View Full Version : Slow system
Hi
I did read the "Before you post" log.
But I'm still not sure if I can ask help on an issue I am having trouble with.
Please forgive me if this is the wrong place to ask for help on this issue.
My issue is a slow computer. I've run AVG, Spybot, Windows Defender, CCleaner. None of them have brought up any viruses or spyware. So I think my relatively new laptop is clean. But it still takes my laptop at least 5 mins to boot up. And if I double click on a program like say Firefox before the system completely "boots up", then the entire system becomes very slow.
I think the problem is crapware...not sure. Is it possible to get help on this issue in this forum?
I did get help in this forum for a different computer a few months back and the help given was fantastic.
Thanks
Hello Candle
Welcome to Safer Networking.
Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.
Lets check your computer for anything malicious, and if none is found than I can direct you to a windows forum that can help you sort out the programs you have installed that may not be needed.
Please download RootRepeal one of these locations and save it to your desktop
Here (http://ad13.geekstogo.com/RootRepeal.exe)
Here (http://download.bleepingcomputer.com/rootrepeal/RootRepeal.exe)
Here (http://rootrepeal.psikotick.com/RootRepeal.exe)
Open http://billy-oneal.com/forums/rootRepeal/rootRepealDesktopIcon.png on your desktop.
Click the http://billy-oneal.com/forums/rootRepeal/reportTab.png tab.
Click the http://billy-oneal.com/forums/rootRepeal/btnScan.png button.
Check just these boxes:
http://forums.whatthetech.com/uploads/monthly_08_2009/post-75503-1250480183.gif
Push Ok
Check the box for your main system drive (Usually C:, and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the http://billy-oneal.com/forums/rootRepeal/saveReport.png button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post.
Download random's system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
Hello Ken545
Thank you very much for your post and your support.
Step 1:
I downloaded RootRepeal.
I clicked the Report tab
I clicked the Scan tab
I checked the boxes you asked me to
...and pushed ok
The scan immediately started. I was not offered the option of checking a box for my main system drive.
Please find the contents of RootRepeal.txt below
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/11/01 17:29
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================
Drivers
-------------------
Name: dump_iaStor.sys
Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys
Address: 0x8DEB1000 Size: 778240 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xAB2EA000 Size: 49152 File Visible: No Signed: -
Status: -
Processes
-------------------
Path: System
PID: 4 Status: Locked to the Windows API!
Path: C:\Windows\System32\audiodg.exe
PID: 1468 Status: Locked to the Windows API!
==EOF==
Logfile of random's system information tool 1.06 (written by random/random)
Run by Tiger at 2009-11-01 17:35:34
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 21 GB (14%) free of 147 GB
Total RAM: 1014 MB (28% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:37:20, on 01/11/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\SquirrelSave\SquirrelSave.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Tiger\Desktop\Computer expert help\programs\RSIT.exe
C:\Program Files\trend micro\Tiger.exe
C:\Windows\system32\DllHost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPWAUDAP] C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
O4 - HKLM\..\Run: "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [FingerPrintSoftware] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Startup: SquirrelSave.lnk = C:\Program Files\SquirrelSave\SquirrelSave.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_16.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_16.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} (IASRunner Class) - http://download.boulder.ibm.com/ibmdl/pub/pc/pccbbs/bp_pc/acpirexe.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Fn+F5 Service (FNF5SVC) - Lenovo. - C:\Program Files\LENOVO\HOTKEY\FNF5SVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PMSveH - Lenovo - C:\Program Files\Lenovo\PM Driver\PMSveH.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: System Update (SUService) - - c:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: On Screen Display (TPHKSVC) - Unknown owner - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
--
End of file - 8626 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-09-13 1111320]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre6\bin\ssv.dll [2009-10-28 321312]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-09-02 1107200]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-28 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F040E541-A427-4CF7-85D8-75E3E0F476C5}]
CPwmIEBrowserHelper Object - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll [2006-12-22 796224]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-09-02 1107200]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-10-23 815104]
"TPWAUDAP"=C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe [2006-09-06 54824]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-02-12 174872]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-03-23 4423680]
"FingerPrintSoftware"=C:\Program Files\Lenovo Fingerprint Software\fpapp.exe [2007-03-02 933888]
"TVT Scheduler Proxy"=C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [2007-01-09 536576]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-28 149280]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"Skytel"=C:\Windows\Skytel.exe [2007-03-16 1822720]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-10-19 2025752]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMHandler]
C:\PROGRA~1\Lenovo\PMDRIV~1\PMHandler.exe [2007-06-06 34352]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask.exe -atboottime []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\Lenovo Multimedia Center\PowerDVD\PDVDServ.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7]
C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe [2007-04-09 58416]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
C:\PROGRA~1\Lenovo\BLUETO~1\BTTray.exe [2007-03-29 719664]
C:\Users\Tiger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
SquirrelSave.lnk - C:\Program Files\SquirrelSave\SquirrelSave.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2008-01-02 200704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
ACGina
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d814414-b84f-11dc-b595-00197eff56fe}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\MicrosoftPowerPoint.exe
shell\Open*\command - D:\MicrosoftPowerPoint.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c6b344cf-9e8a-11dc-ab21-00197eff56fe}]
shell\AutoRun\command - F:\LaunchU3.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fae9a9d9-73a8-11dd-b094-00197eff56fe}]
shell\AutoRun\command - D:\xvlyb.exe
shell\explore\command - D:\xvlyb.exe
shell\open\command - D:\xvlyb.exe
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2009-11-01 17:35:37 ----D---- C:\Program Files\trend micro
2009-11-01 17:35:34 ----D---- C:\rsit
