-6EB7A0D40138}
Symantec-->MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
Update for Windows XP (KB898461)-->"C:\WINNT\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)-->"C:\WINNT\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)-->"C:\WINNT\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)-->"C:\WINNT\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)-->"C:\WINNT\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)-->"C:\WINNT\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)-->"C:\WINNT\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)-->"C:\WINNT\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)-->"C:\WINNT\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB929338)-->"C:\WINNT\$NtUninstallKB929338$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)-->"C:\WINNT\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB931836)-->"C:\WINNT\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update for Windows XP (KB933360)-->"C:\WINNT\$NtUninstallKB933360$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)-->"C:\WINNT\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)-->"C:\WINNT\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)-->"C:\WINNT\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB942840)-->"C:\WINNT\$NtUninstallKB942840$\spuninst\spuninst.exe"
Update for Windows XP (KB946627)-->"C:\WINNT\$NtUninstallKB946627$\spuninst\spuninst.exe"
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
WebSearch Tools-->C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe uninstesies
Win Search-->"C:\Program Files\winex\v2\winex.EXE" /R F
Windows Installer 3.1 (KB893803)-->"C:\WINNT\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{FCE50DB8-C610-4C42-BE5C-193F46C6F812}
Windows Live Sign-in Assistant-->MsiExec.exe /I{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10 Hotfix - KB895316-->"C:\WINNT\$NtUninstallKB895316$\spuninst\spuninst.exe"
Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Hotfix - KB873333-->C:\WINNT\$NtUninstallKB873333$\spuninst\spuninst.exe
Windows XP Hotfix - KB873339-->C:\WINNT\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835-->C:\WINNT\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836-->C:\WINNT\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB885884-->C:\WINNT\$NtUninstallKB885884$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185-->C:\WINNT\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB887472-->C:\WINNT\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP Hotfix - KB888113-->C:\WINNT\$NtUninstallKB888113$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302-->C:\WINNT\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890175-->C:\WINNT\$NtUninstallKB890175$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859-->"C:\WINNT\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Hotfix - KB891781-->C:\WINNT\$NtUninstallKB891781$\spuninst\spuninst.exe
Windows XP Hotfix - KB893066-->"C:\WINNT\$NtUninstallKB893066$\spuninst\spuninst.exe"
Windows XP Hotfix - KB893086-->"C:\WINNT\$NtUninstallKB893086$\spuninst\spuninst.exe"
Windows XP Service Pack 2-->C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.exe
Your MS.C Assistant-->"C:\Program Files\msnet\v9\msnet.EXE" /R H

======Hosts File======

127.0.0.3 www.greg-tut.com
127.0.0.3 nylonsexy.com
127.0.0.3 www.nylonsexy.com
127.0.0.3 vparivalka.com
127.0.0.3 www.vparivalka.comtoescrowpay.com
127.0.0.3 www.awmdabest.com
127.0.0.3 www.sexfiles.nu
127.0.0.3 awmdabest.com
127.0.0.3 sexfiles.nu
127.0.0.3 allforadult.com

======Security center information======

AV: Norton AntiVirus 2005
FW: Norton Internet Worm Protection

======System event log======

Computer Name: CHRISTYNA
Event Code: 7000
Message: The LiveUpdate service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.

Record Number: 75889
Source Name: Service Control Manager
Time Written: 20071114014406.000000-300
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 7009
Message: Timeout (30000 milliseconds) waiting for the LiveUpdate service to connect.

Record Number: 75888
Source Name: Service Control Manager
Time Written: 20071114014405.000000-300
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 10005
Message: DCOM got error "%1053" attempting to start the service LiveUpdate with arguments ""
in order to run the server:
{03E0E6C2-363B-11D3-B536-00902771A435}

Record Number: 75887
Source Name: DCOM
Time Written: 20071114014352.000000-300
Event Type: error
User: CHRISTYNA\Guest

Computer Name: CHRISTYNA
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 75809
Source Name: Tcpip
Time Written: 20071110123648.000000-300
Event Type: warning
User:

Computer Name: CHRISTYNA
Event Code: 10010
Message: The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register with DCOM within the required timeout.

Record Number: 75808
Source Name: DCOM
Time Written: 20071110114312.000000-300
Event Type: error
User: CHRISTYNA\Owner

=====Application event log=====

Computer Name: CHRISTYNA
Event Code: 11
Message: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Record Number: 42575
Source Name: crypt32
Time Written: 20090705123839.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 1002
Message: Hanging application ccApp.exe, version 103.0.1.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 42573
Source Name: Application Hang
Time Written: 20090705122309.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 1002
Message: Hanging application ccApp.exe, version 103.0.1.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 42572
Source Name: Application Hang
Time Written: 20090705122309.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 1000
Message: Faulting application skype.exe, version 2.5.0.151, faulting module skype.exe, version 2.5.0.151, fault address 0x00004302.

Record Number: 42571
Source Name: Application Error
Time Written: 20090705120134.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 56
Message: 6002: LiveUpdate failed because the LiveUpdate package could not be uncompressed.

Make sure your disk is not full and run LiveUpdate again.

Record Number: 42540
Source Name: LiveUpdate
Time Written: 20081206100806.000000-300
Event Type: error
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC-Doctor for Windows\services;C:\Program Files\Common Files\Adaptec Shared\System
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0207
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------

Scofield

2009-07-08, 03:32

ComboFix log......

ComboFix 09-07-06.02 - Owner 07/06/2009 18:14.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.120 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\SLMSS
c:\program files\Common Files\SLMSS\acp1.dat
c:\program files\delfin
c:\program files\MyWay
c:\program files\Need2Find
c:\program files\Need2Find\bar\1.bin\N2FFXTBR.JAR
c:\program files\Need2Find\bar\1.bin\N2NTSTBR.JAR
c:\program files\Need2Find\bar\1.bin\N2PLUGIN.DLL
c:\program files\Need2Find\bar\1.bin\ND2FNBAR.DLL
c:\program files\Need2Find\bar\1.bin\NPND2FN.DLL
c:\program files\Need2Find\bar\1.bin\PARTNER.DAT
c:\program files\Need2Find\bar\Cache\00AA5CCB
c:\program files\Need2Find\bar\Cache\03B8F7E6
c:\program files\Need2Find\bar\Cache\63913770
c:\program files\Need2Find\bar\Cache\files.ini
c:\program files\Need2Find\bar\History\search
c:\program files\Need2Find\bar\Settings\prevcfg.htm
c:\program files\webhancer
c:\program files\webhancer\Programs\webhdll.dll
c:\program files\windows adstatus
c:\winnt\Downloaded Program Files\mediaticketsinstaller.ocx
c:\winnt\hosts
c:\winnt\Readme.txt
c:\winnt\smdat32m.sys
c:\winnt\system32\rk.bin
c:\winnt\Temp\scsE.tmp

.
((((((((((((((((((((((((( Files Created from 2009-06-06 to 2009-07-06 )))))))))))))))))))))))))))))))
.

2009-07-05 16:39 . 2009-07-05 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 16:39 . 2009-07-05 16:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-05 15:48 . 2009-07-05 15:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Comcast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-05 20:55 . 2006-10-20 21:59 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2009-07-05 16:16 . 2007-10-15 20:10 -------- d-----w- c:\documents and settings\Owner\Application Data\ComcastToolbar
2009-07-05 15:47 . 2002-12-10 02:59 -------- d-----w- c:\program files\Common Files\Symantec Shared
2001-10-12 00:22 . 2003-01-05 17:19 53248 ----a-w- c:\program files\ezStub.exe
.

------- Sigcheck -------

[-] 2002-08-29 13:00 12800 0F7D9C87B0CE1FA520473119752C6F79 c:\winnt\$NtServicePackUninstall$\svchost.exe
[7] 2004-08-04 07:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\winnt\ServicePackFiles\i386\svchost.exe
[7] 2004-08-04 07:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\svchost.exe
[7] 2004-08-04 07:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\svchost.exe
[7] 2004-08-04 07:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\winnt\system32\svchost.exe

[7] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\winnt\$hf_mig$\KB890859\SP2GDR\user32.dll
[7] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\winnt\$hf_mig$\KB890859\SP2QFE\user32.dll
[7] 2007-03-08 15:48 578048 7AA4F6C00405DFC4B70ED4214E7D687B c:\winnt\$hf_mig$\KB925902\SP2QFE\user32.dll
[7] 2005-03-02 18:20 561152 74202EB1BD67E8BE9509E38C8D2234B0 c:\winnt\$NtServicePackUninstall$\user32.dll
[7] 2002-11-01 22:26 528896 68E1F4EF02DF52CA9C5E157045D23582 c:\winnt\$NtUninstallKB824141$\user32.dll
[-] 2002-08-29 13:00 560128 DD9269230C21EE8FB7FD3FCCC3B1CFCB c:\winnt\$NtUninstallKB826939$\user32.dll
[7] 2004-08-04 07:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\winnt\$NtUninstallKB890859$\user32.dll
[-] 2003-09-25 16:49 560128 32173306185F603E75C477E117F3BB8D c:\winnt\$NtUninstallKB890859_0$\user32.dll
[7] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\winnt\$NtUninstallKB925902$\user32.dll
[7] 2004-08-04 07:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\winnt\ServicePackFiles\i386\user32.dll
[7] 2004-08-04 07:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\user32.dll
[7] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\user32.dll
[7] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\winnt\system32\user32.dll
[7] 2007-03-08 15:36 577536 B409909F6E2E8A7067076ED748ABF1E7 c:\winnt\system32\dllcache\user32.dll

[7] 2006-05-19 12:15 70656 3748E0FC8C1B6ADA49F98C8E69A4228C c:\winnt\$NtServicePackUninstall$\ws2_32.dll
[-] 2002-08-29 13:00 75264 8529C295DF59B564D37A73B5629162B1 c:\winnt\$NtUninstallKB914388_0$\ws2_32.dll
[7] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\winnt\ServicePackFiles\i386\ws2_32.dll
[7] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ws2_32.dll
[7] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\ws2_32.dll
[7] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\winnt\system32\ws2_32.dll

[7] 2006-06-23 11:25 664576 64CE26DB72810B30F7855EA51E1DF836 c:\winnt\$hf_mig$\KB918899\SP2QFE\wininet.dll
[7] 2006-09-14 08:31 664576 D207370287CF769AEBEBF03837784963 c:\winnt\$hf_mig$\KB922760\SP2QFE\wininet.dll
[7] 2006-10-23 15:34 664576 231EF4179ACABE486376B5CA893F1076 c:\winnt\$hf_mig$\KB925454\SP2QFE\wininet.dll
[7] 2007-01-04 14:05 665088 3FFA1573FC274E5AA7467D03941C45EE c:\winnt\$hf_mig$\KB928090\SP2QFE\wininet.dll
[7] 2007-02-20 09:52 665600 B258C922D22DEEC880B60720531D7627 c:\winnt\$hf_mig$\KB931768\SP2QFE\wininet.dll
[7] 2007-04-18 12:46 665600 4261BA03AFD659DE04F0A17DFBDD454D c:\winnt\$hf_mig$\KB933566\SP2QFE\wininet.dll
[7] 2007-06-26 14:35 665600 E1A3DD68B5380B360A7310A64D9BB188 c:\winnt\$hf_mig$\KB937143\SP2QFE\wininet.dll
[7] 2007-08-22 12:55 665600 A1BC17EB3758D73C3938B2318820F5B4 c:\winnt\$hf_mig$\KB939653\SP2QFE\wininet.dll
[7] 2007-10-11 05:57 666112 80D660A49E0D118144423099B2A9F5DA c:\winnt\$hf_mig$\KB942615\SP2QFE\wininet.dll
[7] 2007-12-07 00:44 666112 085A7C37F9C6EDE1BA870B7DBEC06399 c:\winnt\$hf_mig$\KB944533\SP2QFE\wininet.dll
[7] 2008-08-20 05:33 667648 C91E3A6EF094202F6B5CA8960DFCF243 c:\winnt\$hf_mig$\KB956390\SP2QFE\wininet.dll
[7] 2008-08-20 05:30 666112 9AF5F25124FBDC36E2B510729CBA2674 c:\winnt\$hf_mig$\KB956390\SP3GDR\wininet.dll
[7] 2008-08-20 04:58 666624 94418F53D2612C26DBADC04DAFBC197C c:\winnt\$hf_mig$\KB956390\SP3QFE\wininet.dll
[-] 2006-04-28 14:58 575488 3D5062A7667913B9B515CC5769E9FB31 c:\winnt\$NtServicePackUninstall$\wininet.dll
[-] 2002-08-29 13:00 599040 F3587750A7481DCCBEA13D473A0700BE c:\winnt\$NtUninstallKB890923-IE6SP1-20050225.103456$\wininet.dll
[-] 2005-02-18 20:19 592384 33BDE2B6C11C96969E1CBF894C5980AF c:\winnt\$NtUninstallKB916281-IE6SP1-20060526.162249$\wininet.dll
[7] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\winnt\$NtUninstallKB918899$\wininet.dll
[7] 2006-06-23 11:02 658944 2B4DB890936430C71419037039502752 c:\winnt\$NtUninstallKB922760$\wininet.dll
[7] 2006-09-14 08:39 658944 621AF3F6174A3F60677F5230E28BCC07 c:\winnt\$NtUninstallKB925454$\wininet.dll
[7] 2006-10-23 15:17 658944 6B2735ADFF5A5D3B9130CA4A794722F0 c:\winnt\$NtUninstallKB928090$\wininet.dll
[7] 2007-01-04 13:37 658944 8C393DF5234CBCBFF1EE31902D6B40AE c:\winnt\$NtUninstallKB931768$\wininet.dll
[7] 2007-02-20 09:48 658944 30D1C47E40EFBB792FF8D3C3B51CE507 c:\winnt\$NtUninstallKB933566$\wininet.dll
[7] 2007-04-18 12:31 658944 B7156CD97E739F3014BC4D61758F868A c:\winnt\$NtUninstallKB937143$\wininet.dll
[7] 2007-06-26 14:09 658944 184E47C8F7B331025E6DC92740DB188F c:\winnt\$NtUninstallKB939653$\wininet.dll
[7] 2007-08-22 13:12 658944 1901AD51DA8BE9F8B38D5D526E5D1788 c:\winnt\$NtUninstallKB942615$\wininet.dll
[7] 2007-10-11 06:13 659456 2005AD86A22AEE68E21EE59F9CCB77F2 c:\winnt\$NtUninstallKB944533$\wininet.dll
[7] 2007-12-07 01:07 659456 57D1B5150CF6331FAC6B3E04C1FCB966 c:\winnt\$NtUninstallKB956390$\wininet.dll
[7] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\winnt\ServicePackFiles\i386\wininet.dll
[7] 2008-08-20 05:38 659456 87E694D09893978F22024FEEEDF35342 c:\winnt\SoftwareDistribution\Download\1185bc01976431096846a9c917b224df\sp2gdr\wininet.dll
[7] 2008-08-20 05:33 667648 C91E3A6EF094202F6B5CA8960DFCF243 c:\winnt\SoftwareDistribution\Download\1185bc01976431096846a9c917b224df\sp2qfe\wininet.dll
[7] 2008-08-20 05:30 666112 9AF5F25124FBDC36E2B510729CBA2674 c:\winnt\SoftwareDistribution\Download\1185bc01976431096846a9c917b224df\sp3gdr\wininet.dll
[7] 2008-08-20 04:58 666624 94418F53D2612C26DBADC04DAFBC197C c:\winnt\SoftwareDistribution\Download\1185bc01976431096846a9c917b224df\sp3qfe\wininet.dll
[7] 2004-08-04 07:56 656384 C0823FC5469663BA63E7DB88F9919D70 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\wininet.dll
[7] 2006-10-23 15:17 658944 6B2735ADFF5A5D3B9130CA4A794722F0 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\wininet.dll
[7] 2008-08-20 05:38 659456 87E694D09893978F22024FEEEDF35342 c:\winnt\system32\wininet.dll
[7] 2008-08-20 05:38 659456 87E694D09893978F22024FEEEDF35342 c:\winnt\system32\dllcache\wininet.dll