2009-11-01 17:29:36 ----A---- C:\RootRepeal report 11-01-09 (17-29-36).txt
2009-11-01 17:28:15 ----A---- C:\RootRepeal report 11-01-09 (17-28-15).txt
2009-10-31 22:34:52 ----D---- C:\Users\Tiger\AppData\Roaming\vlc
2009-10-31 22:31:44 ----D---- C:\Program Files\VideoLAN
2009-10-29 15:20:01 ----D---- C:\Windows\system32\eu-ES
2009-10-29 15:20:01 ----D---- C:\Windows\system32\ca-ES
2009-10-29 15:19:51 ----D---- C:\Windows\system32\vi-VN
2009-10-29 14:34:16 ----D---- C:\Windows\system32\EventProviders
2009-10-28 18:59:02 ----D---- C:\Users\Tiger\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-10-28 18:53:19 ----SHD---- C:\Config.Msi
2009-10-28 18:50:00 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-10-28 18:48:18 ----D---- C:\ProgramData\NOS
2009-10-28 16:20:45 ----D---- C:\Program Files\MSECACHE
2009-10-28 16:16:25 ----A---- C:\Windows\system32\javaws.exe
2009-10-28 16:16:25 ----A---- C:\Windows\system32\deploytk.dll
2009-10-28 16:16:24 ----A---- C:\Windows\system32\javaw.exe
2009-10-28 16:16:24 ----A---- C:\Windows\system32\java.exe
2009-10-28 13:42:04 ----A---- C:\Windows\system32\jscript.dll
2009-10-28 13:08:11 ----A---- C:\Windows\system32\occache.dll
2009-10-28 13:08:11 ----A---- C:\Windows\system32\jsproxy.dll
2009-10-28 13:08:10 ----A---- C:\Windows\system32\msfeedsbs.dll
2009-10-28 13:08:10 ----A---- C:\Windows\system32\msfeeds.dll
2009-10-28 13:08:10 ----A---- C:\Windows\system32\ieui.dll
2009-10-28 13:08:10 ----A---- C:\Windows\system32\iepeers.dll
2009-10-28 13:08:09 ----A---- C:\Windows\system32\iesetup.dll
2009-10-28 13:08:09 ----A---- C:\Windows\system32\iernonce.dll
2009-10-28 13:08:08 ----A---- C:\Windows\system32\wininet.dll
2009-10-28 13:08:08 ----A---- C:\Windows\system32\msfeedssync.exe
2009-10-28 13:08:08 ----A---- C:\Windows\system32\ie4uinit.exe
2009-10-28 13:08:07 ----A---- C:\Windows\system32\iertutil.dll
2009-10-28 13:08:07 ----A---- C:\Windows\system32\iedkcs32.dll
2009-10-28 13:08:06 ----A---- C:\Windows\system32\urlmon.dll
2009-10-28 13:08:06 ----A---- C:\Windows\system32\ieUnatt.exe
2009-10-28 13:08:06 ----A---- C:\Windows\system32\iesysprep.dll
2009-10-28 13:08:05 ----A---- C:\Windows\system32\ieframe.dll
2009-10-28 13:08:02 ----A---- C:\Windows\system32\mshtml.dll
2009-10-28 13:05:44 ----A---- C:\Windows\system32\mshtmled.dll
2009-10-28 13:05:44 ----A---- C:\Windows\system32\icardie.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\msls31.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\mshtmler.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\imgutil.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\ieakeng.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\dxtmsft.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\corpol.dll
2009-10-28 13:05:43 ----A---- C:\Windows\system32\admparse.dll
2009-10-28 13:05:42 ----A---- C:\Windows\system32\msrating.dll
2009-10-28 13:05:42 ----A---- C:\Windows\system32\licmgr10.dll
2009-10-28 13:05:42 ----A---- C:\Windows\system32\inseng.dll
2009-10-28 13:05:42 ----A---- C:\Windows\system32\ieaksie.dll
2009-10-28 13:05:42 ----A---- C:\Windows\system32\dxtrans.dll
2009-10-28 13:05:41 ----A---- C:\Windows\system32\WinFXDocObj.exe
2009-10-28 13:05:41 ----A---- C:\Windows\system32\wextract.exe
2009-10-28 13:05:41 ----A---- C:\Windows\system32\webcheck.dll
2009-10-28 13:05:41 ----A---- C:\Windows\system32\mstime.dll
2009-10-28 13:05:41 ----A---- C:\Windows\system32\ieakui.dll
2009-10-28 13:05:41 ----A---- C:\Windows\system32\advpack.dll
2009-10-28 13:05:40 ----A---- C:\Windows\system32\vbscript.dll
2009-10-28 13:05:40 ----A---- C:\Windows\system32\url.dll
2009-10-28 13:05:40 ----A---- C:\Windows\system32\pngfilt.dll
2009-10-28 13:05:40 ----A---- C:\Windows\system32\ieapfltr.dll
2009-10-28 13:05:38 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2009-10-28 13:05:38 ----A---- C:\Windows\system32\SetDepNx.exe
2009-10-28 13:05:38 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2009-10-28 13:05:38 ----A---- C:\Windows\system32\PDMSetup.exe
2009-10-28 13:05:38 ----A---- C:\Windows\system32\mshta.exe
2009-10-28 13:05:38 ----A---- C:\Windows\system32\iexpress.exe
2009-10-28 09:59:55 ----A---- C:\Windows\system32\wmp.dll
2009-10-28 09:59:49 ----A---- C:\Windows\system32\unregmp2.exe
2009-10-28 09:59:47 ----A---- C:\Windows\system32\wmploc.DLL
2009-10-19 21:02:39 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-10-19 21:02:25 ----A---- C:\Windows\system32\SLsvc.exe
2009-10-19 21:02:25 ----A---- C:\Windows\system32\SLCExt.dll
2009-10-19 21:02:22 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2009-10-19 21:02:22 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2009-10-19 21:02:20 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-10-19 21:02:16 ----A---- C:\Windows\system32\mssrch.dll
2009-10-19 21:02:13 ----A---- C:\Windows\system32\tquery.dll
2009-10-19 21:02:12 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2009-10-19 21:02:11 ----A---- C:\Windows\system32\RMActivate_isv.exe
2009-10-19 21:02:10 ----A---- C:\Windows\system32\scavenge.dll
2009-10-19 21:02:09 ----A---- C:\Windows\system32\RMActivate.exe
2009-10-19 21:02:06 ----A---- C:\Windows\system32\msi.dll
2009-10-19 21:02:02 ----A---- C:\Windows\system32\imapi2fs.dll
2009-10-19 21:01:58 ----A---- C:\Windows\system32\secproc_isv.dll
2009-10-19 21:01:57 ----A---- C:\Windows\system32\WscEapPr.dll
2009-10-19 21:01:57 ----A---- C:\Windows\system32\wcnwiz2.dll
2009-10-19 21:01:55 ----A---- C:\Windows\system32\sysmain.dll
2009-10-19 21:01:52 ----A---- C:\Windows\system32\icardagt.exe
2009-10-19 21:01:50 ----A---- C:\Windows\system32\EhStorShell.dll
2009-10-19 21:01:50 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2009-10-19 21:01:49 ----A---- C:\Windows\system32\spreview.exe
2009-10-19 21:01:49 ----A---- C:\Windows\system32\spinstall.exe
2009-10-19 21:01:49 ----A---- C:\Windows\system32\drmv2clt.dll
2009-10-19 21:01:47 ----A---- C:\Windows\system32\spwizui.dll
2009-10-19 21:01:46 ----A---- C:\Windows\system32\secproc.dll
2009-10-19 21:01:46 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2009-10-19 21:01:44 ----A---- C:\Windows\system32\shell32.dll
2009-10-19 21:01:43 ----A---- C:\Windows\system32\SearchIndexer.exe
2009-10-19 21:01:43 ----A---- C:\Windows\system32\p2psvc.dll
2009-10-19 21:01:42 ----A---- C:\Windows\system32\mssvp.dll
2009-10-19 21:01:41 ----A---- C:\Windows\system32\mscoree.dll
2009-10-19 21:01:40 ----A---- C:\Windows\system32\mssphtb.dll
2009-10-19 21:01:40 ----A---- C:\Windows\system32\mssph.dll
2009-10-19 21:01:40 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2009-10-19 21:01:40 ----A---- C:\Windows\system32\imapi2.dll
2009-10-19 21:01:38 ----A---- C:\Windows\system32\sdohlp.dll
2009-10-19 21:01:37 ----A---- C:\Windows\system32\IMJP10K.DLL
2009-10-19 21:01:37 ----A---- C:\Windows\system32\esent.dll
2009-10-19 21:01:37 ----A---- C:\Windows\system32\DevicePairing.dll
2009-10-19 21:01:36 ----A---- C:\Windows\system32\sperror.dll
2009-10-19 21:01:36 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2009-10-19 21:01:35 ----A---- C:\Windows\system32\wevtsvc.dll
2009-10-19 21:01:35 ----A---- C:\Windows\system32\korwbrkr.dll
2009-10-19 21:01:34 ----A---- C:\Windows\system32\SLC.dll