[-] 2005-03-14 00:55 359808 0E66B538096A6529D1AC66E78EB0D5C8 c:\winnt\$hf_mig$\KB893066\SP2GDR\tcpip.sys
[-] 2005-03-14 01:17 359936 6129E70F3D2F1E60860C930EBEAF92C2 c:\winnt\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[7] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\winnt\$hf_mig$\KB917953\SP2GDR\tcpip.sys
[7] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\winnt\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[7] 2007-10-30 16:53 360832 64798ECFA43D78C7178375FCDD16D8C8 c:\winnt\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[7] 2006-04-20 11:38 340480 B8158E2A6112C0A5CA67BC158FC70218 c:\winnt\$NtServicePackUninstall$\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\winnt\$NtUninstallKB893066$\tcpip.sys
[-] 2002-08-29 13:00 332928 244A2F9816BC9B593957281EF577D976 c:\winnt\$NtUninstallKB893066_0$\tcpip.sys
[-] 2005-02-23 02:00 339968 466CBD4831E80729173654AB2B8C0FEE c:\winnt\$NtUninstallKB917953$\tcpip.sys
[7] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\winnt\$NtUninstallKB941644$\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\winnt\ServicePackFiles\i386\tcpip.sys
[7] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\tcpip.sys
[7] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\tcpip.sys
[7] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\winnt\system32\dllcache\tcpip.sys
[7] 2007-10-30 17:20 360064 90CAFF4B094573449A0872A0F919B178 c:\winnt\system32\drivers\tcpip.sys

[-] 2002-08-29 13:00 516608 2246D8D8F4714A2CEDB21AB9B1849ABB c:\winnt\$NtServicePackUninstall$\winlogon.exe
[7] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\winnt\ServicePackFiles\i386\winlogon.exe
[7] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\winlogon.exe
[7] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\winlogon.exe
[7] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\winnt\system32\winlogon.exe

[-] 2002-08-29 13:00 167552 3B350E5A2A5E951453F3993275A4523A c:\winnt\$NtServicePackUninstall$\ndis.sys
[7] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\winnt\ServicePackFiles\i386\ndis.sys
[7] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ndis.sys
[7] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\ndis.sys
[7] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\winnt\system32\drivers\ndis.sys

[7] 2004-08-04 06:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\winnt\ServicePackFiles\i386\ip6fw.sys
[7] 2004-08-04 06:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ip6fw.sys
[7] 2004-08-04 06:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\ip6fw.sys
[7] 2004-08-04 06:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\winnt\system32\drivers\ip6fw.sys

[7] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\winnt\$hf_mig$\KB890859\SP2GDR\ntkrnlpa.exe
[7] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\winnt\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[7] 2006-12-19 16:12 2059392 BA4B97C00A437C1CC3DA365D93EE1E9D c:\winnt\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
[7] 2007-02-28 09:15 2059392 4D3DBDCCBF97F5BA1E74F322B155C3BA c:\winnt\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
[7] 2005-03-02 00:36 1955840 62C353C0449FD961EF7814973FC2FD30 c:\winnt\$NtServicePackUninstall$\ntkrnlpa.exe
[-] 2002-08-29 13:00 1947904 0E8EFB15746878A9B256E75267337233 c:\winnt\$NtUninstallKB826939$\ntkrnlpa.exe
[7] 2004-08-04 05:58 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\winnt\$NtUninstallKB890859$\ntkrnlpa.exe
[7] 2003-04-24 15:57 1949440 46AE6F2D416C39FFDCFC8BCB01203EA3 c:\winnt\$NtUninstallKB890859_0$\ntkrnlpa.exe
[7] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\winnt\$NtUninstallKB929338$\ntkrnlpa.exe
[7] 2006-12-19 12:55 2057600 1D659BFB788ED2BA45075624B748D249 c:\winnt\$NtUninstallKB931784$\ntkrnlpa.exe
[7] 2007-02-28 08:38 2057600 515D30E2C90A3665A2739309334C9283 c:\winnt\Driver Cache\i386\ntkrnlpa.exe
[7] 2004-08-04 05:58 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\winnt\ServicePackFiles\i386\ntkrnlpa.exe
[7] 2004-08-04 05:58 2056832 947FB1D86D14AFCFFDB54BF837EC25D0 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntkrnlpa.exe
[7] 2005-03-02 00:34 2056832 81013F36B21C7F72CF784CC6731E0002 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\ntkrnlpa.exe
[-] 2008-08-14 09:22 2057728 BA002228743B6824D87F0551DBC86D45 c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP2GDR\ntkrnlpa.exe
[-] 2008-08-14 09:18 2062976 63EC865DFF6CCFC7BEF94B5C50297CAD c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP2QFE\ntkrnlpa.exe
[-] 2008-08-14 09:33 2066048 4AC58F03EB94A72809949D757FC39D80 c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP3GDR\ntkrnlpa.exe
[-] 2008-08-14 20:39 2066048 A25E9B86EFFB2AF33BF51E676B68BFB0 c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP3QFE\ntkrnlpa.exe
[7] 2007-02-28 08:38 2057600 515D30E2C90A3665A2739309334C9283 c:\winnt\system32\ntkrnlpa.exe
[7] 2007-02-28 08:38 2057600 515D30E2C90A3665A2739309334C9283 c:\winnt\system32\dllcache\ntkrnlpa.exe

[7] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\winnt\$hf_mig$\KB890859\SP2GDR\ntoskrnl.exe
[7] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\winnt\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[7] 2006-12-19 16:51 2182016 CEF243F6DEFD20BE4ADDE26C7ECACB54 c:\winnt\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
[7] 2007-02-28 09:55 2182144 5A5C8DB4AA962C714C8371FBDF189FC9 c:\winnt\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
[7] 2005-03-02 01:33 2040832 A15A2EE0BE2F71FC1752A05660B8EBDC c:\winnt\$NtServicePackUninstall$\ntoskrnl.exe
[-] 2002-08-29 13:00 2042240 B9080D97DBD631AADF9128F7316958D2 c:\winnt\$NtUninstallKB826939$\ntoskrnl.exe
[7] 2004-08-04 06:19 2180992 CE218BC7088681FAA06633E218596CA7 c:\winnt\$NtUninstallKB890859$\ntoskrnl.exe
[7] 2003-04-24 15:57 1925760 97EC4AB4650DA6FC521CF16F8A6DDCB0 c:\winnt\$NtUninstallKB890859_0$\ntoskrnl.exe
[7] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\winnt\$NtUninstallKB929338$\ntoskrnl.exe
[7] 2006-12-19 14:17 2180352 8F0DEAB1F81FB83F9C5995853CE48B9F c:\winnt\$NtUninstallKB931784$\ntoskrnl.exe
[7] 2007-02-28 09:10 2180352 582A8DBAA58C3B1F176EB2817DAEE77C c:\winnt\Driver Cache\i386\ntoskrnl.exe
[7] 2004-08-04 06:19 2180992 CE218BC7088681FAA06633E218596CA7 c:\winnt\ServicePackFiles\i386\ntoskrnl.exe
[7] 2004-08-04 06:19 2180992 CE218BC7088681FAA06633E218596CA7 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntoskrnl.exe
[7] 2005-03-02 00:59 2179328 4D4CF2C14550A4B7718E94A6E581856E c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\ntoskrnl.exe
[-] 2008-08-14 10:00 2180352 21C91DA9CB53AA8A37041BA9684A8458 c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP2GDR\ntoskrnl.exe
[-] 2008-08-14 09:57 2185984 CE69DBD54221F2D40E49FF6DB77C6507 c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP2QFE\ntoskrnl.exe
[-] 2008-08-14 10:11 2189184 EEAF32F8E15A24F62BECB1BD403BB5C5 c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP3GDR\ntoskrnl.exe
[-] 2008-08-14 21:11 2189184 31914172342BFF330063F343AC6958FE c:\winnt\SoftwareDistribution\Download\e76b316b6389286fbb342d033e63f1ba\SP3QFE\ntoskrnl.exe
[7] 2007-02-28 09:10 2180352 582A8DBAA58C3B1F176EB2817DAEE77C c:\winnt\system32\ntoskrnl.exe
[7] 2007-02-28 09:10 2180352 582A8DBAA58C3B1F176EB2817DAEE77C c:\winnt\system32\dllcache\ntoskrnl.exe

[7] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\winnt\explorer.exe
[7] 2007-06-13 11:26 1033216 7712DF0CDDE3A5AC89843E61CD5B3658 c:\winnt\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2002-08-29 13:00 1004032 A82B28BFC2E4455FE43022A498C0EF0A c:\winnt\$NtServicePackUninstall$\explorer.exe
[7] 2004-08-04 07:56 1032192 A0732187050030AE399B241436565E64 c:\winnt\$NtUninstallKB938828$\explorer.exe
[7] 2004-08-04 07:56 1032192 A0732187050030AE399B241436565E64 c:\winnt\ServicePackFiles\i386\explorer.exe
[7] 2004-08-04 07:56 1032192 A0732187050030AE399B241436565E64 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe
[7] 2004-08-04 07:56 1032192 A0732187050030AE399B241436565E64 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\explorer.exe
[7] 2007-06-13 10:23 1033216 97BD6515465659FF8F3B7BE375B2EA87 c:\winnt\system32\dllcache\explorer.exe

[-] 2002-08-29 13:00 101376 E3DF4A0252D287C44606EE55355E1623 c:\winnt\$NtServicePackUninstall$\services.exe
[7] 2004-08-04 07:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\winnt\ServicePackFiles\i386\services.exe
[7] 2004-08-04 07:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\services.exe
[7] 2004-08-04 07:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\services.exe
[7] 2004-08-04 07:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\winnt\system32\services.exe

[-] 2002-08-29 13:00 11776 B2B6BA905D0E3F8A32A0EB3B4051807B c:\winnt\$NtServicePackUninstall$\lsass.exe
[7] 2004-08-04 07:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\winnt\ServicePackFiles\i386\lsass.exe
[7] 2004-08-04 07:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lsass.exe
[7] 2004-08-04 07:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\lsass.exe
[7] 2004-08-04 07:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\winnt\system32\lsass.exe

[-] 2002-08-29 13:00 13312 414DE7CF9D3F19C3EA902F1BB38EC116 c:\winnt\$NtServicePackUninstall$\ctfmon.exe
[7] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\winnt\ServicePackFiles\i386\ctfmon.exe
[7] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ctfmon.exe
[7] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\winnt\SoftwareDistribution\Download\7684fcdc5c1747eb53ef3c2d202add11\backup\ctfmon.exe
[7] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\ctfmon.exe
[7] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\winnt\system32\ctfmon.exe

[7] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\winnt\$hf_mig$\KB896423\SP2GDR\spoolsv.exe
[7] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\winnt\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[7] 2005-06-10 23:55 53248 6B4BF97957A0B8795811975D4BF1ACFE c:\winnt\$NtServicePackUninstall$\spoolsv.exe
[7] 2004-08-04 07:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\winnt\$NtUninstallKB896423$\spoolsv.exe
[-] 2002-08-29 13:00 51200 9B4155BA58192D4073082B8FC5D42612 c:\winnt\$NtUninstallKB896423_0$\spoolsv.exe
[7] 2004-08-04 07:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\winnt\ServicePackFiles\i386\spoolsv.exe
[7] 2004-08-04 07:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spoolsv.exe
[7] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\spoolsv.exe
[7] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\winnt\system32\spoolsv.exe

[7] 2004-08-04 07:56 111104 4126D27CECE4471E00E425411F7306B5 c:\winnt\ServicePackFiles\i386\wuauclt.exe
[7] 2004-08-04 07:56 111104 4126D27CECE4471E00E425411F7306B5 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\wuauclt.exe
[7] 2004-08-04 07:56 111104 4126D27CECE4471E00E425411F7306B5 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\wuauclt.exe
[7] 2008-10-16 19:09 51224 E654B78D2F1D791B30D0ED9A8195EC22 c:\winnt\system32\wuauclt.exe
[7] 2008-10-16 19:09 51224 E654B78D2F1D791B30D0ED9A8195EC22 c:\winnt\system32\dllcache\wuauclt.exe

[-] 2002-08-29 13:00 22016 E931E0A2B8BF0019DB902E98D03662CB c:\winnt\$NtServicePackUninstall$\userinit.exe
[7] 2004-08-04 07:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\winnt\ServicePackFiles\i386\userinit.exe
[7] 2004-08-04 07:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\userinit.exe
[7] 2004-08-04 07:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\userinit.exe
[7] 2004-08-04 07:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\winnt\system32\userinit.exe

[-] 2002-08-29 13:00 200192 FE84E045A09A4ABC4DEEF7270448B64E c:\winnt\$NtServicePackUninstall$\termsrv.dll
[7] 2004-08-04 07:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\winnt\ServicePackFiles\i386\termsrv.dll
[7] 2004-08-04 07:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\termsrv.dll
[7] 2004-08-04 07:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\termsrv.dll
[7] 2004-08-04 07:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\winnt\system32\termsrv.dll

[7] 2006-07-05 10:57 985088 0FDD84928A5DDE2510761B7EC76CCEC9 c:\winnt\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[7] 2007-04-16 16:07 986112 09F7CB3687F86EDAA4CA081F7AB66C03 c:\winnt\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2002-08-29 13:00 930304 8F162DC91D67D87C1A481BF602A9DAC8 c:\winnt\$NtServicePackUninstall$\kernel32.dll
[7] 2004-08-04 07:56 983552 888190E31455FAD793312F8D087146EB c:\winnt\$NtUninstallKB917422$\kernel32.dll
[7] 2006-07-05 10:55 984064 D8DB5397DE07577C1CB50BA6D23B3AD4 c:\winnt\$NtUninstallKB935839$\kernel32.dll
[7] 2004-08-04 07:56 983552 888190E31455FAD793312F8D087146EB c:\winnt\ServicePackFiles\i386\kernel32.dll
[7] 2004-08-04 07:56 983552 888190E31455FAD793312F8D087146EB c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\kernel32.dll
[7] 2006-07-05 10:55 984064 D8DB5397DE07577C1CB50BA6D23B3AD4 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\kernel32.dll
[7] 2007-04-16 15:52 984576 A01F9CA902A88F7CED06884174D6419D c:\winnt\system32\kernel32.dll
[7] 2007-04-16 15:52 984576 A01F9CA902A88F7CED06884174D6419D c:\winnt\system32\dllcache\kernel32.dll

[-] 2002-08-29 13:00 14848 865AD7CCB20856727D5BD994B094DC5E c:\winnt\$NtServicePackUninstall$\powrprof.dll
[7] 2004-08-04 07:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\winnt\ServicePackFiles\i386\powrprof.dll
[7] 2004-08-04 07:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\powrprof.dll
[7] 2004-08-04 07:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\powrprof.dll
[7] 2004-08-04 07:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\winnt\system32\powrprof.dll

[-] 2002-08-29 13:00 103936 C9F9E3E6B59C6D6CBCE7F14494A4518A c:\winnt\$NtServicePackUninstall$\imm32.dll
[7] 2004-08-04 07:56 110080 87CA7CE6469577F059297B9D6556D66D c:\winnt\ServicePackFiles\i386\imm32.dll
[7] 2004-08-04 07:56 110080 87CA7CE6469577F059297B9D6556D66D c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\imm32.dll
[7] 2004-08-04 07:56 110080 87CA7CE6469577F059297B9D6556D66D c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\imm32.dll
[7] 2004-08-04 07:56 110080 87CA7CE6469577F059297B9D6556D66D c:\winnt\system32\imm32.dll

[-] 2002-08-29 13:00 1157632 2564949DBE5F643F50913BBE45D346E2 c:\winnt\$NtServicePackUninstall$\sfcfiles.dll
[7] 2004-08-04 07:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\winnt\ServicePackFiles\i386\sfcfiles.dll
[7] 2004-08-04 07:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\sfcfiles.dll
[7] 2004-08-04 07:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\sfcfiles.dll
[7] 2004-08-04 07:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\winnt\system32\sfcfiles.dll

[-] 2002-08-29 07:27 23424 1E7F78C2FC393356CD884C6FDE7966F9 c:\winnt\$NtServicePackUninstall$\kbdclass.sys
[7] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\winnt\ServicePackFiles\i386\kbdclass.sys
[7] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\winnt\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\kbdclass.sys
[7] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\winnt\SoftwareDistribution\Download\79123dd72d0f61d4ed8c7a816ed338d7\backup\kbdclass.sys
[7] 2004-08-04 05:58 24576 EBDEE8A2EE5393890A1ACEE971C4C246 c:\winnt\system32\drivers\kbdclass.sys
[-] 2002-08-29 13:00 23424 1E7F78C2FC393356CD884C6FDE7966F9 c:\winnt\system32\ReinstallBackups\0000\DriverFiles\i386\kbdclass.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2006-07-29 5354792]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-10-13 20058152]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2005-09-27 100056]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-08-13 58488]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2002-12-10 26112]
"HostManager"="c:\program files\Common Files\AOL\1158460677\ee\AOLSoftware.exe" [2006-09-26 50736]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-17 98304]
"VX3000"="c:\winnt\vVX3000.exe" [2006-06-29 707376]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 269104]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\winnt\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\GStartup.lnk
backup=c:\winnt\pss\GStartup.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\PowerReg Scheduler.exe
backup=c:\winnt\pss\PowerReg Scheduler.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg SchedulerV2.exe]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\PowerReg SchedulerV2.exe
backup=c:\winnt\pss\PowerReg SchedulerV2.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0a\\waol.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msncall.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158460677\\EE\\aolsoftware.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23136:TCP"= 23136:TCP:BitComet 23136 TCP
"23136:UDP"= 23136:UDP:BitComet 23136 UDP

S2 RioPNP;RioPNP;c:\winnt\system32\drivers\RioPnP.sys [12/9/2002 10:59 PM 6736]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\Qctest\PCDoc\PCDRDRV.sys --> c:\atf\Qctest\PCDoc\PCDRDRV.sys [?]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;c:\winnt\system32\drivers\usbscan.sys [4/20/2003 9:05 PM 15104]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\winnt\system32\drivers\rt2500usb.sys [9/14/2006 11:50 PM 79616]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NMSSVC
.
Contents of the 'Scheduled Tasks' folder

2008-04-12 c:\winnt\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\Navw32.exe [2004-08-18 07:44]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-WinTools - c:\progra~1\COMMON~1\WinTools\WToolsA.exe
HKLM-Run-ProfileWatcher - c:\program files\ProfileWatcher\profilewatcher.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/
mStart Page = hxxp://www.comcast.net/
mSearch Bar = about:blank
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-06 18:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(576)
c:\winnt\system32\COMRes.dll
c:\winnt\system32\l3codecx.acm
.
Completion time: 2009-07-06 18:37
ComboFix-quarantined-files.txt 2009-07-06 22:37

Pre-Run: 22,585,544,704 bytes free
Post-Run: 22,911,782,912 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

367 --- E O F --- 2008-03-01 08:04

katana

2009-07-08, 13:06

Information
Right, there is a lot to get rid of there !!!

----------------------------------------------------------------------------------------
Step 1

Remove Programs

Older versions of some programs have vulnerabilities that malware can use to infect your system.

Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) .
If any of the following programs are still listed there, click on the program to highlight it, and click on remove.
(Don't worry if there are any errors, just uninstall what you can)

(B) MS-C wordfinder
BM Win app
BMSE dbl
CGI-lid
Enhanced MediaLoads
Enhanced search
Help Features
Help Finder
Homeland Network
IE Help
IE Win-enhancer
IEC system
MediaLoads
MS B Help
MS IE assistant
MS.C help
Need2Find Bar
SE Assistant
SE Help
Search Assistant
Search Function
Search MS.C
Select CashBack
Sidebar Search
WebSearch Tools
Win Search
Your MS.C Assistant
Now close the Control Panel.

----------------------------------------------------------------------------------------
Step 2

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If requested, please reboot
If you accidently close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

----------------------------------------------------------------------------------------
Step 3

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
C:\WINNT\System32\5arqlfks.exe
Folder::
C:\Program Files\RXToolBar
C:\Program Files\Common Files\CMEII
C:\Program Files\DownloadWare
C:\Program Files\EbatesMoeMoneyMaker
C:\PROGRA~1\ezula\
C:\Program Files\HomelandNetwork
C:\Program Files\Internet Optimizer
C:\Program Files\Kazaa
C:\Program Files\Media Gateway
C:\Program Files\msnet
C:\PROGRA~1\NEWDOT~1
C:\Program Files\DelFin
C:\Program Files\SaveNow
C:\Program Files\se
C:\PROGRA~1\Toolbar
C:\Program Files\Cbljuz
C:\Program Files\Common files\updmgr
C:\Program Files\Web_Rebates
C:\Program Files\winex
C:\Program Files\Morpheus
C:\Program Files\Kazaa
C:\Program Files\LimeWire
Registry::
[-KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D1C4E81-A32A-416b-BCDB-33B3EF3617D3}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"WinTools"=-
"ProfileWatcher"=-
""=-
"KernelFaultCheck"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\5arqlfks]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadWare]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EbatesMoeMoneyMaker]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eZmmod]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Homeland Network]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Internet Optimizer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lsass]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media Gateway]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Media-Search]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaLoads Installer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PromulGate]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SaveNow]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search-Exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPS]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Trvtphw]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updmgr]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebRebates0]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowEnhancer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTools]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^GStartup.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^PowerReg SchedulerV2.exe]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Toolbar\TBPS.exe"=-
"C:\Program Files\Toolbar\PIB.exe"=-
"C:\Program Files\Toolbar\TBPSSvc.exe"=-
"C:\Program Files\Toolbar\radio.exe"=-
"C:\Program Files\Toolbar\WSG.exe"=-
"C:\Program Files\Morpheus\Morpheus.exe"=-
"C:\Program Files\Kazaa\kazaa.exe"=-
"C:\Program Files\LimeWire\LimeWire.exe"=-
ADS::
Save this as CFScript.txt and place it on your desktop.

http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

----------------------------------------------------------------------------------------
Step 4

Fix With HJT

Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
R3 - URLSearchHook: (no name) - _{9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O3 - Toolbar: (no name) - {55910916-8B4E-4C1E-9253-CCE296EA71EB} - (no file)

O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [ProfileWatcher] C:\Program Files\ProfileWatcher\profilewatcher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM

O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll

O24 - Desktop Component 0: (no name) - http://www.3dwallpaper.com/fg/trinity2k2.jpg
- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

MalwareBytes Log
Combofix Log
A Fresh RSIT log
How are things running now ?

Scofield

2009-07-10, 01:09

Hi Katana and thanks again, you're the best! Okay, the add/remove progams wouldn't let me remove most of what was posted. Following are the logs requested. Please let me know if I skipped a step or erred in any way. Thanks again!

Malwarbytes log:

Malwarebytes' Anti-Malware 1.38
Database version: 2397
Windows 5.1.2600 Service Pack 2

7/9/2009 6:56:43 AM
mbam-log-2009-07-09 (06-56-43).txt

Scan type: Full Scan (C:\|)
Objects scanned: 153616
Time elapsed: 3 hour(s), 26 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 14
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\mp.mediapops (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mp.mediapops.1 (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\rxresult.rxresultfilter (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\rxresult.rxresultfilter.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4438a5dc-e00b-41a0-b0e6-b63fd3b86eee} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2ab289ae-4b90-4281-b2ae-1f4bb034b647} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3} (Adware.Need2Find) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{4767c447-ef15-42f2-8809-68adb7fa76f1} (Adware.Delphinmediaviewer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3} (Adware.Need2Find) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3} (Adware.Need2Find) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaLoads (Adware.Medload) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\system volume information\_restore{30f71744-7195-4a81-bc43-76afe6b4af0f}\RP1692\A0129480.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
c:\system volume information\_restore{30f71744-7195-4a81-bc43-76afe6b4af0f}\RP1692\A0129481.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
c:\system volume information\_restore{30f71744-7195-4a81-bc43-76afe6b4af0f}\RP1692\A0129484.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
c:\system volume information\_restore{30f71744-7195-4a81-bc43-76afe6b4af0f}\RP1692\A0129486.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
c:\WINNT\ntconfig\windows\bootup\sysconfig\Libparse.exe (Malware.Tool) -> Quarantined and deleted successfully.

Scofield

2009-07-10, 01:10

Combofix log:

ComboFix 09-07-09.04 - Owner 07/09/2009 18:09.1.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.110 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

FILE ::
"c:\winnt\System32\5arqlfks.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Cbljuz
c:\program files\HomelandNetwork
c:\program files\Kazaa
c:\program files\Kazaa\My Shared Folder\kazaa327_en.exe
c:\program files\LimeWire
c:\program files\LimeWire\clink.jar.tmp
c:\program files\LimeWire\commons-httpclient.jar.tmp
c:\program files\LimeWire\commons-logging.jar.tmp
c:\program files\LimeWire\commons-net.jar.tmp
c:\program files\LimeWire\commons-pool.jar.tmp
c:\program files\LimeWire\daap.jar.tmp
c:\program files\LimeWire\foxtrot.jar.tmp
c:\program files\LimeWire\httpcore-nio.jar.tmp
c:\program files\LimeWire\httpcore.jar.tmp
c:\program files\LimeWire\icu4j.jar.tmp
c:\program files\LimeWire\id3v2.jar.tmp
c:\program files\LimeWire\Incomplete\downloads.bak
c:\program files\LimeWire\Incomplete\downloads.dat
c:\program files\LimeWire\Incomplete\T-3634612-Shaggy - It Wasn't Me.mp3
c:\program files\LimeWire\Incomplete\T-5448118-Shaggy - It Wasnt Me.mp3
c:\program files\LimeWire\Incomplete\T-5452552-Shaggy- It Wasn't Me .mp3
c:\program files\LimeWire\Incomplete\T-5452552-Shaggy - It Wasnt Me.mp3
c:\program files\LimeWire\Incomplete\T-9107646-Shaggy - It Wasnt Me.mp3
c:\program files\LimeWire\jcraft.jar.tmp
c:\program files\LimeWire\jdic.jar.tmp
c:\program files\LimeWire\jdic_stub.jar.tmp
c:\program files\LimeWire\jl011.jar.tmp
c:\program files\LimeWire\jmdns.jar.tmp
c:\program files\LimeWire\LimeWire.jar.tmp
c:\program files\LimeWire\log4j.jar.tmp
c:\program files\LimeWire\looks.jar.tmp
c:\program files\LimeWire\MessagesBundles.jar.tmp
c:\program files\LimeWire\mp3sp14.jar.tmp
c:\program files\LimeWire\ProgressTabs.jar.tmp
c:\program files\LimeWire\themes.jar.tmp
c:\program files\LimeWire\tritonus.jar.tmp
c:\program files\LimeWire\vorbis.jar.tmp
c:\program files\Morpheus
c:\program files\Morpheus\current.dat
c:\program files\Morpheus\Get 250 Dollars Free- Golden Tiger Casino.ico
c:\program files\Morpheus\morpheustoolbar.exe
c:\program files\Morpheus\PokerRewards.ico
c:\program files\Morpheus\update.exe
c:\program files\msnet
c:\program files\msnet\Data\app.dat
c:\program files\msnet\Data\bm.dat
c:\program files\se
c:\program files\se\Data\app.dat
c:\program files\se\Data\bm.dat
c:\program files\winex
c:\program files\winex\Data\app.dat
c:\program files\winex\Data\bm.dat

.
((((((((((((((((((((((((( Files Created from 2009-06-09 to 2009-07-09 )))))))))))))))))))))))))))))))
.

2009-07-09 01:54 . 2009-07-09 01:54 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-07-09 01:53 . 2009-06-17 15:27 38160 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-07-09 01:53 . 2009-07-09 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-09 01:53 . 2009-07-09 01:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-09 01:53 . 2009-06-17 15:27 19096 ----a-w- c:\winnt\system32\drivers\mbam.sys
2009-07-08 01:27 . 2009-07-08 01:27 -------- d-----w- C:\rsit
2009-07-07 00:09 . 2009-07-07 00:09 -------- d-----w- c:\program files\ERUNT
2009-07-05 16:39 . 2009-07-08 01:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 16:39 . 2009-07-05 16:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-05 15:48 . 2009-07-05 15:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Comcast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-09 21:59 . 2007-10-15 20:10 -------- d-----w- c:\documents and settings\Owner\Application Data\ComcastToolbar
2009-07-09 21:58 . 2006-10-20 21:59 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2009-07-09 21:53 . 2002-12-10 02:59 -------- d-----w- c:\program files\Common Files\Symantec Shared
2001-10-12 00:22 . 2003-01-05 17:19 53248 ----a-w- c:\program files\ezStub.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2005-09-27 100056]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-08-13 58488]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2002-12-10 26112]
"HostManager"="c:\program files\Common Files\AOL\1158460677\ee\AOLSoftware.exe" [2006-09-26 50736]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-17 98304]
"VX3000"="c:\winnt\vVX3000.exe" [2006-06-29 707376]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 269104]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\winnt\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0a\\waol.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\msncall.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158460677\\EE\\aolsoftware.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23136:TCP"= 23136:TCP:BitComet 23136 TCP
"23136:UDP"= 23136:UDP:BitComet 23136 UDP

R2 RioPNP;RioPNP;c:\winnt\system32\drivers\RioPnP.sys [12/9/2002 10:59 PM 6736]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\Qctest\PCDoc\PCDRDRV.sys --> c:\atf\Qctest\PCDoc\PCDRDRV.sys [?]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;c:\winnt\system32\drivers\usbscan.sys [4/20/2003 9:05 PM 15104]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\winnt\system32\drivers\rt2500usb.sys [9/14/2006 11:50 PM 79616]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NMSCFG
*NewlyCreated* - NMSSVC
.
Contents of the 'Scheduled Tasks' folder

2008-04-12 c:\winnt\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\Navw32.exe [2004-08-18 07:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.comcast.net/
mSearch Bar = about:blank
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
IE: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-09 18:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\winnt\system32\l3codecx.acm
.
Completion time: 2009-07-09 18:28
ComboFix-quarantined-files.txt 2009-07-09 22:28
ComboFix2.txt 2009-07-06 22:37