2009-10-19 21:01:34 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2009-10-19 21:01:34 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2009-10-19 21:01:34 ----A---- C:\Windows\system32\IasMigReader.exe
2009-10-19 21:01:33 ----A---- C:\Windows\system32\msshsq.dll
2009-10-19 21:01:30 ----A---- C:\Windows\system32\msjet40.dll
2009-10-19 21:01:30 ----A---- C:\Windows\system32\MPSSVC.dll
2009-10-19 21:01:29 ----A---- C:\Windows\system32\msxml6.dll
2009-10-19 21:01:28 ----A---- C:\Windows\system32\Query.dll
2009-10-19 21:01:28 ----A---- C:\Windows\system32\qmgr.dll
2009-10-19 21:01:27 ----A---- C:\Windows\system32\P2PGraph.dll
2009-10-19 21:01:27 ----A---- C:\Windows\system32\msexch40.dll
2009-10-19 21:01:27 ----A---- C:\Windows\system32\diagperf.dll
2009-10-19 21:01:26 ----A---- C:\Windows\system32\srchadmin.dll
2009-10-19 21:01:26 ----A---- C:\Windows\system32\ole32.dll
2009-10-19 21:01:26 ----A---- C:\Windows\system32\ntdll.dll
2009-10-19 21:01:25 ----A---- C:\Windows\system32\winload.exe
2009-10-19 21:01:25 ----A---- C:\Windows\system32\msxml3.dll
2009-10-19 21:01:25 ----A---- C:\Windows\system32\mblctr.exe
2009-10-19 21:01:25 ----A---- C:\Windows\system32\EncDec.dll
2009-10-19 21:01:24 ----A---- C:\Windows\system32\uDWM.dll
2009-10-19 21:01:24 ----A---- C:\Windows\system32\mmc.exe
2009-10-19 21:01:24 ----A---- C:\Windows\system32\dfsr.exe
2009-10-19 21:01:23 ----A---- C:\Windows\system32\riched20.dll
2009-10-19 21:01:23 ----A---- C:\Windows\system32\IasMigPlugin.dll
2009-10-19 21:01:23 ----A---- C:\Windows\system32\fdBth.dll
2009-10-19 21:01:22 ----A---- C:\Windows\system32\RacEngn.dll
2009-10-19 21:01:20 ----A---- C:\Windows\system32\kernel32.dll
2009-10-19 21:01:19 ----A---- C:\Windows\system32\spoolss.dll
2009-10-19 21:01:19 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2009-10-19 21:01:19 ----A---- C:\Windows\system32\SearchFilterHost.exe
2009-10-19 21:01:19 ----A---- C:\Windows\system32\milcore.dll
2009-10-19 21:01:19 ----A---- C:\Windows\system32\EhStorAPI.dll
2009-10-19 21:01:19 ----A---- C:\Windows\system32\CertEnroll.dll
2009-10-19 21:01:18 ----A---- C:\Windows\system32\schedsvc.dll
2009-10-19 21:01:18 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-10-19 21:01:17 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2009-10-19 21:01:16 ----A---- C:\Windows\system32\msvcp60.dll
2009-10-19 21:01:16 ----A---- C:\Windows\system32\msjtes40.dll
2009-10-19 21:01:16 ----A---- C:\Windows\system32\fsquirt.exe
2009-10-19 21:01:15 ----A---- C:\Windows\system32\infocardapi.dll
2009-10-19 21:01:15 ----A---- C:\Windows\system32\gpedit.dll
2009-10-19 21:01:14 ----A---- C:\Windows\system32\WinSAT.exe
2009-10-19 21:01:13 ----A---- C:\Windows\system32\PresentationSettings.exe
2009-10-19 21:01:13 ----A---- C:\Windows\system32\es.dll
2009-10-19 21:01:12 ----A---- C:\Windows\system32\mstext40.dll
2009-10-19 21:01:12 ----A---- C:\Windows\system32\Magnify.exe
2009-10-19 21:01:12 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2009-10-19 21:01:12 ----A---- C:\Windows\system32\advapi32.dll
2009-10-19 21:01:10 ----A---- C:\Windows\system32\WMPhoto.dll
2009-10-19 21:01:10 ----A---- C:\Windows\system32\WebClnt.dll
2009-10-19 21:01:10 ----A---- C:\Windows\system32\msexcl40.dll
2009-10-19 21:01:09 ----A---- C:\Windows\system32\slwmi.dll
2009-10-19 21:01:09 ----A---- C:\Windows\system32\msxbde40.dll
2009-10-19 21:01:09 ----A---- C:\Windows\system32\comsvcs.dll
2009-10-19 21:01:08 ----A---- C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2009-10-19 21:01:08 ----A---- C:\Windows\system32\vssapi.dll
2009-10-19 21:01:07 ----A---- C:\Windows\system32\authui.dll
2009-10-19 21:01:06 ----A---- C:\Windows\system32\NetProjW.dll
2009-10-19 21:01:05 ----A---- C:\Windows\system32\PresentationHost.exe
2009-10-19 21:01:05 ----A---- C:\Windows\system32\newdev.dll
2009-10-19 21:01:05 ----A---- C:\Windows\system32\msrepl40.dll
2009-10-19 21:01:04 ----A---- C:\Windows\system32\propsys.dll
2009-10-19 21:01:04 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-10-19 21:01:04 ----A---- C:\Windows\system32\iasrecst.dll
2009-10-19 21:01:04 ----A---- C:\Windows\system32\gpsvc.dll
2009-10-19 21:01:04 ----A---- C:\Windows\system32\eudcedit.exe
2009-10-19 21:01:03 ----A---- C:\Windows\system32\crypt32.dll
2009-10-19 21:01:03 ----A---- C:\Windows\explorer.exe
2009-10-19 21:01:02 ----A---- C:\Windows\system32\setupapi.dll
2009-10-19 21:01:02 ----A---- C:\Windows\system32\rpcss.dll
2009-10-19 21:01:02 ----A---- C:\Windows\system32\mspbde40.dll
2009-10-19 21:01:01 ----A---- C:\Windows\system32\davclnt.dll
2009-10-19 21:01:01 ----A---- C:\Windows\system32\d3d9.dll
2009-10-19 21:01:00 ----A---- C:\Windows\system32\shlwapi.dll
2009-10-19 21:01:00 ----A---- C:\Windows\system32\msltus40.dll
2009-10-19 21:01:00 ----A---- C:\Windows\system32\mfc42.dll
2009-10-19 21:01:00 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2009-10-19 21:01:00 ----A---- C:\Windows\system32\EhStorAuthn.dll
2009-10-19 21:00:59 ----A---- C:\Windows\system32\msrd3x40.dll
2009-10-19 21:00:59 ----A---- C:\Windows\system32\msdtctm.dll
2009-10-19 21:00:58 ----A---- C:\Windows\system32\wevtapi.dll
2009-10-19 21:00:58 ----A---- C:\Windows\system32\photowiz.dll
2009-10-19 21:00:58 ----A---- C:\Windows\system32\nlhtml.dll
2009-10-19 21:00:58 ----A---- C:\Windows\system32\browseui.dll
2009-10-19 21:00:56 ----A---- C:\Windows\system32\user32.dll
2009-10-19 21:00:55 ----A---- C:\Windows\system32\samsrv.dll
2009-10-19 21:00:55 ----A---- C:\Windows\system32\quartz.dll
2009-10-19 21:00:55 ----A---- C:\Windows\system32\ci.dll
2009-10-19 21:00:54 ----A---- C:\Windows\system32\win32spl.dll
2009-10-19 21:00:54 ----A---- C:\Windows\system32\WcnNetsh.dll
2009-10-19 21:00:54 ----A---- C:\Windows\system32\SLCommDlg.dll
2009-10-19 21:00:54 ----A---- C:\Windows\system32\oleaut32.dll
2009-10-19 21:00:53 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-10-19 21:00:53 ----A---- C:\Windows\system32\IKEEXT.DLL
2009-10-19 21:00:52 ----A---- C:\Windows\system32\netshell.dll
2009-10-19 21:00:52 ----A---- C:\Windows\system32\compcln.exe
2009-10-19 21:00:52 ----A---- C:\Windows\system32\apds.dll
2009-10-19 21:00:51 ----A---- C:\Windows\system32\winhttp.dll
2009-10-19 21:00:51 ----A---- C:\Windows\system32\mswstr10.dll
2009-10-19 21:00:51 ----A---- C:\Windows\system32\audiosrv.dll
2009-10-19 21:00:50 ----A---- C:\Windows\system32\xmlfilter.dll
2009-10-19 21:00:50 ----A---- C:\Windows\system32\msctf.dll
2009-10-19 21:00:50 ----A---- C:\Windows\system32\emdmgmt.dll
2009-10-19 21:00:49 ----A---- C:\Windows\system32\QAGENTRT.DLL
2009-10-19 21:00:49 ----A---- C:\Windows\system32\msvcrt.dll
2009-10-19 21:00:49 ----A---- C:\Windows\system32\gdi32.dll
2009-10-19 21:00:48 ----A---- C:\Windows\system32\VSSVC.exe
2009-10-19 21:00:48 ----A---- C:\Windows\system32\mfc42u.dll
2009-10-19 21:00:48 ----A---- C:\Windows\system32\iphlpsvc.dll
2009-10-19 21:00:47 ----A---- C:\Windows\system32\SLUI.exe
2009-10-19 21:00:47 ----A---- C:\Windows\system32\eapphost.dll
2009-10-19 21:00:46 ----A---- C:\Windows\system32\sqlsrv32.dll
2009-10-19 21:00:46 ----A---- C:\Windows\system32\msrd2x40.dll
2009-10-19 21:00:45 ----A---- C:\Windows\system32\propdefs.dll
2009-10-19 21:00:45 ----A---- C:\Windows\system32\odbc32.dll
2009-10-19 21:00:44 ----A---- C:\Windows\system32\winresume.exe
2009-10-19 21:00:43 ----A---- C:\Windows\system32\shdocvw.dll