Pre-Run: 24,595,222,528 bytes free
Post-Run: 24,573,616,128 bytes free

171 --- E O F --- 2008-03-01 08:04

Scofield

2009-07-10, 01:11

RSIT log:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Owner at 2009-07-09 19:10:51
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 23 GB (60%) free of 39 GB
Total RAM: 254 MB (15% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:08 PM, on 7/9/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
c:\program files\common files\aol\1158460677\ee\aolsoftware.exe
C:\WINNT\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Desktop\RSIT.exe
C:\Documents and Settings\Owner\Desktop\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 127.0.0.3 www.greg-tut.com
O1 - Hosts: 127.0.0.3 nylonsexy.com
O1 - Hosts: 127.0.0.3 www.nylonsexy.com
O1 - Hosts: 127.0.0.3 vparivalka.com
O1 - Hosts: 127.0.0.3 www.vparivalka.comtoescrowpay.com
O1 - Hosts: 127.0.0.3 www.awmdabest.com
O1 - Hosts: 127.0.0.3 www.sexfiles.nu
O1 - Hosts: 127.0.0.3 awmdabest.com
O1 - Hosts: 127.0.0.3 sexfiles.nu
O1 - Hosts: 127.0.0.3 allforadult.com
O1 - Hosts: 127.0.0.3 www.allforadult.com
O1 - Hosts: 127.0.0.3 www.iframe.biz
O1 - Hosts: 127.0.0.3 www.newiframe.biz
O1 - Hosts: 127.0.0.3 newiframe.biz
O1 - Hosts: 127.0.0.3 www.vesbiz.biz
O1 - Hosts: 127.0.0.3 vesbiz.biz
O1 - Hosts: 127.0.0.3 www.pizdato.biz
O1 - Hosts: 127.0.0.3 pizdato.biz
O1 - Hosts: 127.0.0.3 www.aaasexypics.com
O1 - Hosts: 127.0.0.3 aaasexypics.com
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net
O1 - Hosts: 127.0.0.3 virgin-tgp.net
O1 - Hosts: 127.0.0.3 www.awmcash.biz
O1 - Hosts: 127.0.0.3 awmcash.biz
O1 - Hosts: 127.0.0.3 buldog-stats.com
O1 - Hosts: 127.0.0.3 www.buldog-stats.com
O1 - Hosts: 127.0.0.3 fregat.drocherway.com
O1 - Hosts: 127.0.0.3 slutmania.biz
O1 - Hosts: 127.0.0.3 www.slutmania.biz
O1 - Hosts: 127.0.0.3 toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com
O1 - Hosts: 127.0.0.3 www.megapornix.com
O1 - Hosts: 127.0.0.3 megapornix.com
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz
O1 - Hosts: 127.0.0.3 sp2fucked.biz
O1 - Hosts: 207.68.176.250 auto.search.msn.com
O1 - Hosts: 64.12.152.18 search.netscape.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VX3000] C:\WINNT\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe

--
End of file - 9711 bytes

======Scheduled tasks folder======

C:\WINNT\tasks\Norton AntiVirus - Scan my computer - Owner.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29}]
Comcast Toolbar - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2006-11-07 1821184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 324416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
ST - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
MSNToolBandBHO - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
CNavExtBho Class - C:\Program Files\Norton AntiVirus\NavShExt.dll [2004-08-18 210048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - MSN - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Norton AntiVirus - C:\Program Files\Norton AntiVirus\NavShExt.dll [2004-08-18 210048]
{4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - Comcast Toolbar - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2006-11-07 1821184]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Monitor"=C:\PROGRA~1\SYMNET~1\SNDMon.exe [2005-09-26 100056]
"ccApp"=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2004-08-13 58488]
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]
"HostManager"=C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe [2006-09-25 50736]
"AOLDialer"=C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [2006-10-23 71216]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]
"VX3000"=C:\WINNT\vVX3000.exe [2006-06-29 707376]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2006-06-29 269104]
"ddoctorv2"=C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe [2008-04-24 202560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
C:\Program Files\PhoneTools\CapFax.EXE [2001-11-07 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2004-08-13 58488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C84 Series]
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE [2003-05-27 99840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
C:\WINNT\GWMDMMSG.exe [2002-08-06 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
C:\WINNT\GWMDMpi.exe [2002-08-06 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
C:\WINNT\system32\SK9910DM.EXE [2001-01-03 66048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINNT\System32\hkcmd.exe [2002-09-09 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINNT\System32\igfxtray.exe [2002-09-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Keyboard Preload Check]
C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:Keyboard Preload Check []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaFace Integration]
C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe [2003-08-18 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [2002-07-16 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe [2004-08-13 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe [2006-07-29 5354792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
C:\PROGRA~1\AMERIC~2.0\aoltray.exe [2003-08-15 36953]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

C:\Documents and Settings\Owner\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINNT\system32\igfxsrvc.dll [2002-09-09 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINNT\system32\WgaLogon.dll [2006-06-19 702768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\America Online 9.0a\waol.exe"="C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:America Online 9.0a"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL Connectivity Service"
"C:\Program Files\Common Files\AOL\1158460677\EE\aolsoftware.exe"="C:\Program Files\Common Files\AOL\1158460677\EE\aolsoftware.exe:*:Enabled:AOL Shared Components"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

======List of files/folders created in the last 1 months======

2009-07-09 19:10:46 ----SHD---- C:\RECYCLER
2009-07-09 18:28:38 ----D---- C:\WINNT\temp
2009-07-09 18:28:31 ----A---- C:\ComboFix.txt
2009-07-08 21:54:08 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2009-07-08 21:53:56 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-07-08 21:53:55 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-07-07 21:27:17 ----D---- C:\rsit
2009-07-06 20:09:02 ----D---- C:\Program Files\ERUNT
2009-07-06 18:12:06 ----A---- C:\Boot.bak
2009-07-06 18:11:56 ----RASHD---- C:\cmdcons
2009-07-06 18:08:48 ----A---- C:\WINNT\zip.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWXCACLS.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWSC.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWREG.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\sed.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\PEV.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\NIRCMD.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\grep.exe
2009-07-06 18:08:41 ----D---- C:\WINNT\ERDNT
2009-07-06 18:08:34 ----D---- C:\Qoobox
2009-07-05 13:25:19 ----A---- C:\WINNT\wininit.ini
2009-07-05 12:39:27 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-07-05 12:39:27 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 12:31:28 ----A---- C:\WINNT\ntbtlog.txt
2009-07-05 12:10:57 ----HDC---- C:\WINNT\$NtUninstallKB956390$
2009-07-05 11:48:57 ----D---- C:\Documents and Settings\All Users\Application Data\Comcast

======List of files/folders modified in the last 1 months======

2009-07-09 19:06:48 ----RD---- C:\Program Files
2009-07-09 18:54:57 ----D---- C:\WINNT\Prefetch
2009-07-09 18:51:33 ----D---- C:\Documents and Settings\Owner\Application Data\ComcastToolbar
2009-07-09 18:28:44 ----D---- C:\WINNT\system32
2009-07-09 18:28:38 ----AD---- C:\WINNT
2009-07-09 18:21:39 ----A---- C:\WINNT\system.ini
2009-07-09 18:16:33 ----D---- C:\WINNT\system32\drivers
2009-07-09 18:16:33 ----D---- C:\WINNT\AppPatch
2009-07-09 18:16:20 ----D---- C:\Program Files\Common Files
2009-07-09 18:15:17 ----D---- C:\WINNT\system32\CatRoot2
2009-07-09 18:08:10 ----A---- C:\WINNT\SchedLgU.Txt
2009-07-09 17:58:30 ----D---- C:\Documents and Settings\Owner\Application Data\Skype
2009-07-09 17:53:23 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-07-09 17:46:42 ----D---- C:\WINNT\system32\ias
2009-07-06 18:33:55 ----RSHD---- C:\WINNT\system32\dllcache
2009-07-06 18:22:07 ----SD---- C:\WINNT\Downloaded Program Files
2009-07-06 18:12:06 ----RASH---- C:\boot.ini
2009-07-05 13:27:47 ----D---- C:\WINNT\isrvs
2009-07-05 12:31:24 ----D---- C:\Config.Msi
2009-07-05 12:24:15 ----HD---- C:\WINNT\inf
2009-07-05 12:17:58 ----D---- C:\Program Files\Internet Explorer
2009-07-05 12:05:55 ----D---- C:\WINNT\system32\CatRoot
2009-07-05 12:00:52 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2009-07-05 11:53:52 ----D---- C:\WINNT\system32\CatRoot_bak
2009-07-05 11:52:34 ----SHD---- C:\WINNT\Installer
2009-07-05 11:52:31 ----D---- C:\WINNT\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINNT\system32\drivers\ialmsbw.sys [2002-09-16 91678]
R1 Cdr4_xp;Cdr4_xp; C:\WINNT\system32\drivers\Cdr4_xp.sys [2003-01-12 61424]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2003-01-12 23420]
R1 intelppm;Intel Processor Driver; C:\WINNT\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton AntiVirus\SAVRTPEL.SYS []
R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0; C:\WINNT\System32\DRIVERS\Sk9920nt.sys [2000-09-12 6208]
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R2 ASCTRM;ASCTRM; C:\WINNT\system32\drivers\ASCTRM.sys [2002-12-09 8552]
R2 MASPINT;MASPINT; C:\WINNT\system32\drivers\MASPINT.sys [2000-03-29 8096]
R2 RioPNP;RioPNP; C:\WINNT\system32\drivers\RioPNP.sys [2000-06-06 6736]
R2 symlcbrd;symlcbrd; \??\C:\WINNT\System32\drivers\symlcbrd.sys []
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINNT\system32\drivers\ialmkchw.sys [2002-09-16 71514]
R3 catchme;catchme; \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys []
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINNT\System32\DRIVERS\e100b325.sys [2002-02-25 139776]
R3 GTWModem;GTW V.92 Voicemodem; C:\WINNT\System32\DRIVERS\GWMDM.sys [2002-08-06 1107680]
R3 ialm;ialm; C:\WINNT\System32\DRIVERS\ialmnt5.sys [2002-09-16 79323]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINNT\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 MxlW2k;MxlW2k; C:\WINNT\system32\drivers\MxlW2k.sys [2003-01-03 28276]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070919.037\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070919.037\NavEx15.Sys []
R3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINNT\system32\drivers\NMSCFG.SYS []
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton AntiVirus\SAVRT.SYS []
R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000; C:\WINNT\System32\DRIVERS\Sk99202k.sys [2000-09-11 7552]
R3 smwdm;smwdm; C:\WINNT\system32\drivers\smwdm.sys [2002-04-04 459944]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINNT\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 wanatw;WAN Miniport (ATW); C:\WINNT\System32\DRIVERS\wanatw4.sys [2003-01-10 33588]
S1 SYMTDI;SYMTDI; C:\WINNT\System32\Drivers\SYMTDI.SYS [2005-04-05 267192]
S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINNT\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 BCMModem;BCM V.90 56K Modem; C:\WINNT\System32\DRIVERS\BCMDM.sys [2001-08-17 871388]
S3 Bridge;MAC Bridge; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
S3 BridgeMP;MAC Bridge Miniport; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\WINNT\system32\GTNDIS5.SYS []
S3 HidUsb;Microsoft HID Class Driver; C:\WINNT\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Mouse HID Driver; C:\WINNT\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 PCDRDRV;Pcdr Helper Driver; \??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys []
S3 PcdrNt;PcdrNt; C:\WINNT\System32\drivers\PcdrNt.sys [2002-11-21 44192]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service; C:\WINNT\system32\drivers\usbscan.sys [2004-08-04 15104]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 SYMDNS;SYMDNS; C:\WINNT\System32\Drivers\SYMDNS.SYS [2005-04-05 11512]
S3 SYMFW;SYMFW; C:\WINNT\System32\Drivers\SYMFW.SYS [2005-04-05 173208]
S3 SYMIDS;SYMIDS; C:\WINNT\System32\Drivers\SYMIDS.SYS [2005-04-05 36984]
S3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20090707.004\symidsco.sys []
S3 SYMNDIS;SYMNDIS; C:\WINNT\System32\Drivers\SYMNDIS.SYS [2005-04-05 47192]
S3 SYMREDRV;SYMREDRV; C:\WINNT\System32\Drivers\SYMREDRV.SYS [2005-04-05 17976]
S3 usbaudio;USB Audio Driver (WDM); C:\WINNT\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINNT\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 VX3000;VX-3000; C:\WINNT\system32\DRIVERS\VX3000.sys [2006-06-29 1966256]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver; C:\WINNT\System32\DRIVERS\rt2500usb.sys [2004-05-07 79616]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINNT\System32\drivers\ws2ifsl.sys [2002-08-29 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AOL ACS;AOL Connectivity Service; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2006-10-23 46640]
R2 AOL TopSpeedMonitor;AOL TopSpeed Monitor; C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe [2004-10-15 100016]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2004-08-13 197752]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2004-08-13 164984]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-29 187184]
R2 NMSSvc;Intel(R) NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
R2 NPFMntor;Norton AntiVirus Firewall Monitor Service; C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe [2004-08-18 46208]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS [2002-08-19 57388]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2005-04-05 206552]
R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2004-07-21 173160]
R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2005-09-26 817304]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINNT\system32\wdfmgr.exe [2005-01-28 38912]
R2 WANMiniportService;WAN Miniport (ATW) Service; C:\WINNT\wanmpsvc.exe [2003-08-27 65536]
R3 navapsvc;Norton AntiVirus Auto-Protect Service; C:\Program Files\Norton AntiVirus\navapsvc.exe [2004-08-18 176768]
S2 SBService;ScriptBlocking Service; C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe [2004-08-18 66688]
S3 ccPwdSvc;Symantec Password Validation; C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe [2004-08-13 78968]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 SAVScan;SAVScan; C:\Program Files\Norton AntiVirus\SAVScan.exe [2004-07-23 197864]
S3 usnsvc;Messenger Sharing USN Journal Reader service; C:\WINNT\system32\svchost.exe [2004-08-04 14336]

-----------------EOF-----------------

Scofield

2009-07-10, 01:14

Things are definitly running better. IE is running much faster, as are all the other programs. Still seems a bit sluggish at times. During the Add/Remove programs instrustions I thought I was deleting alot of files, but the error message was something to the effect of: "error, could not remove... would you like to remove from the add/remove program list" to which I said yes.
Thanks again and please advise on how to proceed.

katana

2009-07-10, 11:59

Information

1) Still seems a bit sluggish at times.

2) During the Add/Remove programs instrustions ~ would you like to remove from the add/remove program list" to which I said yes.

1) This machine is never going to break any speed records, it is desperately low on RAM for modern software.

Total RAM: 254 MB (15% free)

2) That's fine :)

----------------------------------------------------------------------------------------
Step 1

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\Program Files\ezStub.exe
C:\WINNT\wininit.ini
c:\winnt\system32\drivers\etc\hosts
Folder::
C:\WINNT\isrvs
C:\rsit
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23136:TCP"=-
"23136:UDP"=-
ADS::
Save this as CFScript.txt and place it on your desktop.

http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

----------------------------------------------------------------------------------------
Step 2

Please run HostsXpert.exe again

----------------------------------------------------------------------------------------
Step 3

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

----------------------------------------------------------------------------------------
Step 4

Please run RSIT again ( there should be two logs this time )

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Combofix log
Kaspersky Log
RSIT Logs

Scofield

2009-07-10, 16:20

Katana...you're an artist. Thanks for what you do. Okay, so I'm not an idiot about these things, but I copied the custom notepad script and dragged it into Combofix...twice. The work completed but a log never appeared and I can't find it anywhere Tried to run Kaspersky online scanner but it said I needed Java version 1.5 to do so. I didn't want to download anything unless you gave the go-ahead. Please advise and thanks for being patient with me.

Scofield.

katana

2009-07-10, 16:29

Have a look for C:\Combofix.txt

Please post a fresh RSIT log also

Scofield

2009-07-10, 18:00

Combofix:

ComboFix 09-07-09.08 - Owner 07/10/2009 9:31:46.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.109 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

FILE ::
"c:\Program Files\ezStub.exe"
"c:\winnt\system32\drivers\etc\hosts"
"C:\WINNT\wininit.ini"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\Program Files\ezStub.exe
C:\rsit
C:\rsit\info.txt
C:\rsit\log.txt
C:\WINNT\isrvs
c:\winnt\system32\drivers\etc\hosts
C:\WINNT\wininit.ini

.
((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))
.

2009-07-09 01:54:08 . 2009-07-09 01:54:08 0 d-----w- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2009-07-09 01:53:58 . 2009-06-17 15:27:56 38160 ----a-w- C:\WINNT\system32\drivers\mbamswissarmy.sys
2009-07-09 01:53:56 . 2009-07-09 01:53:56 0 d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-07-09 01:53:55 . 2009-07-09 01:54:06 0 d-----w- C:\Program Files\Malwarebytes' Anti-Malware
2009-07-09 01:53:55 . 2009-06-17 15:27:44 19096 ----a-w- C:\WINNT\system32\drivers\mbam.sys
2009-07-07 00:09:02 . 2009-07-07 00:09:28 0 d-----w- C:\Program Files\ERUNT
2009-07-05 16:39:27 . 2009-07-08 01:02:44 0 d-----w- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 16:39:27 . 2009-07-05 16:46:44 0 d-----w- C:\Program Files\Spybot - Search & Destroy
2009-07-05 15:48:57 . 2009-07-05 15:48:57 0 d-----w- C:\Documents and Settings\All Users\Application Data\Comcast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-10 13:17:25 . 2003-09-08 01:59:48 0 d-----w- C:\Program Files\Common Files\AOL
2009-07-10 13:15:12 . 2003-09-08 01:40:10 0 d-----w- C:\Documents and Settings\All Users\Application Data\AOL
2009-07-10 13:13:55 . 2004-05-02 17:34:26 0 d-----w- C:\Documents and Settings\Owner\Application Data\AOL
2009-07-10 11:40:05 . 2002-12-10 02:59:22 0 d-----w- C:\Program Files\Symantec
2009-07-10 11:40:05 . 2002-12-10 02:59:16 0 d-----w- C:\Program Files\Common Files\Symantec Shared
2009-07-10 02:47:39 . 2002-12-10 01:52:35 0 d--h--w- C:\Program Files\InstallShield Installation Information
2009-07-10 02:46:16 . 2002-12-10 02:59:16 0 d-----w- C:\Documents and Settings\All Users\Application Data\Symantec
2009-07-09 23:24:07 . 2007-10-15 20:10:45 0 d-----w- C:\Program Files\ComcastToolbar
2009-07-09 23:21:35 . 2007-10-15 20:10:44 0 d-----w- C:\Documents and Settings\Owner\Application Data\ComcastToolbar
2009-07-09 21:58:30 . 2006-10-20 21:59:39 0 d-----w- C:\Documents and Settings\Owner\Application Data\Skype
.

((((((((((((((((((((((((((((( SnapShot@2009-07-09_22.21.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-10 11:36:01 . 2009-07-10 11:36:01 155648 C:\WINNT\ERDNT\AutoBackup\7-10-2009\Users\00000002\UsrClass.dat
+ 2009-07-10 11:36:02 . 2005-10-20 16:02:28 163328 C:\WINNT\ERDNT\AutoBackup\7-10-2009\ERDNT.EXE
+ 2009-07-10 11:36:00 . 2009-07-10 11:36:01 8937472 C:\WINNT\ERDNT\AutoBackup\7-10-2009\Users\00000001\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2002-12-10 02:53:52 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-17 02:41:18 98304]
"VX3000"="C:\WINNT\vVX3000.exe" [2006-06-29 23:55:44 707376]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINNT\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\msncall.exe"=

R2 RioPNP;RioPNP;C:\WINNT\system32\drivers\RioPnP.sys [12/9/2002 10:59:43 PM 6736]
S3 PCDRDRV;Pcdr Helper Driver;\??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys --> C:\Atf\Qctest\PCDoc\PCDRDRV.sys [?]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINNT\system32\drivers\usbscan.sys [4/20/2003 9:05:06 PM 15104]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;C:\WINNT\system32\drivers\rt2500usb.sys [9/14/2006 11:50:11 PM 79616]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NMSCFG
*NewlyCreated* - NMSSVC
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
DPF: DirectAnimation Java Classes - file://C:\WINNT\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://C:\WINNT\Java\classes\xmldso.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB
.

Scofield

2009-07-10, 18:01

RSIT #1

Logfile of random's system information tool 1.06 (written by random/random)
Run by Owner at 2009-07-10 11:59:23
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 24 GB (62%) free of 39 GB
Total RAM: 254 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:38 AM, on 7/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\wscntfy.exe
C:\WINNT\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\RSIT.exe
C:\Documents and Settings\Owner\Desktop\Owner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VX3000] C:\WINNT\vVX3000.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/Codebase/AxisCamControl.ocx
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

--
End of file - 4050 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
ST - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
MSNToolBandBHO - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - MSN - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]
"VX3000"=C:\WINNT\vVX3000.exe [2006-06-29 707376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
C:\Program Files\PhoneTools\CapFax.EXE [2001-11-07 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C84 Series]
C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE [2003-05-27 99840]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
C:\WINNT\GWMDMMSG.exe [2002-08-06 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
C:\WINNT\GWMDMpi.exe [2002-08-06 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
C:\WINNT\system32\SK9910DM.EXE [2001-01-03 66048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\WINNT\System32\hkcmd.exe [2002-09-09 114688]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\WINNT\System32\igfxtray.exe [2002-09-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Keyboard Preload Check]
C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:Keyboard Preload Check []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaFace Integration]
C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe [2003-08-18 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [2002-07-16 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe [2004-08-13 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Program Files\MSN Messenger\msnmsgr.exe [2006-07-29 5354792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
C:\PROGRA~1\AMERIC~2.0\aoltray.exe -check []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

C:\Documents and Settings\Owner\Start Menu\Programs\Startup
ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINNT\system32\igfxsrvc.dll [2002-09-09 315392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINNT\system32\WgaLogon.dll [2006-06-19 702768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

======List of files/folders created in the last 1 months======

2009-07-10 11:59:23 ----D---- C:\rsit
2009-07-10 10:05:26 ----SHD---- C:\RECYCLER
2009-07-10 09:40:51 ----D---- C:\WINNT\temp
2009-07-10 09:30:20 ----SD---- C:\ComboFix
2009-07-10 09:30:18 ----A---- C:\WINNT\system32\CF5605.exe
2009-07-10 09:11:11 ----A---- C:\WINNT\msoffice.ini
2009-07-08 21:54:08 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2009-07-08 21:53:56 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-07-08 21:53:55 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-07-06 20:09:02 ----D---- C:\Program Files\ERUNT
2009-07-06 18:12:06 ----A---- C:\Boot.bak
2009-07-06 18:11:56 ----RASHD---- C:\cmdcons
2009-07-06 18:08:48 ----A---- C:\WINNT\zip.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWXCACLS.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWSC.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\SWREG.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\sed.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\PEV.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\NIRCMD.exe
2009-07-06 18:08:48 ----A---- C:\WINNT\grep.exe
2009-07-06 18:08:41 ----D---- C:\WINNT\ERDNT
2009-07-06 18:08:34 ----D---- C:\Qoobox
2009-07-05 12:39:27 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-07-05 12:39:27 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 12:31:28 ----A---- C:\WINNT\ntbtlog.txt
2009-07-05 12:10:57 ----HDC---- C:\WINNT\$NtUninstallKB956390$
2009-07-05 11:48:57 ----D---- C:\Documents and Settings\All Users\Application Data\Comcast

======List of files/folders modified in the last 1 months======

2009-07-10 11:55:24 ----RD---- C:\Program Files
2009-07-10 09:41:56 ----AD---- C:\WINNT
2009-07-10 09:41:56 ----A---- C:\WINNT\system.ini
2009-07-10 09:41:02 ----D---- C:\WINNT\system32
2009-07-10 09:38:13 ----D---- C:\WINNT\system32\drivers
2009-07-10 09:38:13 ----D---- C:\WINNT\AppPatch
2009-07-10 09:37:55 ----D---- C:\Program Files\Common Files
2009-07-10 09:36:58 ----D---- C:\WINNT\system32\CatRoot2
2009-07-10 09:30:53 ----A---- C:\WINNT\SchedLgU.Txt
2009-07-10 09:17:56 ----D---- C:\WINNT\system32\ias
2009-07-10 09:17:25 ----D---- C:\Program Files\Common Files\AOL
2009-07-10 09:15:12 ----D---- C:\Documents and Settings\All Users\Application Data\AOL
2009-07-10 09:14:39 ----D---- C:\Program Files\AOL
2009-07-10 09:13:55 ----D---- C:\Documents and Settings\Owner\Application Data\AOL
2009-07-10 09:13:35 ----A---- C:\WINNT\win.ini
2009-07-10 07:40:24 ----SHD---- C:\WINNT\Installer
2009-07-10 07:40:08 ----D---- C:\Config.Msi
2009-07-10 07:40:05 ----D---- C:\Program Files\Symantec
2009-07-10 07:40:05 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-07-09 22:47:39 ----HD---- C:\Program Files\InstallShield Installation Information
2009-07-09 22:46:16 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2009-07-09 22:43:39 ----SD---- C:\WINNT\Tasks
2009-07-09 19:55:09 ----D---- C:\WINNT\Prefetch
2009-07-09 19:24:07 ----D---- C:\Program Files\ComcastToolbar
2009-07-09 19:21:35 ----D---- C:\Documents and Settings\Owner\Application Data\ComcastToolbar
2009-07-09 17:58:30 ----D---- C:\Documents and Settings\Owner\Application Data\Skype
2009-07-06 18:33:55 ----RSHD---- C:\WINNT\system32\dllcache
2009-07-06 18:22:07 ----SD---- C:\WINNT\Downloaded Program Files
2009-07-06 18:12:06 ----RASH---- C:\boot.ini
2009-07-05 12:24:15 ----HD---- C:\WINNT\inf
2009-07-05 12:17:58 ----D---- C:\Program Files\Internet Explorer
2009-07-05 12:05:55 ----D---- C:\WINNT\system32\CatRoot
2009-07-05 12:00:52 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2009-07-05 11:53:52 ----D---- C:\WINNT\system32\CatRoot_bak
2009-07-05 11:52:31 ----D---- C:\WINNT\WinSxS

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINNT\system32\drivers\ialmsbw.sys [2002-09-16 91678]
R1 Cdr4_xp;Cdr4_xp; C:\WINNT\system32\drivers\Cdr4_xp.sys [2003-01-12 61424]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2003-01-12 23420]
R1 intelppm;Intel Processor Driver; C:\WINNT\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0; C:\WINNT\System32\DRIVERS\Sk9920nt.sys [2000-09-12 6208]
R2 ASCTRM;ASCTRM; C:\WINNT\system32\drivers\ASCTRM.sys [2002-12-09 8552]
R2 MASPINT;MASPINT; C:\WINNT\system32\drivers\MASPINT.sys [2000-03-29 8096]
R2 RioPNP;RioPNP; C:\WINNT\system32\drivers\RioPNP.sys [2000-06-06 6736]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINNT\system32\drivers\ialmkchw.sys [2002-09-16 71514]
R3 catchme;catchme; \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys []
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINNT\System32\DRIVERS\e100b325.sys [2002-02-25 139776]
R3 GTWModem;GTW V.92 Voicemodem; C:\WINNT\System32\DRIVERS\GWMDM.sys [2002-08-06 1107680]
R3 ialm;ialm; C:\WINNT\System32\DRIVERS\ialmnt5.sys [2002-09-16 79323]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINNT\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 MxlW2k;MxlW2k; C:\WINNT\system32\drivers\MxlW2k.sys [2003-01-03 28276]
R3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINNT\system32\drivers\NMSCFG.SYS []
R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000; C:\WINNT\System32\DRIVERS\Sk99202k.sys [2000-09-11 7552]
R3 smwdm;smwdm; C:\WINNT\system32\drivers\smwdm.sys [2002-04-04 459944]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINNT\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINNT\system32\drivers\ac97intc.sys [2001-08-17 96256]
S3 ATWPKT2;ATWPKT2; \??\C:\WINNT\system32\drivers\ATWPKT2.SYS []
S3 BCMModem;BCM V.90 56K Modem; C:\WINNT\System32\DRIVERS\BCMDM.sys [2001-08-17 871388]
S3 Bridge;MAC Bridge; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
S3 BridgeMP;MAC Bridge Miniport; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\WINNT\system32\GTNDIS5.SYS []
S3 HidUsb;Microsoft HID Class Driver; C:\WINNT\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Mouse HID Driver; C:\WINNT\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
S3 PCDRDRV;Pcdr Helper Driver; \??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys []
S3 PcdrNt;PcdrNt; C:\WINNT\System32\drivers\PcdrNt.sys []
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service; C:\WINNT\system32\drivers\usbscan.sys [2004-08-04 15104]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 usbaudio;USB Audio Driver (WDM); C:\WINNT\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINNT\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 VX3000;VX-3000; C:\WINNT\system32\DRIVERS\VX3000.sys [2006-06-29 1966256]
S3 wanatw;WAN Miniport (ATW); C:\WINNT\System32\DRIVERS\wanatw4.sys [2003-01-10 33588]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver; C:\WINNT\System32\DRIVERS\rt2500usb.sys [2004-05-07 79616]
S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINNT\System32\drivers\ws2ifsl.sys [2002-08-29 12032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-29 187184]
R2 NMSSvc;Intel(R) NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
R2 PrismXL;PrismXL; C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS [2002-08-19 57388]
R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINNT\system32\wdfmgr.exe [2005-01-28 38912]
S3 usnsvc;Messenger Sharing USN Journal Reader service; C:\WINNT\system32\svchost.exe [2004-08-04 14336]