2009-10-19 21:00:42 ----A---- C:\Windows\system32\wevtutil.exe
2009-10-19 21:00:42 ----A---- C:\Windows\system32\dbgeng.dll
2009-10-19 21:00:41 ----A---- C:\Windows\system32\mssitlb.dll
2009-10-19 21:00:39 ----A---- C:\Windows\system32\WsmSvc.dll
2009-10-19 21:00:39 ----A---- C:\Windows\system32\swprv.dll
2009-10-19 21:00:39 ----A---- C:\Windows\system32\mmcndmgr.dll
2009-10-19 21:00:38 ----A---- C:\Windows\system32\usp10.dll
2009-10-19 21:00:37 ----A---- C:\Windows\system32\vds.exe
2009-10-19 21:00:37 ----A---- C:\Windows\system32\msctfp.dll
2009-10-19 21:00:37 ----A---- C:\Windows\system32\fdBthProxy.dll
2009-10-19 21:00:37 ----A---- C:\Windows\system32\drvinst.exe
2009-10-19 21:00:37 ----A---- C:\Windows\system32\devmgr.dll
2009-10-19 21:00:36 ----A---- C:\Windows\system32\netlogon.dll
2009-10-19 21:00:36 ----A---- C:\Windows\system32\msscb.dll
2009-10-19 21:00:36 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2009-10-19 21:00:36 ----A---- C:\Windows\system32\BFE.DLL
2009-10-19 21:00:36 ----A---- C:\Windows\system32\adsldpc.dll
2009-10-19 21:00:35 ----A---- C:\Windows\system32\Wldap32.dll
2009-10-19 21:00:35 ----A---- C:\Windows\system32\wcnwiz.dll
2009-10-19 21:00:35 ----A---- C:\Windows\system32\evr.dll
2009-10-19 21:00:34 ----A---- C:\Windows\system32\WSDApi.dll
2009-10-19 21:00:34 ----A---- C:\Windows\system32\WMVSDECD.DLL
2009-10-19 21:00:34 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-10-19 21:00:34 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-10-19 21:00:33 ----A---- C:\Windows\system32\wercon.exe
2009-10-19 21:00:33 ----A---- C:\Windows\system32\services.exe
2009-10-19 21:00:32 ----A---- C:\Windows\system32\wcncsvc.dll
2009-10-19 21:00:32 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-10-19 21:00:32 ----A---- C:\Windows\system32\mimefilt.dll
2009-10-19 21:00:32 ----A---- C:\Windows\system32\comdlg32.dll
2009-10-19 21:00:32 ----A---- C:\Windows\system32\certcli.dll
2009-10-19 21:00:32 ----A---- C:\Windows\system32\adtschema.dll
2009-10-19 21:00:31 ----A---- C:\Windows\system32\mswdat10.dll
2009-10-19 21:00:31 ----A---- C:\Windows\system32\msjter40.dll
2009-10-19 21:00:31 ----A---- C:\Windows\system32\msdtcprx.dll
2009-10-19 21:00:31 ----A---- C:\Windows\system32\msdrm.dll
2009-10-19 21:00:31 ----A---- C:\Windows\system32\ipsmsnap.dll
2009-10-19 21:00:30 ----A---- C:\Windows\system32\umpnpmgr.dll
2009-10-19 21:00:30 ----A---- C:\Windows\system32\taskeng.exe
2009-10-19 21:00:30 ----A---- C:\Windows\system32\rtffilt.dll
2009-10-19 21:00:30 ----A---- C:\Windows\system32\reg.exe
2009-10-19 21:00:30 ----A---- C:\Windows\system32\dnsapi.dll
2009-10-19 21:00:29 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-10-19 21:00:29 ----A---- C:\Windows\system32\certutil.exe
2009-10-19 21:00:28 ----A---- C:\Windows\system32\w32time.dll
2009-10-19 21:00:28 ----A---- C:\Windows\system32\IPSECSVC.DLL
2009-10-19 21:00:28 ----A---- C:\Windows\system32\bcrypt.dll
2009-10-19 21:00:27 ----A---- C:\Windows\system32\rsaenh.dll
2009-10-19 21:00:27 ----A---- C:\Windows\system32\msshooks.dll
2009-10-19 21:00:27 ----A---- C:\Windows\system32\msscntrs.dll
2009-10-19 21:00:27 ----A---- C:\Windows\system32\bthserv.dll
2009-10-19 21:00:26 ----A---- C:\Windows\system32\TsWpfWrp.exe
2009-10-19 21:00:26 ----A---- C:\Windows\system32\msstrc.dll
2009-10-19 21:00:26 ----A---- C:\Windows\system32\msihnd.dll
2009-10-19 21:00:26 ----A---- C:\Windows\system32\MMDevAPI.dll
2009-10-19 21:00:25 ----A---- C:\Windows\system32\inetcomm.dll
2009-10-19 21:00:24 ----A---- C:\Windows\system32\netapi32.dll
2009-10-19 21:00:24 ----A---- C:\Windows\system32\dfshim.dll
2009-10-19 21:00:23 ----A---- C:\Windows\system32\mtxclu.dll
2009-10-19 21:00:23 ----A---- C:\Windows\system32\inetpp.dll
2009-10-19 21:00:22 ----A---- C:\Windows\system32\mscories.dll
2009-10-19 21:00:22 ----A---- C:\Windows\system32\hidserv.dll
2009-10-19 21:00:22 ----A---- C:\Windows\system32\fundisc.dll
2009-10-19 21:00:22 ----A---- C:\Windows\system32\cryptsvc.dll
2009-10-19 21:00:21 ----A---- C:\Windows\system32\wmicmiplugin.dll
2009-10-19 21:00:21 ----A---- C:\Windows\system32\termsrv.dll
2009-10-19 21:00:21 ----A---- C:\Windows\system32\profsvc.dll
2009-10-19 21:00:21 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2009-10-19 21:00:19 ----A---- C:\Windows\system32\wdc.dll
2009-10-19 21:00:19 ----A---- C:\Windows\system32\shsvcs.dll
2009-10-19 21:00:19 ----A---- C:\Windows\system32\msiexec.exe
2009-10-19 21:00:19 ----A---- C:\Windows\system32\imapi.dll
2009-10-19 21:00:19 ----A---- C:\Windows\system32\chsbrkr.dll
2009-10-19 21:00:18 ----A---- C:\Windows\system32\rasmans.dll
2009-10-19 21:00:18 ----A---- C:\Windows\system32\pnidui.dll
2009-10-19 21:00:18 ----A---- C:\Windows\system32\iassdo.dll
2009-10-19 21:00:17 ----A---- C:\Windows\system32\spoolsv.exe
2009-10-19 21:00:17 ----A---- C:\Windows\system32\scrrun.dll
2009-10-19 21:00:17 ----A---- C:\Windows\system32\icardres.dll
2009-10-19 21:00:17 ----A---- C:\Windows\system32\autofmt.exe
2009-10-19 21:00:16 ----A---- C:\Windows\system32\wersvc.dll
2009-10-19 21:00:16 ----A---- C:\Windows\system32\slmgr.vbs
2009-10-19 21:00:16 ----A---- C:\Windows\system32\PSHED.DLL
2009-10-19 21:00:16 ----A---- C:\Windows\system32\pdh.dll
2009-10-19 21:00:15 ----A---- C:\Windows\system32\pidgenx.dll
2009-10-19 21:00:15 ----A---- C:\Windows\system32\dhcpcsvc.dll
2009-10-19 21:00:15 ----A---- C:\Windows\system32\CertEnrollUI.dll
2009-10-19 21:00:15 ----A---- C:\Windows\system32\azroles.dll
2009-10-19 21:00:13 ----A---- C:\Windows\system32\wmpmde.dll
2009-10-19 21:00:13 ----A---- C:\Windows\system32\winlogon.exe
2009-10-19 21:00:13 ----A---- C:\Windows\system32\SyncCenter.dll
2009-10-19 21:00:12 ----A---- C:\Windows\system32\SLUINotify.dll
2009-10-19 21:00:12 ----A---- C:\Windows\system32\msjetoledb40.dll
2009-10-19 21:00:12 ----A---- C:\Windows\system32\comuid.dll
2009-10-19 21:00:11 ----A---- C:\Windows\system32\sethc.exe
2009-10-19 21:00:11 ----A---- C:\Windows\system32\ncrypt.dll
2009-10-19 21:00:11 ----A---- C:\Windows\system32\kd1394.dll
2009-10-19 21:00:11 ----A---- C:\Windows\system32\certmgr.dll
2009-10-19 21:00:10 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-10-19 21:00:10 ----A---- C:\Windows\system32\untfs.dll
2009-10-19 21:00:10 ----A---- C:\Windows\system32\spp.dll
2009-10-19 21:00:10 ----A---- C:\Windows\system32\scrobj.dll
2009-10-19 21:00:10 ----A---- C:\Windows\system32\iassam.dll
2009-10-19 21:00:09 ----A---- C:\Windows\system32\wisptis.exe
2009-10-19 21:00:09 ----A---- C:\Windows\system32\taskcomp.dll
2009-10-19 21:00:09 ----A---- C:\Windows\system32\rtutils.dll
2009-10-19 21:00:09 ----A---- C:\Windows\system32\dwm.exe
2009-10-19 21:00:08 ----A---- C:\Windows\system32\autochk.exe
2009-10-19 21:00:07 ----A---- C:\Windows\system32\printui.dll
2009-10-19 21:00:07 ----A---- C:\Windows\system32\iasnap.dll
2009-10-19 21:00:07 ----A---- C:\Windows\system32\autoconv.exe
2009-10-19 21:00:06 ----A---- C:\Windows\system32\winsrv.dll
2009-10-19 21:00:06 ----A---- C:\Windows\system32\cscript.exe
2009-10-19 21:00:05 ----A---- C:\Windows\system32\wow32.dll
2009-10-19 21:00:05 ----A---- C:\Windows\system32\userenv.dll
2009-10-19 21:00:05 ----A---- C:\Windows\system32\onex.dll
2009-10-19 21:00:05 ----A---- C:\Windows\system32\kdcom.dll
2009-10-19 21:00:05 ----A---- C:\Windows\system32\basecsp.dll
2009-10-19 21:00:05 ----A---- C:\Windows\system32\audiodg.exe
2009-10-19 21:00:04 ----A---- C:\Windows\system32\osk.exe
2009-10-19 21:00:04 ----A---- C:\Windows\system32\mswsock.dll
2009-10-19 21:00:00 ----A---- C:\Windows\system32\kdusb.dll
2009-10-19 20:59:59 ----A---- C:\Windows\system32\winmm.dll
2009-10-19 20:59:59 ----A---- C:\Windows\system32\spcmsg.dll
2009-10-19 20:59:59 ----A---- C:\Windows\system32\RelMon.dll
2009-10-19 20:59:59 ----A---- C:\Windows\system32\rdpencom.dll
2009-10-19 20:59:58 ----A---- C:\Windows\system32\WinSCard.dll
2009-10-19 20:59:58 ----A---- C:\Windows\system32\WerFaultSecure.exe
2009-10-19 20:59:58 ----A---- C:\Windows\system32\offfilt.dll
2009-10-19 20:59:58 ----A---- C:\Windows\system32\msftedit.dll
2009-10-19 20:59:57 ----A---- C:\Windows\system32\dnsrslvr.dll
2009-10-19 20:59:56 ----A---- C:\Windows\system32\WerFault.exe
2009-10-19 20:59:56 ----A---- C:\Windows\system32\Utilman.exe
2009-10-19 20:59:56 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2009-10-19 20:59:56 ----A---- C:\Windows\system32\secproc_ssp.dll
2009-10-19 20:59:55 ----A---- C:\Windows\system32\wsepno.dll
2009-10-19 20:59:55 ----A---- C:\Windows\system32\stobject.dll
2009-10-19 20:59:55 ----A---- C:\Windows\system32\mfplat.dll
2009-10-19 20:59:55 ----A---- C:\Windows\system32\diskraid.exe
2009-10-19 20:59:55 ----A---- C:\Windows\system32\apphelp.dll
2009-10-19 20:59:54 ----A---- C:\Windows\system32\SndVol.exe
2009-10-19 20:59:54 ----A---- C:\Windows\system32\prnntfy.dll
2009-10-19 20:59:54 ----A---- C:\Windows\system32\msnetobj.dll
2009-10-19 20:59:54 ----A---- C:\Windows\system32\mscms.dll
2009-10-19 20:59:54 ----A---- C:\Windows\system32\mcmde.dll
2009-10-19 20:59:54 ----A---- C:\Windows\system32\adsmsext.dll
2009-10-19 20:59:53 ----A---- C:\Windows\system32\wscript.exe
2009-10-19 20:59:53 ----A---- C:\Windows\system32\wiaservc.dll
2009-10-19 20:59:53 ----A---- C:\Windows\system32\sysclass.dll
2009-10-19 20:59:53 ----A---- C:\Windows\system32\odbccp32.dll
2009-10-19 20:59:53 ----A---- C:\Windows\system32\iasdatastore.dll
2009-10-19 20:59:52 ----A---- C:\Windows\system32\ulib.dll
2009-10-19 20:59:51 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2009-10-19 20:59:51 ----A---- C:\Windows\system32\dsound.dll
2009-10-19 20:59:51 ----A---- C:\Windows\system32\cryptui.dll
2009-10-19 20:59:50 ----A---- C:\Windows\system32\wscntfy.dll
2009-10-19 20:59:50 ----A---- C:\Windows\system32\rastapi.dll
2009-10-19 20:59:50 ----A---- C:\Windows\system32\pnpsetup.dll
2009-10-19 20:59:50 ----A---- C:\Windows\system32\fdProxy.dll
2009-10-19 20:59:49 ----A---- C:\Windows\system32\wlangpui.dll
2009-10-19 20:59:49 ----A---- C:\Windows\system32\ipsecsnp.dll
2009-10-19 20:59:49 ----A---- C:\Windows\system32\brcpl.dll
2009-10-19 20:59:48 ----A---- C:\Windows\system32\wscsvc.dll
2009-10-19 20:59:48 ----A---- C:\Windows\system32\vdsdyn.dll
2009-10-19 20:59:48 ----A---- C:\Windows\system32\rastls.dll
2009-10-19 20:59:48 ----A---- C:\Windows\system32\iashlpr.dll
2009-10-19 20:59:48 ----A---- C:\Windows\system32\gpapi.dll
2009-10-19 20:59:48 ----A---- C:\Windows\system32\diskpart.exe
2009-10-19 20:59:47 ----A---- C:\Windows\system32\WMVENCOD.DLL
2009-10-19 20:59:47 ----A---- C:\Windows\system32\logman.exe
2009-10-19 20:59:46 ----A---- C:\Windows\system32\regsvc.dll
2009-10-19 20:59:46 ----A---- C:\Windows\system32\rasapi32.dll
2009-10-19 20:59:46 ----A---- C:\Windows\system32\ntprint.dll
2009-10-19 20:59:45 ----A---- C:\Windows\system32\zipfldr.dll
2009-10-19 20:59:45 ----A---- C:\Windows\system32\wusa.exe
2009-10-19 20:59:45 ----A---- C:\Windows\system32\mscorier.dll
2009-10-19 20:59:45 ----A---- C:\Windows\system32\iasrad.dll
2009-10-19 20:59:45 ----A---- C:\Windows\system32\findstr.exe
2009-10-19 20:59:44 ----A---- C:\Windows\system32\wshext.dll
2009-10-19 20:59:44 ----A---- C:\Windows\system32\wpccpl.dll
2009-10-19 20:59:44 ----A---- C:\Windows\system32\netcenter.dll
2009-10-19 20:59:42 ----A---- C:\Windows\system32\wer.dll
2009-10-19 20:59:42 ----A---- C:\Windows\system32\rasdlg.dll
2009-10-19 20:59:42 ----A---- C:\Windows\system32\iassvcs.dll
2009-10-19 20:59:41 ----A---- C:\Windows\system32\wsnmp32.dll
2009-10-19 20:59:41 ----A---- C:\Windows\system32\themecpl.dll
2009-10-19 20:59:39 ----A---- C:\Windows\system32\uxsms.dll
2009-10-19 20:59:39 ----A---- C:\Windows\system32\tsbyuv.dll
2009-10-19 20:59:39 ----A---- C:\Windows\system32\srvsvc.dll
2009-10-19 20:59:39 ----A---- C:\Windows\system32\mssprxy.dll
2009-10-19 20:59:38 ----A---- C:\Windows\system32\scansetting.dll
2009-10-19 20:59:38 ----A---- C:\Windows\system32\ntmarta.dll
2009-10-19 20:59:38 ----A---- C:\Windows\system32\msutb.dll
2009-10-19 20:59:38 ----A---- C:\Windows\system32\mstlsapi.dll
2009-10-19 20:59:38 ----A---- C:\Windows\system32\iasads.dll
2009-10-19 20:59:37 ----A---- C:\Windows\system32\slcc.dll
2009-10-19 20:59:37 ----A---- C:\Windows\system32\powrprof.dll
2009-10-19 20:59:37 ----A---- C:\Windows\system32\mstsc.exe
2009-10-19 20:59:36 ----A---- C:\Windows\system32\powercpl.dll
2009-10-19 20:59:36 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2009-10-19 20:59:36 ----A---- C:\Windows\system32\networkmap.dll
2009-10-19 20:59:36 ----A---- C:\Windows\system32\iasacct.dll
2009-10-19 20:59:36 ----A---- C:\Windows\system32\authz.dll
2009-10-19 20:59:35 ----A---- C:\Windows\system32\sud.dll
2009-10-19 20:59:35 ----A---- C:\Windows\system32\newdev.exe
2009-10-19 20:59:35 ----A---- C:\Windows\system32\dot3svc.dll
2009-10-19 20:59:35 ----A---- C:\Windows\system32\connect.dll
2009-10-19 20:59:34 ----A---- C:\Windows\system32\themeui.dll
2009-10-19 20:59:34 ----A---- C:\Windows\system32\systemcpl.dll
2009-10-19 20:59:34 ----A---- C:\Windows\system32\samlib.dll
2009-10-19 20:59:34 ----A---- C:\Windows\system32\pcaui.dll
2009-10-19 20:59:34 ----A---- C:\Windows\system32\mmci.dll
2009-10-19 20:59:34 ----A---- C:\Windows\system32\accessibilitycpl.dll
2009-10-19 20:59:33 ----A---- C:\Windows\system32\usercpl.dll
2009-10-19 20:59:33 ----A---- C:\Windows\system32\autoplay.dll
2009-10-19 20:59:32 ----A---- C:\Windows\system32\wlanpref.dll
2009-10-19 20:59:32 ----A---- C:\Windows\system32\rpchttp.dll
2009-10-19 20:59:32 ----A---- C:\Windows\system32\qdvd.dll
2009-10-19 20:59:31 ----A---- C:\Windows\system32\wpcao.dll
2009-10-19 20:59:31 ----A---- C:\Windows\system32\vdsutil.dll
2009-10-19 20:59:31 ----A---- C:\Windows\system32\regapi.dll
2009-10-19 20:59:31 ----A---- C:\Windows\system32\msinfo32.exe
2009-10-19 20:59:30 ----A---- C:\Windows\system32\tapisrv.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\scksp.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\scesrv.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\psisdecd.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\oleprn.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\mpr.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\imm32.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\feclient.dll
2009-10-19 20:59:30 ----A---- C:\Windows\system32\AudioSes.dll
2009-10-19 20:59:29 ----A---- C:\Windows\system32\wscisvif.dll
2009-10-19 20:59:29 ----A---- C:\Windows\system32\rekeywiz.exe
2009-10-19 20:59:29 ----A---- C:\Windows\system32\iaspolcy.dll