-----------------EOF-----------------

Scofield

2009-07-10, 18:03

RSIT #2

info.txt logfile of random's system information tool 1.06 2009-07-10 11:59:41

======Uninstall list======

-->C:\WINNT\IsUninst.exe -fC:\WINNT\orun32.isu
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINNT\INF\PCHealth.inf
Adobe Acrobat 5.0-->C:\WINNT\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 9 ActiveX-->C:\WINNT\System32\Macromed\Flash\UninstFl.exe -q
Adobe Reader 7.0.8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
Comcast Toolbar-->C:\Program Files\ComcastToolbar\uninstall.exe
Creative Jukebox Driver-->C:\Program Files\Creative\Jukebox Driver\DrvUnins.exe /s
DelFin Media Viewer-->C:\WINNT\unvise32.exe C:\Program Files\DelFin\PromulGate\uninstal.log
Desktop Doctor-->MsiExec.exe /I{D87149B3-7A1D-4548-9CBF-032B791E5908}
Do More-->C:\WINNT\IsUninst.exe -f"C:\Program Files\Gateway\Do More\Uninst.isu"
DVD-->"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
Easy CD Creator 5 Platinum-->MsiExec.exe /I{8851E12C-0EF9-11D4-A788-009027ABA5D0}
EPSON Printer Software-->C:\WINNT\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
Film Factory-->C:\WINNT\IsUninst.exe -f"C:\Program Files\EPSON Software\Film Factory\Uninst.isu"
FinePixViewer Ver.4.2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ED4D80-8294-11D5-96CD-0040266301AD}\SETUP.EXE"
FUJIFILM USB Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE"
Gateway Rhapsody-->"C:\Program Files\Gateway Rhapsody\Unwise32.exe" C:\PROGRA~1\GATEWA~1\Install.log
Gateway Rhapsody-->"C:\Program Files\SIFXINST\SIFXINST.EXE" /UnapplyFile 20BBF229-A337-40AD-9FEB-2C98CDA53D1C /Prompt
GTW V.92 Voicemodem-->C:\WINNT\GWMDMU.exe verbose
HijackThis 2.0.2-->"C:\Documents and Settings\Owner\Desktop\HijackThis.exe" /uninstall
ImageMixer VCD2 for FinePix-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{934E9442-D305-4ACF-AD87-A6C11D677CB9}\setup.exe"
Intel(R) PRO Ethernet Adapter and Software-->Prounstl.exe
Intel(R) PROSet II-->MsiExec.exe /I{01A4AEDE-F219-49A2-B855-16A016EAF9A4}
IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaFACE 4.01 Image Library-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{82AF77BC-423D-42DA-BE5B-FFCA04752181} /l1033
MediaFACE 4.01-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{41979C2F-34B8-4F92-8111-B13C5864682D} /l1033
MediaLoads Installer-->"C:\Program Files\DownloadWare\dw.exe" /R
Microsoft .NET Framework (English) v1.0.3705-->C:\WINNT\Microsoft.NET\Framework\Install.exe /u /p Microsoft .NET Framework Full v1.0.3705 (1033)
Microsoft .NET Framework (English)-->MsiExec.exe /X{B43357AA-3A6D-4D94-B56E-43C44D09E548}
Microsoft Encarta Encyclopedia Standard 2003-->MsiExec.exe /I{03410014-3975-4267-9F39-1DC4745090B7}
Microsoft LifeCam-->MsiExec.exe /X{4DEE75B1-B201-4DA3-A50F-007CDB00DA23}
Microsoft Office 2000 Small Business-->MsiExec.exe /I{00030409-78E1-11D2-B60F-006097C998E7}
Microsoft Picture It! Photo 7.0-->MsiExec.exe /I{369B36BE-3D64-4641-9AEA-808D436FE132}
Microsoft Streets and Trips 2002-->MsiExec.exe /I{12BDDF23-B1DB-49C8-92D3-3E6841CCED61}
Microsoft Word 2002-->MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
Microsoft Works 2003 Setup Launcher-->C:\Program Files\Microsoft Works Suite 2003\Setup\Launcher.exe d:\
Microsoft Works 7.0-->MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
Microsoft Works Suite Add-in for Microsoft Word-->MsiExec.exe /I{7EE9DE0D-9228-4C33-B80E-FDD1773600DF}
MicroStaff WINASPI-->C:\MWASPI\uninst.exe
mIRC-->"c:\winnt\ntconfig\windows\bootup\sysconfig\lsass.exe" -uninstall
MSN Music Assistant-->rundll32 advpack.dll,LaunchINFSection C:\WINNT\INF\msninst.inf,Uninstall
MSN Toolbar-->C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\mtbs.exe c
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MUSICMATCH Jukebox-->C:\WINNT\IsUninst.exe -f"C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\Uninst.isu" -cC:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.dll
MUSTEK 1200 UB v2.1-->C:\WINNT\TWAIN_32\1200UB\UNINST.EXE
Need2Find Bar-->rundll32 C:\PROGRA~1\NEED2F~1\bar\1.bin\Nd2fnBar.dll,O
NOMAD Jukebox 3 Driver-->C:\Program Files\Creative\Jukebox 3 Drivers\DrvUnins.exe /s
PhotoParade Player-->"C:\Program Files\PhotoParade\Uninstall PhotoParade Player.exe" "PhotoParade.exe"
PS/2 Millennium Keyboard-->SKUninst.exe SK_PS2MillenniumKeyboard
QuickTime-->C:\WINNT\unvise32qt.exe C:\WINNT\System32\QuickTime\Uninstall.log
RAW FILE CONVERTER LE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D680C913-5955-469D-9D88-C1940F7506D6}\SETUP.EXE" -l0x9
RealPlayer Basic-->C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
Rhapsody Player Engine-->MsiExec.exe /I{30C2FCD0-FF7B-4FFA-8DDE-43A22E01A1E7}
Search Assistant-->"C:\Program Files\se\v11\se.EXE" /R W
Search Function-->"C:\Program Files\se\v11\se.EXE" /R S
Search MS.C-->"C:\Program Files\msnet\v9\msnet.EXE" /R S
Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINNT\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINNT\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)-->"C:\WINNT\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINNT\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINNT\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows Media Player 8 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP8$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)-->"C:\WINNT\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)-->"C:\WINNT\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)-->"C:\WINNT\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)-->"C:\WINNT\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896424)-->"C:\WINNT\$NtUninstallKB896424$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)-->"C:\WINNT\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)-->"C:\WINNT\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)-->"C:\WINNT\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)-->"C:\WINNT\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)-->"C:\WINNT\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)-->"C:\WINNT\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)-->"C:\WINNT\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)-->"C:\WINNT\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)-->"C:\WINNT\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)-->"C:\WINNT\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)-->"C:\WINNT\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911567)-->"C:\WINNT\$NtUninstallKB911567$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)-->"C:\WINNT\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912919)-->"C:\WINNT\$NtUninstallKB912919$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)-->"C:\WINNT\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)-->"C:\WINNT\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)-->"C:\WINNT\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917159)-->"C:\WINNT\$NtUninstallKB917159$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917344)-->"C:\WINNT\$NtUninstallKB917344$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917422)-->"C:\WINNT\$NtUninstallKB917422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)-->"C:\WINNT\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)-->"C:\WINNT\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918899)-->"C:\WINNT\$NtUninstallKB918899$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)-->"C:\WINNT\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)-->"C:\WINNT\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920214)-->"C:\WINNT\$NtUninstallKB920214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)-->"C:\WINNT\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)-->"C:\WINNT\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)-->"C:\WINNT\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921398)-->"C:\WINNT\$NtUninstallKB921398$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)-->"C:\WINNT\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921883)-->"C:\WINNT\$NtUninstallKB921883$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922616)-->"C:\WINNT\$NtUninstallKB922616$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922760)-->"C:\WINNT\$NtUninstallKB922760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)-->"C:\WINNT\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)-->"C:\WINNT\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)-->"C:\WINNT\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINNT\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923694)-->"C:\WINNT\$NtUninstallKB923694$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)-->"C:\WINNT\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924191)-->"C:\WINNT\$NtUninstallKB924191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)-->"C:\WINNT\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)-->"C:\WINNT\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)-->"C:\WINNT\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925454)-->"C:\WINNT\$NtUninstallKB925454$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925486)-->"C:\WINNT\$NtUninstallKB925486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)-->"C:\WINNT\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)-->"C:\WINNT\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)-->"C:\WINNT\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)-->"C:\WINNT\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)-->"C:\WINNT\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928090)-->"C:\WINNT\$NtUninstallKB928090$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)-->"C:\WINNT\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)-->"C:\WINNT\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)-->"C:\WINNT\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929969)-->"C:\WINNT\$NtUninstallKB929969$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)-->"C:\WINNT\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)-->"C:\WINNT\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931768)-->"C:\WINNT\$NtUninstallKB931768$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)-->"C:\WINNT\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)-->"C:\WINNT\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933566)-->"C:\WINNT\$NtUninstallKB933566$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)-->"C:\WINNT\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)-->"C:\WINNT\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)-->"C:\WINNT\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)-->"C:\WINNT\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937143)-->"C:\WINNT\$NtUninstallKB937143$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938127)-->"C:\WINNT\$NtUninstallKB938127$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)-->"C:\WINNT\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB939653)-->"C:\WINNT\$NtUninstallKB939653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)-->"C:\WINNT\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)-->"C:\WINNT\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINNT\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)-->"C:\WINNT\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB942615)-->"C:\WINNT\$NtUninstallKB942615$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)-->"C:\WINNT\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)-->"C:\WINNT\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)-->"C:\WINNT\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944338-v2)-->"C:\WINNT\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944533)-->"C:\WINNT\$NtUninstallKB944533$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)-->"C:\WINNT\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)-->"C:\WINNT\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"C:\WINNT\$NtUninstallKB956390$\spuninst\spuninst.exe"
Select CashBack-->C:\WINNT\vcp41t2q.exe
Shockwave-->C:\WINNT\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINNT\System32\Macromed\SHOCKW~1\Install.log
Sidebar Search-->"C:\Program Files\se\v11\se.EXE" /R R
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Update for Windows XP (KB898461)-->"C:\WINNT\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)-->"C:\WINNT\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)-->"C:\WINNT\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)-->"C:\WINNT\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)-->"C:\WINNT\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)-->"C:\WINNT\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)-->"C:\WINNT\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)-->"C:\WINNT\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)-->"C:\WINNT\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB929338)-->"C:\WINNT\$NtUninstallKB929338$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)-->"C:\WINNT\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB931836)-->"C:\WINNT\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update for Windows XP (KB933360)-->"C:\WINNT\$NtUninstallKB933360$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)-->"C:\WINNT\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)-->"C:\WINNT\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)-->"C:\WINNT\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB942840)-->"C:\WINNT\$NtUninstallKB942840$\spuninst\spuninst.exe"
Update for Windows XP (KB946627)-->"C:\WINNT\$NtUninstallKB946627$\spuninst\spuninst.exe"
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
WebSearch Tools-->C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe uninstesies
Win Search-->"C:\Program Files\winex\v2\winex.EXE" /R F
Windows Installer 3.1 (KB893803)-->"C:\WINNT\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{FCE50DB8-C610-4C42-BE5C-193F46C6F812}
Windows Live Sign-in Assistant-->MsiExec.exe /I{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10 Hotfix - KB895316-->"C:\WINNT\$NtUninstallKB895316$\spuninst\spuninst.exe"
Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Hotfix - KB873333-->C:\WINNT\$NtUninstallKB873333$\spuninst\spuninst.exe
Windows XP Hotfix - KB873339-->C:\WINNT\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835-->C:\WINNT\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836-->C:\WINNT\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB885884-->C:\WINNT\$NtUninstallKB885884$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185-->C:\WINNT\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB887472-->C:\WINNT\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP Hotfix - KB888113-->C:\WINNT\$NtUninstallKB888113$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302-->C:\WINNT\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890175-->C:\WINNT\$NtUninstallKB890175$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859-->"C:\WINNT\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Hotfix - KB891781-->C:\WINNT\$NtUninstallKB891781$\spuninst\spuninst.exe
Windows XP Hotfix - KB893066-->"C:\WINNT\$NtUninstallKB893066$\spuninst\spuninst.exe"
Windows XP Hotfix - KB893086-->"C:\WINNT\$NtUninstallKB893086$\spuninst\spuninst.exe"
Windows XP Service Pack 2-->C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.exe
Your MS.C Assistant-->"C:\Program Files\msnet\v9\msnet.EXE" /R H

=====HijackThis Backups=====

O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM [2009-07-09]
O24 - Desktop Component 0: (no name) - http://www.3dwallpaper.com/fg/trinity2k2.jpg [2009-07-09]
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank [2009-07-09]
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2009-07-09]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank [2009-07-09]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank [2009-07-09]
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2009-07-09]
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) [2009-07-09]
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2009-07-09]
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [2009-07-09]
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2009-07-09]
O1 - Hosts: 127.0.0.3 allforadult.com [2009-07-09]
O1 - Hosts: 127.0.0.3 www.sexfiles.nu [2009-07-09]
O1 - Hosts: 127.0.0.3 www.allforadult.com [2009-07-09]
O1 - Hosts: 127.0.0.3 slutmania.biz [2009-07-09]
O1 - Hosts: 127.0.0.3 virgin-tgp.net [2009-07-09]
O1 - Hosts: 127.0.0.3 nylonsexy.com [2009-07-09]
O1 - Hosts: 127.0.0.3 www.toolbarpartner.com [2009-07-09]
O1 - Hosts: 127.0.0.3 www.slutmania.biz [2009-07-09]
O1 - Hosts: 127.0.0.3 www.virgin-tgp.net [2009-07-09]
O1 - Hosts: 127.0.0.3 www.nylonsexy.com [2009-07-09]
O1 - Hosts: 127.0.0.3 sexfiles.nu [2009-07-09]
O1 - Hosts: 127.0.0.3 www.megapornix.com [2009-07-09]
O1 - Hosts: 127.0.0.3 toolbarpartner.com [2009-07-09]
O1 - Hosts: 127.0.0.3 aaasexypics.com [2009-07-09]
O1 - Hosts: 127.0.0.3 www.aaasexypics.com [2009-07-09]
O1 - Hosts: 127.0.0.3 megapornix.com [2009-07-09]
O1 - Hosts: 127.0.0.3 www.sp2fucked.biz [2009-07-09]
O1 - Hosts: 127.0.0.3 sp2fucked.biz [2009-07-09]
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-07-10]
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe [2009-07-10]
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background [2009-07-10]
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2009-07-10]
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe [2009-07-10]
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 [2009-07-10]
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe [2009-07-10]
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2009-07-10]
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2009-07-10]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ [2009-07-10]

======Hosts File======

127.0.0.1 localhost

======System event log======

Computer Name: CHRISTYNA
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Record Number: 76288
Source Name: W32Time
Time Written: 20071128165424.000000-300
Event Type: warning
User:

Computer Name: CHRISTYNA
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the
DHCP Server) for the Network Card with network address 0007E9C1FD13. The following
error occurred:
The semaphore timeout period has expired.
.
Your computer will continue to try and obtain an address on its own from
the network address (DHCP) server.

Record Number: 76251
Source Name: Dhcp
Time Written: 20071126183931.000000-300
Event Type: warning
User:

Computer Name: CHRISTYNA
Event Code: 10010
Message: The server {0006F03A-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Record Number: 76160
Source Name: DCOM
Time Written: 20071121222450.000000-300
Event Type: error
User: CHRISTYNA\Owner

Computer Name: CHRISTYNA
Event Code: 10010
Message: The server {0006F03A-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Record Number: 76159
Source Name: DCOM
Time Written: 20071121222414.000000-300
Event Type: error
User: CHRISTYNA\Owner

Computer Name: CHRISTYNA
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Record Number: 76151
Source Name: W32Time
Time Written: 20071121165408.000000-300
Event Type: warning
User:

=====Application event log=====

Computer Name: CHRISTYNA
Event Code: 11
Message: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Record Number: 42575
Source Name: crypt32
Time Written: 20090705123839.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 1002
Message: Hanging application ccApp.exe, version 103.0.1.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 42573
Source Name: Application Hang
Time Written: 20090705122309.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 1002
Message: Hanging application ccApp.exe, version 103.0.1.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 42572
Source Name: Application Hang
Time Written: 20090705122309.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 1000
Message: Faulting application skype.exe, version 2.5.0.151, faulting module skype.exe, version 2.5.0.151, fault address 0x00004302.

Record Number: 42571
Source Name: Application Error
Time Written: 20090705120134.000000-240
Event Type: error
User:

Computer Name: CHRISTYNA
Event Code: 56
Message:
Record Number: 42540
Source Name: LiveUpdate
Time Written: 20081206100806.000000-300
Event Type: error
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\Adaptec Shared\System
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0207
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO

-----------------EOF-----------------

katana

2009-07-10, 22:46

----------------------------------------------------------------------------------------
Step 1

Download and Run SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1 (http://jpshortstuff.247fixes.com/SystemLook.exe)
Download Mirror #2 (http://images.malwareremoval.com/jpshortstuff/SystemLook.exe)

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:regfind
DelFin
Need2Find
msnet
vcp41t2q.exe
Program Files\se
WToolsA.exe
winex.EXE
:comment

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

----------------------------------------------------------------------------------------
Step 2

Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan (http://www.pandasecurity.com/activescan/index/) << LINK

Click the Scan Now button
Follow the prompts to install the Active X if necessary
Go and make a cup of tea/coffee/beverage of your choice and watch some TV :)
When the scan is finished, a report will be generated
Next to Scan Details click the small export to notepad button and save the report to your desktop.
Please post the report in your reply.

Scofield

2009-07-11, 02:31

We are making great progess Katana. Thanks again! Following are the requested logs...

SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 18:11 on 10/07/2009 by Owner (Administrator - Elevation successful)

========== regfind ==========

Searching for "DelFin"
[HKEY_CURRENT_USER\Software\DelFin]
[HKEY_CURRENT_USER\Software\DelFin\PromulGate]
""Install""=="C:\Program Files\DelFin\PromulGate"
[HKEY_CURRENT_USER\Software\DelFin\PromulGate]
""Install""=="C:\Program Files\DelFin\PromulGate"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[HKEY_LOCAL_MACHINE\SOFTWARE\DelFin]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
""DisplayName""=="DelFin Media Viewer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
""DisplayName""=="DelFin Media Viewer"
[HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin]
[HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin\PromulGate]
""Install""=="C:\Program Files\DelFin\PromulGate"
[HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin\PromulGate]
""Install""=="C:\Program Files\DelFin\PromulGate"
[HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]

Searching for "Need2Find"
[HKEY_CURRENT_USER\Software\Need2Find]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}]
"@"=="Need2Find Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}]
"@"=="Need2Find Bar Settings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\ProgID]
"@"=="Need2FindBar.SettingsPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\VersionIndependentProgID]
"@"=="Need2FindBar.SettingsPlugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
"@"=="Need2Find Toolbar Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\InprocServer32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\InprocServer32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ProgID]
"@"=="Need2FindBar.ToolbarPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\VersionIndependentProgID]
"@"=="Need2FindBar.ToolbarPlugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
"@"=="INeed2FindBarSettings"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8C-A32A-416B-BCDB-33B3EF3617D3}]
"@"=="_INeed2FindBarSettingsEvents"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
"@"=="Need2Find Bar Settings Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin\CurVer]
"@"=="Need2FindBar.SettingsPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
"@"=="Need2Find Bar Settings Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
"@"=="Need2Find Toolbar Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin\CurVer]
"@"=="Need2FindBar.ToolbarPlugin.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
"@"=="Need2Find Toolbar Plugin"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3}\1.0\0\win32]
"@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3}\1.0\HELPDIR]
"@"=="C:\Program Files\Need2Find\bar\1.bin\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
""DisplayName""=="Need2Find Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
""DisplayName""=="Need2Find Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
""DisplayName""=="Need2Find Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
""DisplayName""=="Need2Find Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
""DisplayName""=="Need2Find Bar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find]
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
""Dir""=="C:\Program Files\Need2Find\bar\"
[HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find]

Searching for "msnet"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9EA69F99-F8FF-415E-8B90-35D6DFAF160E}\InProcServer32]
"@"=="C:\WINNT\System32\msnetobj.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9EA69F99-F8FF-415E-8B90-35D6DFAF160E}\InProcServer32]
"@"=="C:\WINNT\System32\msnetobj.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9FC132B-096D-460B-B7D5-1DB0FAE0C062}\InprocServer32]
"@"=="C:\WINNT\system32\msnetobj.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9FC132B-096D-460B-B7D5-1DB0FAE0C062}\InprocServer32]
"@"=="C:\WINNT\system32\msnetobj.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8AA720BF-7468-4DA1-97DA-66D2E41B3DDA}\1.0]
"@"=="msnetobj 1.0 Type Library"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8AA720BF-7468-4DA1-97DA-66D2E41B3DDA}\1.0\0\win32]
"@"=="C:\WINNT\system32\msnetobj.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R S"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R S"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R H"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R H"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\MUILanguages\RCV2\msnetobj.dll]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\msnetobj.dll]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\msnetobj.dll]

Searching for "vcp41t2q.exe"
No data found.

Searching for "Program Files\se"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R W"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R W"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R S"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R S"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R R"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R R"

Searching for "WToolsA.exe"
No data found.

Searching for "winex.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
""UninstallString""==""C:\Program Files\winex\v2\winex.EXE" /R F"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
""UninstallString""==""C:\Program Files\winex\v2\winex.EXE" /R F"

-=End Of File=-

Scofield

2009-07-11, 02:32

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-07-10 20:25:51
PROTECTIONS: 0
MALWARE: 94
SUSPECTS: 1
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00001888 adware/dyfuca Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer
00013876 Application/Psexec.A HackTools No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\boot.exe
00013991 Application/RebootN.A HackTools No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\restart.exe
00018331 adware/gator Adware No 0 Yes No c:\winnt\gatorpatch.log
00020900 spyware/apropos Spyware No 1 Yes No c:\winnt\system32\auto_update_uninstall.log
00024343 adware/keenvalue Adware No 0 Yes No c:\program files\perfectnav
00024343 adware/keenvalue Adware No 0 Yes No hkey_local_machine\software\perfectnav
00027660 adware/savenow Adware No 0 Yes No c:\winnt\system32\wsxsvc
00027660 adware/savenow Adware No 0 Yes No hkey_local_machine\software\whenu
00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\classes\appid\adm.exe
00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\classes\appid\altnet signing module.exe
00029258 application/altnet HackTools No 0 Yes No hkey_classes_root\appid\adm.exe
00029767 adware/delfinmedia Adware No 1 Yes No hkey_current_user\software\delfin
00029767 adware/delfinmedia Adware No 1 Yes No hkey_local_machine\software\delfin
00034279 adware/mediatickets Adware No 1 Yes No c:\winnt\downloaded program files\mediaticketsinstaller.inf
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-games-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-autos-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-entertainment-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-health and fitness-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-music-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-computers and internet-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-business directory-
00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-travel-
00040415 adware/wintools Adware No 0 Yes No hkey_local_machine\system\controlset001\enum\root\legacy_tbpssvc
00040415 adware/wintools Adware No 0 Yes No hkey_classes_root\wsg.wsgobj
00040471 adware/downloadware Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware
00046160 adware/searchexe Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant
00046160 adware/searchexe Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search function
00048503 spyware/clipgenie Spyware No 1 Yes No hkey_current_user\software\traynotifier
00049442 adware/scbar Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search
00049468 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129522.dll
00049470 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129497.exe
00049470 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129490.exe
00049471 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129491.dll
00049471 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129498.dll
00055559 Adware/DownloadWare Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129537.exe
00065614 Bck/IRCFlood.G Virus/Trojan No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll
00091847 Application/PrcView.A HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1695\A0133795.exe
00095999 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129521.dll
00096565 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129540.dll
00097149 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129493.dll
00097150 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129504.dll
00097984 Adware/Cydoor Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129526.dll
00099224 Application/MyWay HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129515.DLL
00099503 Adware/Medload Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1694\A0133792.exe
00099617 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129541.exe
00103402 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129546.dll
00103403 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129611.exe
00103404 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129544.dll
00103405 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129550.dll
00106277 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129551.dll
00107290 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129606.dll
00107291 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129609.dll
00107296 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129542.dll
00107366 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129548.dll
00107367 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129543.dll
00107368 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129545.dll
00107369 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129607.dll
00107370 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129547.dll
00107371 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129552.dll
00107387 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129608.dll
00107388 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129612.exe
00107389 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129614.exe
00107390 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129610.dll
00114504 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129503.dll
00114505 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129500.dll
00114506 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129501.dll
00114508 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129495.exe
00114509 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129494.dll
00114510 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129496.dll
00116708 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129489.exe
00121953 Adware/eZula Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134996.exe
00121953 Adware/eZula Adware No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\ezStub.exe.vir
00122010 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129524.exe
00130110 Hacktool/CCProxyOver HackTools No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\mscfg32bit.exe
00132145 Adware/DownloadWare Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129620.exe
00132146 Adware/DownloadWare Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129619.DLL
00132694 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129523.dll
00132695 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129525.dll
00135485 Adware/MediaTickets Adware No 1 Yes No C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx
00135485 Adware/MediaTickets Adware No 1 Yes No C:\Qoobox\Quarantine\C\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx.vir
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@casalemedia[1].txt
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt
00139864 Adware/TopMoxie Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129615.exe
00142033 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129492.dll
00144676 Adware/CWS.Searchmeup Adware No 1 Yes No C:\Qoobox\Quarantine\C\WINNT\hosts.vir
00156692 Adware/nCase Adware No 0 Yes No C:\WINNT\Downloaded Program Files\RCXF39.tmp
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@ad.yieldmanager[1].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt
00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.toolbarplugin.1
00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.settingsplugin
00169752 application/need2find HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}
00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.toolbarplugin
00169752 application/need2find HackTools No 0 Yes No hkey_current_user\software\need2find
00169752 application/need2find HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}
00169752 Application/Need2Find HackTools No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\Need2Find\bar\1.bin\NPND2FN.DLL.vir
00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.settingsplugin.1
00169752 application/need2find HackTools No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall
00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}
00169752 application/need2find HackTools No 0 Yes No hkey_local_machine\software\need2find
00169753 Application/Need2Find HackTools No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\Need2Find\bar\1.bin\N2PLUGIN.DLL.vir
00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@overture[1].txt
00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129519.exe
00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129518.exe
00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129517.exe
00174723 Adware/SAHAgent Adware No 0 Yes No C:\WINNT\system32\4o256jcj.exe
00178289 Spyware/MarketScore Spyware No 1 Yes No C:\Qoobox\Quarantine\C\WINNT\system32\rk.bin.vir
00180282 Application/Need2Find HackTools No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL.vir
00184065 Adware/SAHAgent Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129509.exe
00184066 Adware/SAHAgent Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129508.dll
00184067 Adware/SAHAgent Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129507.exe
00215582 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129487.exe
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@atwola[1].txt
00278769 Application/PRScheduler HackTools No 0 Yes No C:\WINNT\pss\PowerReg SchedulerV2.exeStartup
00285172 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129502.dll
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134338.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134339.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134340.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134341.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134342.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134343.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134346.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134347.dll
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134350.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134351.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134352.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134355.dll
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134356.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134360.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134362.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134363.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134367.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134370.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134336.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134372.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134385.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134386.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134393.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134396.ocx
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134397.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134335.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134399.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134400.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134401.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134402.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134404.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134405.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134406.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134408.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134409.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134410.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134416.dll
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134417.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134420.dll
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134425.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134426.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134427.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134429.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134326.exe
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134371.dll
00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134398.exe
00501626 Spyware/Clipgenie Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129505.DLL
00527202 Application/PRScheduler HackTools No 0 Yes No C:\WINNT\pss\PowerReg Scheduler.exeStartup
00532291 Trj/Downloader.LTJ Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129516.dll
00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1695\A0133798.sys
02834437 W32/Randon.GB.worm Virus/Worm No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll
03008302 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129482.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129533.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129538.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129536.exe
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\webHancer\Programs\webhdll.dll.vir
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129534.exe
03950453 Generic Trojan Virus/Trojan No 0 No No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1695\A0133921.exe[²≡\Mutex.dll]
03950453 Generic Trojan Virus/Trojan No 0 No No C:\Qoobox\Quarantine\C\Program Files\Morpheus\update.exe.vir[²≡\Mutex.dll]
04199668 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129485.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location
;===================================================================================================================================================================================
No C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description
;===================================================================================================================================================================================
210625 HIGH MS09-026
210624 HIGH MS09-025
210621 HIGH MS09-022
210618 HIGH MS09-019
208380 HIGH MS09-015
208379 HIGH MS09-014
208378 HIGH MS09-013
208377 HIGH MS09-012
206981 HIGH MS09-007
206980 HIGH MS09-006
204670 HIGH MS09-001
203806 HIGH MS08-078
203508 HIGH MS08-073
203505 HIGH MS08-071
202465 HIGH MS08-068
201683 HIGH MS08-067
201258 HIGH MS08-066
201256 HIGH MS08-064
201255 HIGH MS08-063
201253 HIGH MS08-061
209275 HIGH MS08-049
196455 MEDIUM MS08-037
194860 HIGH MS08-030
191618 HIGH MS08-025
191614 HIGH MS08-021
191613 HIGH MS08-020
120815 HIGH MS06-022
;===================================================================================================================================================================================

katana

2009-07-11, 11:51

OTMoveIt
Please download OTM by OldTimer (http://oldtimer.geekstogo.com/OTM.exe) and save it to your desktop

Double-click OTM.exe to run it.
Copy the lines in the codebox below. ( Make sure you include :Processes )

:Processes
:Reg
[-HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
[-HKEY_CURRENT_USER\Software\DelFin]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[-HKEY_CURRENT_USER\Software\Need2Find]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DelFin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Select CashBack]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebSearch Tools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find]
[-HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find]
[-HKEY_classes_root\appid\adm.exe]
[-HKEY_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}]
[-HKEY_classes_root\need2findbar.settingsplugin.1]
[-HKEY_classes_root\need2findbar.settingsplugin]
[-HKEY_classes_root\need2findbar.toolbarplugin.1]
[-HKEY_classes_root\need2findbar.toolbarplugin]
[-HKEY_classes_root\wsg.wsgobj]
[-HKEY_current_user\software\delfin]
[-HKEY_current_user\software\need2find]
[-HKEY_current_user\software\traynotifier]
[-HKEY_local_machine\software\classes\appid\adm.exe]
[-HKEY_local_machine\software\classes\appid\altnet signing module.exe]
[-HKEY_local_machine\software\delfin]
[-HKEY_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search function]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search]
[-HKEY_local_machine\software\need2find]
[-HKEY_local_machine\software\perfectnav]
[-HKEY_local_machine\software\whenu]
[-HKEY_local_machine\system\controlset001\enum\root\legacy_tbpssvc]
:Files
C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx
C:\WINNT\Downloaded Program Files\RCXF39.tmp
C:\WINNT\ntconfig\windows\bootup\sysconfig\boot.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\mscfg32bit.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\restart.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll
C:\WINNT\pss\PowerReg Scheduler.exeStartup
C:\WINNT\pss\PowerReg SchedulerV2.exeStartup
C:\WINNT\system32\4o256jcj.exe
c:\documents and settings\owner\favorites\-autos-
c:\documents and settings\owner\favorites\-business directory-
c:\documents and settings\owner\favorites\-computers and internet-
c:\documents and settings\owner\favorites\-entertainment-
c:\documents and settings\owner\favorites\-games-
c:\documents and settings\owner\favorites\-health and fitness-
c:\documents and settings\owner\favorites\-music-
c:\documents and settings\owner\favorites\-travel-
c:\program files\perfectnav
c:\winnt\downloaded program files\mediaticketsinstaller.inf
c:\winnt\gatorpatch.log
c:\winnt\system32\auto_update_uninstall.log
c:\winnt\system32\wsxsvc
:Commands
[Purity]
[EmptyTemp]

Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

- Close ALL open windows (especially Internet Explorer!)-
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTM

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Scofield

2009-07-12, 10:05

Hi Katana and thanks again. Well, I've ran OTM three times now, and every time I copy/paste the custom script and click "moveit" results show up on the right under the green bar but the computer instantly freezes up. I cannot copy the results, the entire back ground disappears, and I am forced to restart. How should I proceed from here?

katana

2009-07-12, 17:09

Let's break it down into a couple of sections
Put each section in and run it separately.

:Processes
:Reg
[-HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
[-HKEY_CURRENT_USER\Software\DelFin]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[-HKEY_CURRENT_USER\Software\Need2Find]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DelFin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Select CashBack]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebSearch Tools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find]
[-HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find]
[-HKEY_classes_root\appid\adm.exe]
:Commands

:Processes
:Reg
[-HKEY_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}]
[-HKEY_classes_root\need2findbar.settingsplugin.1]
[-HKEY_classes_root\need2findbar.settingsplugin]
[-HKEY_classes_root\need2findbar.toolbarplugin.1]
[-HKEY_classes_root\need2findbar.toolbarplugin]
[-HKEY_classes_root\wsg.wsgobj]
[-HKEY_current_user\software\delfin]
[-HKEY_current_user\software\need2find]
[-HKEY_current_user\software\traynotifier]
[-HKEY_local_machine\software\classes\appid\adm.exe]
[-HKEY_local_machine\software\classes\appid\altnet signing module.exe]
[-HKEY_local_machine\software\delfin]
[-HKEY_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search function]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search]
[-HKEY_local_machine\software\need2find]
[-HKEY_local_machine\software\perfectnav]
[-HKEY_local_machine\software\whenu]
[-HKEY_local_machine\system\controlset001\enum\root\legacy_tbpssvc]
:Files

:Files
C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx
C:\WINNT\Downloaded Program Files\RCXF39.tmp
C:\WINNT\ntconfig\windows\bootup\sysconfig\boot.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\mscfg32bit.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\restart.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll
C:\WINNT\pss\PowerReg Scheduler.exeStartup
C:\WINNT\pss\PowerReg SchedulerV2.exeStartup
C:\WINNT\system32\4o256jcj.exe

c:\documents and settings\owner\favorites\-autos-
c:\documents and settings\owner\favorites\-business directory-
c:\documents and settings\owner\favorites\-computers and internet-
c:\documents and settings\owner\favorites\-entertainment-
c:\documents and settings\owner\favorites\-games-
c:\documents and settings\owner\favorites\-health and fitness-
c:\documents and settings\owner\favorites\-music-
c:\documents and settings\owner\favorites\-travel-
c:\program files\perfectnav
c:\winnt\downloaded program files\mediaticketsinstaller.inf
c:\winnt\gatorpatch.log
c:\winnt\system32\auto_update_uninstall.log
c:\winnt\system32\wsxsvc
:Commands
[EmptyTemp]
:Files

Scofield

2009-07-13, 01:05

Wow you're on to something. Breaking it down seems to be having an effect. First log...

========== PROCESSES ==========
========== REGISTRY ==========
Registry key HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_CURRENT_USER\Software\DelFin\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer\ not found.
Registry key HKEY_CURRENT_USER\Software\Need2Find\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\DelFin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Select CashBack\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebSearch Tools\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\ not found.
Registry key HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin\ not found.
Registry key HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer\ not found.
Registry key HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find\ not found.
Registry key HKEY_classes_root\appid\adm.exe\ not found.
Error: Unable to interpret <:CommandsCode:> in the current context!

OTM by OldTimer - Version 3.0.0.4 log created on 07122009_190307

Scofield

2009-07-13, 01:32

second scan froze the computer.... third fixed alot and required a reboot hopefully this is the log you need....

All processes killed
========== FILES ==========
C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx unregistered successfully.
C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx moved successfully.
C:\WINNT\Downloaded Program Files\RCXF39.tmp moved successfully.
C:\WINNT\ntconfig\windows\bootup\sysconfig\boot.exe moved successfully.
LoadLibrary failed for C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll NOT unregistered.
C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll moved successfully.
C:\WINNT\ntconfig\windows\bootup\sysconfig\mscfg32bit.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll NOT unregistered.
C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll moved successfully.
C:\WINNT\ntconfig\windows\bootup\sysconfig\restart.exe moved successfully.
DllUnregisterServer procedure not found in C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll NOT unregistered.
C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll moved successfully.
C:\WINNT\pss\PowerReg Scheduler.exeStartup moved successfully.
C:\WINNT\pss\PowerReg SchedulerV2.exeStartup moved successfully.
C:\WINNT\system32\4o256jcj.exe moved successfully.
c:\documents and settings\owner\favorites\-Autos- moved successfully.
c:\documents and settings\owner\favorites\-Business Directory- moved successfully.
c:\documents and settings\owner\favorites\-Computers and Internet- moved successfully.
c:\documents and settings\owner\favorites\-Entertainment- moved successfully.
c:\documents and settings\owner\favorites\-Games- moved successfully.
c:\documents and settings\owner\favorites\-Health and Fitness- moved successfully.
c:\documents and settings\owner\favorites\-Music- moved successfully.
c:\documents and settings\owner\favorites\-Travel- moved successfully.
c:\program files\PerfectNav\BHO moved successfully.
c:\program files\PerfectNav moved successfully.
c:\winnt\downloaded program files\MediaTicketsInstaller.INF moved successfully.
c:\winnt\GatorPatch.log moved successfully.
c:\winnt\system32\auto_update_uninstall.log moved successfully.
c:\winnt\system32\wsxsvc moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Owner
->Temp folder emptied: 77901 bytes
->Temporary Internet Files folder emptied: 16005676 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19528 bytes
%systemroot%\System32 .tmp files removed: 319736 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 102289 bytes

Total Files Cleaned = 15.82 mb

========== FILES ==========

OTM by OldTimer - Version 3.0.0.4 log created on 07122009_191118

Files moved on Reboot...

Registry entries deleted on Reboot...

Scofield

2009-07-13, 05:40

========== PROCESSES ==========
========== REGISTRY ==========
Registry key HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_CURRENT_USER\Software\DelFin\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer\ not found.
Registry key HKEY_CURRENT_USER\Software\Need2Find\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\DelFin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Select CashBack\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebSearch Tools\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\ not found.
Registry key HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ not found.
Registry key HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin\ not found.
Registry key HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer\ not found.
Registry key HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find\ not found.
Registry key HKEY_classes_root\appid\adm.exe\ not found.
========== COMMANDS ==========

OTM by OldTimer - Version 3.0.0.4 log created on 07122009_233846

katana

2009-07-13, 09:53

Ok, lets break section two down again and see if we can get that one to run.

:Processes
:Reg
[-HKEY_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}]
[-HKEY_classes_root\need2findbar.settingsplugin.1]
[-HKEY_classes_root\need2findbar.settingsplugin]
[-HKEY_classes_root\need2findbar.toolbarplugin.1]
[-HKEY_classes_root\need2findbar.toolbarplugin]
[-HKEY_classes_root\wsg.wsgobj]
[-HKEY_current_user\software\delfin]
[-HKEY_current_user\software\need2find]
[-HKEY_current_user\software\traynotifier]
[-HKEY_local_machine\software\classes\appid\adm.exe]
[-HKEY_local_machine\software\classes\appid\altnet signing module.exe]
:Files

:Processes
:Reg
[-HKEY_local_machine\software\delfin]
[-HKEY_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search function]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search]
[-HKEY_local_machine\software\need2find]
[-HKEY_local_machine\software\perfectnav]
[-HKEY_local_machine\software\whenu]
[-HKEY_local_machine\system\controlset001\enum\root\legacy_tbpssvc]
:Files

Scofield

2009-07-13, 16:20

Hiya Katana... Okay, the first set still froze the computer, but it ony had two lines, I wrote down what I could...

Process
Registry

Registry Key HKEY_Classes_root\clsid\{630d6140[04c5-dbl

Registry Key HKEY-Local_Machine\Software\Classes

They cut off and thats all I could write down. The second set worked and here is the result...

rror: Unable to interpret <Processes> in the current context!
========== REGISTRY ==========
Registry key HKEY_local_machine\software\delfin\ not found.
Registry key HKEY_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer\ deleted successfully.
Registry key HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware\ deleted successfully.
Registry key HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall\ not found.
Registry key HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant\ not found.
Registry key HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search function\ not found.
Registry key HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search\ not found.
Registry key HKEY_local_machine\software\need2find\ not found.
Registry key HKEY_local_machine\software\perfectnav\ deleted successfully.
Registry key HKEY_local_machine\software\whenu\ deleted successfully.
Registry key HKEY_local_machine\system\controlset001\enum\root\legacy_tbpssvc\ deleted successfully.
========== FILES ==========

OTM by OldTimer - Version 3.0.0.4 log created on 07132009_101646

katana

2009-07-13, 22:04

Ok, let's get heavy with it :laugh:

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Registry::
[-HKEY_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}]
[-HKEY_classes_root\need2findbar.settingsplugin.1]
[-HKEY_classes_root\need2findbar.settingsplugin]
[-HKEY_classes_root\need2findbar.toolbarplugin.1]
[-HKEY_classes_root\need2findbar.toolbarplugin]
[-HKEY_classes_root\wsg.wsgobj]
[-HKEY_current_user\software\delfin]
[-HKEY_current_user\software\need2find]
[-HKEY_current_user\software\traynotifier]
[-HKEY_local_machine\software\classes\appid\adm.exe]
[-HKEY_local_machine\software\classes\appid\altnet signing module.exe]
ADS::
Save this as CFScript.txt and place it on your desktop.

http://i51.photobucket.com/albums/f387/Katana_1970/CFScriptb.gif

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Are there any problems left now ?

Scofield

2009-07-14, 00:40

Sweet. Let's Kick ass. Gotta log for you. Thanks a ton!

ComboFix 09-07-13.01 - Owner 07/13/2009 16:35.4.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.139 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2009-06-13 to 2009-07-13 )))))))))))))))))))))))))))))))
.

2009-07-12 01:48 . 2009-07-12 01:48 -------- d-----w- C:\_OTM
2009-07-11 02:55 . 2009-07-11 02:55 127872 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\uninstall.exe
2009-07-11 02:55 . 2009-07-11 02:56 -------- d-----w- c:\documents and settings\Owner\Application Data\Move Networks
2009-07-10 22:15 . 2008-06-19 21:24 28544 ----a-w- c:\winnt\system32\drivers\pavboot.sys
2009-07-10 22:15 . 2009-07-10 22:15 -------- d-----w- c:\program files\Panda Security
2009-07-10 15:59 . 2009-07-10 15:59 -------- d-----w- C:\rsit
2009-07-09 01:54 . 2009-07-09 01:54 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2009-07-09 01:53 . 2009-06-17 15:27 38160 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-07-09 01:53 . 2009-07-09 01:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-09 01:53 . 2009-07-09 01:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-09 01:53 . 2009-06-17 15:27 19096 ----a-w- c:\winnt\system32\drivers\mbam.sys
2009-07-07 00:09 . 2009-07-07 00:09 -------- d-----w- c:\program files\ERUNT
2009-07-05 16:39 . 2009-07-08 01:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-05 16:39 . 2009-07-05 16:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-05 15:48 . 2009-07-05 15:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Comcast
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-16 06:35 . 2009-07-11 02:55 4183416 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071503000010.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-10 13:17 . 2003-09-08 01:59 -------- d-----w- c:\program files\Common Files\AOL
2009-07-10 13:15 . 2003-09-08 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-07-10 13:13 . 2004-05-02 17:34 -------- d-----w- c:\documents and settings\Owner\Application Data\AOL
2009-07-10 11:40 . 2002-12-10 02:59 -------- d-----w- c:\program files\Symantec
2009-07-10 11:40 . 2002-12-10 02:59 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-10 02:47 . 2002-12-10 01:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-10 02:46 . 2002-12-10 02:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-07-09 23:24 . 2007-10-15 20:10 -------- d-----w- c:\program files\ComcastToolbar
2009-07-09 23:21 . 2007-10-15 20:10 -------- d-----w- c:\documents and settings\Owner\Application Data\ComcastToolbar
2009-07-09 21:58 . 2006-10-20 21:59 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
.

((((((((((((((((((((((((((((( SnapShot@2009-07-09_22.21.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-09-03 18:22 . 2009-07-12 02:34 285312 c:\winnt\system32\FNTCACHE.DAT
- 2002-09-03 18:22 . 2007-04-04 07:11 285312 c:\winnt\system32\FNTCACHE.DAT
+ 2009-07-12 07:52 . 2009-07-12 07:52 172032 c:\winnt\ERDNT\AutoBackup\7-12-2009\Users\00000002\UsrClass.dat
+ 2009-07-12 07:52 . 2005-10-20 16:02 163328 c:\winnt\ERDNT\AutoBackup\7-12-2009\ERDNT.EXE
+ 2009-07-11 09:29 . 2009-07-11 09:29 172032 c:\winnt\ERDNT\AutoBackup\7-11-2009\Users\00000002\UsrClass.dat
+ 2009-07-11 09:29 . 2005-10-20 16:02 163328 c:\winnt\ERDNT\AutoBackup\7-11-2009\ERDNT.EXE
+ 2009-07-10 11:36 . 2009-07-10 11:36 155648 c:\winnt\ERDNT\AutoBackup\7-10-2009\Users\00000002\UsrClass.dat
+ 2009-07-10 11:36 . 2005-10-20 16:02 163328 c:\winnt\ERDNT\AutoBackup\7-10-2009\ERDNT.EXE
+ 2009-04-17 12:59 . 2009-04-17 12:59 128256 c:\winnt\Downloaded Program Files\as2stubie.dll
+ 2009-07-12 07:52 . 2009-07-12 07:52 8937472 c:\winnt\ERDNT\AutoBackup\7-12-2009\Users\00000001\ntuser.dat
+ 2009-07-11 09:29 . 2009-07-11 09:29 8937472 c:\winnt\ERDNT\AutoBackup\7-11-2009\Users\00000001\ntuser.dat
+ 2009-07-10 11:36 . 2009-07-10 11:36 8937472 c:\winnt\ERDNT\AutoBackup\7-10-2009\Users\00000001\ntuser.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2002-12-10 26112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-17 98304]
"VX3000"="c:\winnt\vVX3000.exe" [2006-06-29 707376]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=c:\winnt\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 pavboot;pavboot;c:\winnt\system32\drivers\pavboot.sys [7/10/2009 6:15 PM 28544]
R2 RioPNP;RioPNP;c:\winnt\system32\drivers\RioPnP.sys [12/9/2002 10:59 PM 6736]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\atf\Qctest\PCDoc\PCDRDRV.sys --> c:\atf\Qctest\PCDoc\PCDRDRV.sys [?]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;c:\winnt\system32\drivers\usbscan.sys [4/20/2003 9:05 PM 15104]
S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;c:\winnt\system32\drivers\rt2500usb.sys [9/14/2006 11:50 PM 79616]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NMSSVC
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mWindow Title = Windows Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-13 16:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-13 16:55
ComboFix-quarantined-files.txt 2009-07-13 20:54
ComboFix2.txt 2009-07-09 22:28
ComboFix3.txt 2009-07-06 22:37

Pre-Run: 25,479,974,912 bytes free
Post-Run: 25,562,824,704 bytes free

109 --- E O F --- 2008-03-01 08:04

Scofield

2009-07-14, 17:43

Oh hi Katana.... I just saw your question about any problems left now. There doesn't seem to be anything wrong now. Everything is running very smooth. Thanks again.

katana

2009-07-14, 18:16

Congratulations your logs look clean :)

Let's see if I can help you keep it that way

First lets tidy up

Uninstall Combofix
This will clear your System Volume Information restore points and remove all the infected files that were quarantined
Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png

Uninstall OTMoveIt (OTM.exe)
Open OTMoveIt Click Cleanup,
When a box pops up click YES.

You can also delete any logs we have produced, and empty your Recycle bin.

----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean.

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE (http://secunia.com/software_inspector/) for details

AntiSpyware
AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy (http://www.safer-networking.org/) <<< A must have program It includes host protection and registry protection A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware (http://www.malwarebytes.org/mbam.php) <<< A New and effective program
a-squared Free (http://www.emsisoft.com/en/software/free/) <<< A good "realtime" or "on demand" scanner
superantispyware (http://www.superantispyware.com/) <<< A good "realtime" or "on demand" scanner

Prevention
These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol (http://www.winpatrol.com) An excellent startup manager and then some !! Notifies you if programs are added to startup Allows delayed startup A must have addition
SpywareBlaster 4.0 (http://www.javacoolsoftware.com/spywareblaster.html) SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2 (http://www.javacoolsoftware.com/spywareguard.html) SpywareGuard provides real-time protection against spyware. Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut (http://www.funkytoad.com/index.php?option=com_content&view=article&id=15&Itemid=33) Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS (http://www.mvps.org/winhelp2002/hosts.zip) This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial (http://www.mvps.org/winhelp2002/hosts.htm) by WinHelp2002. Not required if you are using other host file protections

Internet Browsers
Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

If you are still using IE6 then either update, or get one of the following.
FireFox (http://www.mozilla.com/en-US/firefox/) With many addons available that make customization easy this is a very popular choice NoScript and AdBlockPlus addons are essential
Opera (http://www.opera.com/) Another popular alternative
Netscape (http://browser.netscape.com/addons) Another popular alternative Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies
Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner (http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25) Free and very simple to use
CCleaner (http://www.ccleaner.com/) Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place (http://forum.malwareremoval.com/viewtopic.php?t=4959)

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again :D

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

Scofield

2009-07-15, 05:07

Hi Katana and thanks yet again. You're probably getting tired of hearing me say that! I have followed all of your instructions and things are running superb. You guys are the best! I hope you don't have to hear from me again!

Scofield.