2009-10-19 20:59:29 ----A---- C:\Windows\system32\Faultrep.dll
2009-10-19 20:59:29 ----A---- C:\Windows\system32\dot3msm.dll
2009-10-19 20:59:28 ----A---- C:\Windows\system32\sdclt.exe
2009-10-19 20:59:28 ----A---- C:\Windows\system32\qedit.dll
2009-10-19 20:59:28 ----A---- C:\Windows\system32\ncryptui.dll
2009-10-19 20:59:28 ----A---- C:\Windows\system32\dpapimig.exe
2009-10-19 20:59:28 ----A---- C:\Windows\system32\DeviceEject.exe
2009-10-19 20:59:27 ----A---- C:\Windows\system32\TSTheme.exe
2009-10-19 20:59:27 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2009-10-19 20:59:27 ----A---- C:\Windows\system32\scecli.dll
2009-10-19 20:59:27 ----A---- C:\Windows\system32\rasplap.dll
2009-10-19 20:59:27 ----A---- C:\Windows\system32\rasgcw.dll
2009-10-19 20:59:27 ----A---- C:\Windows\system32\pnpui.dll
2009-10-19 20:59:27 ----A---- C:\Windows\system32\perfdisk.dll
2009-10-19 20:59:27 ----A---- C:\Windows\system32\hdwwiz.exe
2009-10-19 20:59:27 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2009-10-19 20:59:27 ----A---- C:\Windows\system32\certreq.exe
2009-10-19 20:59:26 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-10-19 20:59:26 ----A---- C:\Windows\system32\spwinsat.dll
2009-10-19 20:59:26 ----A---- C:\Windows\system32\cmmon32.exe
2009-10-19 20:59:25 ----A---- C:\Windows\system32\whealogr.dll
2009-10-19 20:59:25 ----A---- C:\Windows\system32\tcpmon.dll
2009-10-19 20:59:25 ----A---- C:\Windows\system32\PnPUnattend.exe
2009-10-19 20:59:25 ----A---- C:\Windows\system32\fdWSD.dll
2009-10-19 20:59:24 ----A---- C:\Windows\system32\srcore.dll
2009-10-19 20:59:24 ----A---- C:\Windows\system32\SCardSvr.dll
2009-10-19 20:59:24 ----A---- C:\Windows\system32\conime.exe
2009-10-19 20:59:24 ----A---- C:\Windows\system32\cmdial32.dll
2009-10-19 20:59:23 ----A---- C:\Windows\system32\wiaaut.dll
2009-10-19 20:59:23 ----A---- C:\Windows\system32\SnippingTool.exe
2009-10-19 20:59:23 ----A---- C:\Windows\system32\raschap.dll
2009-10-19 20:59:23 ----A---- C:\Windows\system32\MSVidCtl.dll
2009-10-19 20:59:23 ----A---- C:\Windows\system32\fontext.dll
2009-10-19 20:59:22 ----A---- C:\Windows\system32\WMVXENCD.DLL
2009-10-19 20:59:22 ----A---- C:\Windows\system32\wlanui.dll
2009-10-19 20:59:22 ----A---- C:\Windows\system32\shwebsvc.dll
2009-10-19 20:59:22 ----A---- C:\Windows\system32\rasppp.dll
2009-10-19 20:59:22 ----A---- C:\Windows\system32\PnPutil.exe
2009-10-19 20:59:22 ----A---- C:\Windows\system32\dsprop.dll
2009-10-19 20:59:21 ----A---- C:\Windows\system32\oobefldr.dll
2009-10-19 20:59:21 ----A---- C:\Windows\system32\dimsroam.dll
2009-10-19 20:59:20 ----A---- C:\Windows\system32\shsetup.dll
2009-10-19 20:59:20 ----A---- C:\Windows\system32\rasmontr.dll
2009-10-19 20:59:20 ----A---- C:\Windows\system32\modemui.dll
2009-10-19 20:59:19 ----A---- C:\Windows\system32\mscandui.dll
2009-10-19 20:59:19 ----A---- C:\Windows\system32\chtbrkr.dll
2009-10-19 20:59:18 ----A---- C:\Windows\system32\wmdrmsdk.dll
2009-10-19 20:59:18 ----A---- C:\Windows\system32\wlgpclnt.dll
2009-10-19 20:59:18 ----A---- C:\Windows\system32\dataclen.dll
2009-10-19 20:59:17 ----A---- C:\Windows\system32\smss.exe
2009-10-19 20:59:17 ----A---- C:\Windows\system32\rdpwsx.dll
2009-10-19 20:59:17 ----A---- C:\Windows\system32\netplwiz.dll
2009-10-19 20:59:17 ----A---- C:\Windows\system32\credui.dll
2009-10-19 20:59:17 ----A---- C:\Windows\system32\blackbox.dll
2009-10-19 20:59:16 ----A---- C:\Windows\system32\WSDMon.dll
2009-10-19 20:59:16 ----A---- C:\Windows\system32\wmpeffects.dll
2009-10-19 20:59:16 ----A---- C:\Windows\system32\networkexplorer.dll
2009-10-19 20:59:16 ----A---- C:\Windows\system32\certprop.dll
2009-10-19 20:59:15 ----A---- C:\Windows\system32\wpcsvc.dll
2009-10-19 20:59:15 ----A---- C:\Windows\system32\msscp.dll
2009-10-19 20:59:15 ----A---- C:\Windows\system32\logagent.exe
2009-10-19 20:59:15 ----A---- C:\Windows\system32\InkEd.dll
2009-10-19 20:59:15 ----A---- C:\Windows\system32\ifmon.dll
2009-10-19 20:59:15 ----A---- C:\Windows\system32\gpresult.exe
2009-10-19 20:59:15 ----A---- C:\Windows\system32\cipher.exe
2009-10-19 20:59:14 ----A---- C:\Windows\system32\wscapi.dll
2009-10-19 20:59:14 ----A---- C:\Windows\system32\thawbrkr.dll
2009-10-19 20:59:14 ----A---- C:\Windows\system32\msimtf.dll
2009-10-19 20:59:12 ----A---- C:\Windows\system32\softkbd.dll
2009-10-19 20:59:12 ----A---- C:\Windows\system32\sendmail.dll
2009-10-19 20:59:11 ----A---- C:\Windows\system32\msctfui.dll
2009-10-19 20:59:11 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2009-10-19 20:59:10 ----A---- C:\Windows\system32\olepro32.dll
2009-10-19 20:59:10 ----A---- C:\Windows\system32\drmmgrtn.dll
2009-10-19 20:59:10 ----A---- C:\Windows\system32\dmsynth.dll
2009-10-19 20:59:09 ----A---- C:\Windows\system32\puiapi.dll
2009-10-19 20:59:09 ----A---- C:\Windows\system32\input.dll
2009-10-19 20:59:09 ----A---- C:\Windows\system32\cdd.dll
2009-10-19 20:59:08 ----A---- C:\Windows\system32\wshbth.dll
2009-10-19 20:59:08 ----A---- C:\Windows\system32\version.dll
2009-10-19 20:59:08 ----A---- C:\Windows\system32\SLLUA.exe
2009-10-19 20:59:08 ----A---- C:\Windows\system32\msisip.dll
2009-10-19 20:59:08 ----A---- C:\Windows\system32\mprapi.dll
2009-10-19 20:59:08 ----A---- C:\Windows\system32\ExplorerFrame.dll
2009-10-19 20:59:07 ----A---- C:\Windows\system32\fc.exe
2009-10-19 20:59:06 ----A---- C:\Windows\system32\fdSSDP.dll
2009-10-19 20:59:06 ----A---- C:\Windows\system32\dmusic.dll
2009-10-19 20:59:05 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-10-19 20:59:05 ----A---- C:\Windows\system32\msjint40.dll
2009-10-19 20:59:05 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2009-10-19 20:59:05 ----A---- C:\Windows\system32\l2nacp.dll
2009-10-19 20:59:05 ----A---- C:\Windows\system32\eapp3hst.dll
2009-10-19 20:59:05 ----A---- C:\Windows\system32\cscapi.dll
2009-10-19 20:59:04 ----A---- C:\Windows\system32\wsdchngr.dll
2009-10-19 20:59:04 ----A---- C:\Windows\system32\SMBHelperClass.dll
2009-10-19 20:59:04 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-10-19 20:59:04 ----A---- C:\Windows\system32\ftp.exe
2009-10-19 20:59:04 ----A---- C:\Windows\system32\cscdll.dll
2009-10-19 20:59:03 ----A---- C:\Windows\system32\Storprop.dll
2009-10-19 20:59:03 ----A---- C:\Windows\system32\rasdial.exe
2009-10-19 20:59:03 ----A---- C:\Windows\system32\rasdiag.dll
2009-10-19 20:59:03 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-10-19 20:59:03 ----A---- C:\Windows\system32\bthci.dll
2009-10-19 20:59:02 ----A---- C:\Windows\system32\fdWCN.dll
2009-10-19 20:59:02 ----A---- C:\Windows\system32\dot3cfg.dll
2009-10-19 20:59:02 ----A---- C:\Windows\system32\bthudtask.exe
2009-10-19 20:59:01 ----A---- C:\Windows\system32\ipconfig.exe
2009-10-19 20:59:01 ----A---- C:\Windows\system32\eappcfg.dll
2009-10-19 20:59:01 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2009-10-19 20:59:00 ----A---- C:\Windows\system32\tscupgrd.exe
2009-10-19 20:59:00 ----A---- C:\Windows\system32\slcinst.dll
2009-10-19 20:59:00 ----A---- C:\Windows\system32\networkitemfactory.dll
2009-10-19 20:58:59 ----A---- C:\Windows\system32\nslookup.exe
2009-10-19 20:58:58 ----A---- C:\Windows\system32\eappgnui.dll
2009-10-19 20:58:57 ----A---- C:\Windows\system32\ocsetup.exe
2009-10-19 20:58:57 ----A---- C:\Windows\system32\hbaapi.dll
2009-10-19 20:58:57 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-10-19 20:58:57 ----A---- C:\Windows\system32\fdeploy.dll
2009-10-19 20:58:56 ----A---- C:\Windows\system32\mmcico.dll
2009-10-19 20:58:55 ----A---- C:\Windows\system32\PNPXAssoc.dll
2009-10-19 20:58:54 ----A---- C:\Windows\system32\gpupdate.exe
2009-10-19 20:58:51 ----A---- C:\Windows\system32\csrstub.exe
2009-10-19 20:58:51 ----A---- C:\Windows\system32\cbsra.exe
2009-10-19 20:58:50 ----A---- C:\Windows\system32\iscsilog.dll
2009-10-19 20:58:50 ----A---- C:\Windows\system32\bitsigd.dll
2009-10-19 20:58:49 ----A---- C:\Windows\system32\NcdProp.dll
2009-10-19 20:58:45 ----A---- C:\Windows\system32\vdmdbg.dll
2009-10-19 20:58:45 ----A---- C:\Windows\system32\odbcconf.dll
2009-10-19 20:58:42 ----A---- C:\Windows\system32\slwga.dll
2009-10-19 20:58:42 ----A---- C:\Windows\system32\inetppui.dll
2009-10-19 20:58:41 ----A---- C:\Windows\system32\winrnr.dll
2009-10-19 20:58:40 ----A---- C:\Windows\system32\midimap.dll
2009-10-19 20:57:58 ----A---- C:\Windows\system32\f3ahvoas.dll
2009-10-19 20:57:57 ----A---- C:\Windows\system32\msimsg.dll
2009-10-19 20:56:56 ----A---- C:\Windows\system32\SmiEngine.dll
2009-10-19 20:56:47 ----A---- C:\Windows\system32\wdscore.dll
2009-10-19 20:56:46 ----A---- C:\Windows\system32\PkgMgr.exe
2009-10-19 20:56:30 ----A---- C:\Windows\system32\drvstore.dll
2009-10-15 08:50:15 ----D---- C:\Windows\SQL9_KB970892_ENU
2009-10-13 20:09:25 ----A---- C:\Windows\system32\msasn1.dll
2009-10-13 20:09:17 ----A---- C:\Windows\system32\msv1_0.dll
2009-10-13 20:08:31 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-10-13 20:08:29 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-10-13 20:06:14 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2009-10-06 19:00:53 ----A---- C:\Windows\system32\wups2.dll
2009-10-06 19:00:53 ----A---- C:\Windows\system32\wucltux.dll
2009-10-06 19:00:53 ----A---- C:\Windows\system32\wuaueng.dll
2009-10-06 19:00:53 ----A---- C:\Windows\system32\wuauclt.exe
2009-10-06 19:00:22 ----A---- C:\Windows\system32\wups.dll
2009-10-06 19:00:22 ----A---- C:\Windows\system32\wudriver.dll
2009-10-06 19:00:22 ----A---- C:\Windows\system32\wuapi.dll
2009-10-06 18:59:52 ----A---- C:\Windows\system32\wuwebv.dll
2009-10-06 18:59:52 ----A---- C:\Windows\system32\wuapp.exe
2009-10-02 18:27:08 ----N---- C:\Windows\system32\MpSigStub.exe
======List of files/folders modified in the last 1 months======
2009-11-01 17:35:52 ----D---- C:\Windows\Prefetch
2009-11-01 17:35:44 ----D---- C:\Windows\Temp
2009-11-01 17:35:37 ----RD---- C:\Program Files
2009-11-01 17:27:13 ----D---- C:\Windows\system32\drivers
2009-11-01 17:05:09 ----D---- C:\Users\Tiger\AppData\Roaming\SquirrelSave
2009-11-01 16:59:19 ----SHD---- C:\System Volume Information
2009-11-01 00:02:27 ----D---- C:\SWSHARE
2009-10-31 22:20:36 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-10-31 22:19:19 ----D---- C:\Windows\System32
2009-10-31 22:19:19 ----D---- C:\Windows\inf
2009-10-31 22:19:19 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-10-31 16:42:24 ----D---- C:\Windows\Microsoft.NET
2009-10-31 16:42:03 ----RSD---- C:\Windows\assembly
2009-10-31 15:26:53 ----D---- C:\Windows\winsxs
2009-10-31 15:25:35 ----D---- C:\Windows\system32\catroot
2009-10-30 22:18:08 ----D---- C:\Windows\system32\LogFiles
2009-10-29 15:51:28 ----D---- C:\Windows\rescache
2009-10-29 15:37:33 ----D---- C:\Windows
2009-10-29 15:37:06 ----SHD---- C:\Boot
2009-10-29 15:33:08 ----D---- C:\Windows\system32\catroot2
2009-10-29 15:25:45 ----D---- C:\Program Files\Windows Mail
2009-10-29 15:25:45 ----D---- C:\Program Files\Windows Calendar
2009-10-29 15:25:44 ----D---- C:\Program Files\Movie Maker
2009-10-29 15:25:40 ----D---- C:\Program Files\Windows Sidebar
2009-10-29 15:25:40 ----D---- C:\Program Files\Internet Explorer
2009-10-29 15:25:39 ----D---- C:\Program Files\Windows Media Player
2009-10-29 15:25:38 ----D---- C:\Program Files\Windows Journal
2009-10-29 15:25:33 ----D---- C:\Program Files\Windows Photo Gallery
2009-10-29 15:25:33 ----D---- C:\Program Files\Common Files\System
2009-10-29 15:25:23 ----D---- C:\Windows\servicing
2009-10-29 15:25:23 ----D---- C:\Program Files\Windows Defender
2009-10-29 15:25:22 ----D---- C:\Windows\ehome
2009-10-29 15:24:31 ----D---- C:\Windows\system32\XPSViewer
2009-10-29 15:24:31 ----D---- C:\Windows\system32\sk-SK
2009-10-29 15:24:31 ----D---- C:\Windows\system32\lv-LV
2009-10-29 15:24:31 ----D---- C:\Windows\system32\ko-KR
2009-10-29 15:24:31 ----D---- C:\Windows\system32\hr-HR
2009-10-29 15:24:31 ----D---- C:\Windows\system32\et-EE
2009-10-29 15:24:31 ----D---- C:\Windows\system32\da-DK
2009-10-29 15:24:31 ----D---- C:\Windows\IME
2009-10-29 15:24:28 ----D---- C:\Windows\system32\en-US
2009-10-29 15:24:25 ----D---- C:\Windows\system32\oobe
2009-10-29 15:24:25 ----D---- C:\Windows\system32\it-IT
2009-10-29 15:24:25 ----D---- C:\Windows\system32\el-GR
2009-10-29 15:24:25 ----D---- C:\Windows\system32\de-DE
2009-10-29 15:24:24 ----D---- C:\Windows\system32\migration
2009-10-29 15:24:11 ----D---- C:\Windows\system32\sv-SE
2009-10-29 15:24:11 ----D---- C:\Windows\system32\setup
2009-10-29 15:24:11 ----D---- C:\Windows\system32\ru-RU
2009-10-29 15:24:11 ----D---- C:\Windows\system32\he-IL
2009-10-29 15:24:11 ----D---- C:\Windows\system32\fr-FR
2009-10-29 15:24:11 ----D---- C:\Windows\system32\AdvancedInstallers
2009-10-29 15:24:10 ----D---- C:\Windows\system32\SLUI
2009-10-29 15:24:10 ----D---- C:\Windows\system32\pt-PT
2009-10-29 15:24:10 ----D---- C:\Windows\system32\hu-HU
2009-10-29 15:24:10 ----D---- C:\Windows\system32\fi-FI
2009-10-29 15:24:10 ----D---- C:\Windows\system32\cs-CZ
2009-10-29 15:24:08 ----D---- C:\Windows\system32\zh-TW
2009-10-29 15:24:08 ----D---- C:\Windows\system32\zh-CN
2009-10-29 15:24:08 ----D---- C:\Windows\system32\uk-UA
2009-10-29 15:24:08 ----D---- C:\Windows\system32\sr-Latn-CS
2009-10-29 15:24:08 ----D---- C:\Windows\system32\sl-SI
2009-10-29 15:24:08 ----D---- C:\Windows\system32\ro-RO
2009-10-29 15:24:08 ----D---- C:\Windows\system32\pl-PL
2009-10-29 15:24:08 ----D---- C:\Windows\system32\manifeststore
2009-10-29 15:24:08 ----D---- C:\Windows\system32\ja-JP
2009-10-29 15:24:08 ----D---- C:\Windows\system32\es-ES
2009-10-29 15:24:08 ----D---- C:\Windows\system32\en
2009-10-29 15:24:08 ----D---- C:\Windows\system32\bg-BG
2009-10-29 15:24:06 ----D---- C:\Windows\system32\th-TH
2009-10-29 15:24:03 ----D---- C:\Windows\system32\tr-TR
2009-10-29 15:24:02 ----D---- C:\Windows\system32\wbem
2009-10-29 15:23:57 ----D---- C:\Windows\system32\nl-NL
2009-10-29 15:23:57 ----D---- C:\Windows\system32\nb-NO
2009-10-29 15:23:57 ----D---- C:\Windows\system32\lt-LT
2009-10-29 15:23:57 ----D---- C:\Windows\system32\ar-SA
2009-10-29 15:23:54 ----D---- C:\Windows\system32\migwiz
2009-10-29 15:23:53 ----D---- C:\Windows\system32\pt-BR
2009-10-29 15:20:13 ----RSD---- C:\Windows\Fonts
2009-10-29 15:20:13 ----D---- C:\Windows\AppPatch
2009-10-29 15:19:51 ----D---- C:\Windows\system32\Boot
2009-10-29 15:17:59 ----D---- C:\Windows\system32\RTCOM
2009-10-28 20:26:59 ----D---- C:\Users\Tiger\AppData\Roaming\TrueCrypt
2009-10-28 19:00:46 ----D---- C:\ProgramData\Adobe
2009-10-28 18:57:02 ----SHD---- C:\Windows\Installer
2009-10-28 18:57:01 ----D---- C:\Program Files\Adobe
2009-10-28 18:55:48 ----D---- C:\Program Files\Common Files\Adobe
2009-10-28 18:50:09 ----D---- C:\Users\Tiger\AppData\Roaming\Adobe
2009-10-28 18:50:00 ----D---- C:\Program Files\Common Files
2009-10-28 18:48:18 ----HD---- C:\ProgramData
2009-10-28 16:41:26 ----D---- C:\Program Files\Java
2009-10-28 16:19:45 ----D---- C:\Windows\system32\Tasks
2009-10-28 13:14:17 ----D---- C:\Windows\PolicyDefinitions
2009-10-28 10:59:43 ----HD---- C:\Program Files\InstallShield Installation Information
2009-10-28 10:43:38 ----D---- C:\Program Files\Common Files\microsoft shared
2009-10-28 10:37:11 ----D---- C:\Program Files\Microsoft SQL Server
2009-10-28 10:36:35 ----D---- C:\Program Files\Microsoft.NET
2009-10-28 10:34:26 ----D---- C:\Windows\Registration
2009-10-28 09:15:28 ----D---- C:\Users\Tiger\AppData\Roaming\Lenovo
2009-10-28 09:03:53 ----D---- C:\Program Files\Canon
2009-10-27 17:43:11 ----D---- C:\Windows\Debug
2009-10-20 19:21:24 ----D---- C:\Program Files\Microsoft Games
2009-10-20 19:06:59 ----D---- C:\Program Files\Lenovo Multimedia Center
2009-10-20 18:55:56 ----D---- C:\Windows\ModemLogs
2009-10-20 18:31:07 ----D---- C:\ProgramData\Microsoft Help
2009-10-20 18:25:58 ----D---- C:\Program Files\Microsoft Works
2009-10-20 18:21:04 ----A---- C:\Windows\win.ini
2009-10-02 18:01:57 ----A---- C:\Windows\system32\mrt.exe
[I]to be continued in the next post as the spybot website said this was too long a post
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-09-13 335240]
R1 AvgMfx86;AVG Minifilter x86 Resident Driver; C:\Windows\System32\Drivers\avgmfx86.sys [2009-09-13 27784]
R1 AvgTdiX;AVG Free8 Network Redirector; C:\Windows\System32\Drivers\avgtdix.sys [2009-05-10 108552]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiif32.sys [2006-08-30 13744]
R1 truecrypt;truecrypt; C:\Windows\System32\drivers\truecrypt.sys [2008-04-03 188672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-22 37376]
R2 tvtfilter;tvtfilter; C:\Windows\system32\DRIVERS\tvtfilter.sys [2007-08-21 33536]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2006-11-08 1161888]
R3 ATSWPDRV;(****DEBUG****) AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2007-04-10 140808]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 179712]
R3 BthEnum;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]
R3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 79664]
R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 81200]
R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 16432]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-01-02 2016256]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-03-26 1761696]
R3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-12-19 1786880]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2006-09-13 28224]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial.sys [2006-06-30 26752]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2008-01-19 8192]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-10-23 179896]
R3 TVTI2C;Lenovo SM bus driver; C:\Windows\system32\DRIVERS\Tvti2c.sys [2006-09-13 35264]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-19 11264]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-01-02 2016256]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 RimUsb;BlackBerry Device; C:\Windows\System32\Drivers\RimUsb.sys [2006-07-13 22528]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2006-10-05 9216]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-09-13 297752]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2006-11-15 634988]
R2 FNF5SVC;Fn+F5 Service; C:\Program Files\LENOVO\HOTKEY\FNF5SVC.exe [2007-04-09 54832]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-02-12 355096]
R2 PMSveH;PMSveH; C:\Program Files\Lenovo\PM Driver\PMSveH.exe [2007-03-16 57344]
R2 ProtexisLicensing;ProtexisLicensing; C:\Windows\system32\PSIService.exe [2006-11-03 174656]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 SUService;System Update; c:\Program Files\Lenovo\System Update\SUService.exe [2006-12-15 11776]
R2 ThinkVantage Registry Monitor Service;ThinkVantage Registry Monitor Service; C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe [2007-01-09 644672]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2007-03-02 55936]
R2 TSSCoreService;TSS Core Service; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [2006-12-22 722496]
R2 TVT Backup Protection Service;TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-01-09 569344]
R2 TVT Backup Service;TVT Backup Service; C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe [2007-01-09 950272]
R2 TVT Scheduler;TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [2007-01-09 1118208]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-31 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
-----------------EOF-----------------
Please find below the contents of the info.txt file
info.txt logfile of random's system information tool 1.06 2009-11-01 17:37:31
======Uninstall list======
Access Help-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C6FA39A7-26B1-480A-BC74-6D17531AC222}\Setup.exe" -l0x9 UNINSTALL
Acrobat.com-->msiexec /qb /x {6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Acrobat.com-->MsiExec.exe /I{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A92000000001}
Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log
Agere Systems HDA Modem-->agrsmdel
AVG 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
BlackBerry Desktop Software 4.2-->MsiExec.exe /I{3B7DAD74-8F16-4AEF-B0CA-4072CB1BF9AA}
BlackBerry Desktop Software 4.2-->MsiExec.exe /i{3B7DAD74-8F16-4AEF-B0CA-4072CB1BF9AA}
Broadcom Gigabit Integrated Controller-->MsiExec.exe /X{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}
Canon MP Navigator EX 1.0-->"C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator EX 1.0\uninst.ini
Canon MP610 series-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP610_series /L0x0009
Canon My Printer-->C:\Program Files\Canon\MyPrinter\uninst.exe uninst.ini
Canon Utilities Solution Menu-->C:\Program Files\Canon\SolutionMenu\uninst.exe uninst.ini
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Client Security Solution-->MsiExec.exe /X{0F4EFCE8-E358-4430-A504-F55F32BA1816}
Diskeeper Home-->MsiExec.exe /X{796E076A-82F7-4D49-98C8-DEC0C3BC733A}
Gadwin PrintScreen-->C:\Program Files\Gadwin Systems\PrintScreen\Uninstall.exe
Garmin WebUpdater-->MsiExec.exe /X{366FFC89-C800-4366-B903-B9C4314109A5}
Help Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{986F64DC-FF15-449D-998F-EE3BCEC6666A}\Setup.exe" -l0x9 -AddRemove
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe
Java(TM) 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
Lenovo Bluetooth with Enhanced Data Rate Software 6.0.1.4900-->MsiExec.exe /X{03D1988F-469F-4843-8E6E-E5FE9D17889D}
Lenovo Care Supplement-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6280149E-EFF3-4F1B-BD43-5B7EDD6F620A}\SETUP.EXE" -l0x9 -AddRemove
Lenovo Care-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CF52099A-3BEA-4C41-AEA8-1E190F04D737}\SETUP.EXE" -l0x9 -AddRemove
Lenovo Fingerprint Software-->MsiExec.exe /X{EC422FB2-9F4D-4FB1-A5CE-5F741132EBC5}
Lenovo System Interface Driver-->RunDll32.exe setupapi.dll,InstallHinfSection DefaultUninstall.NTx86 130 C:\Program Files\Lenovo\SMIIF\lnvsmi.inf
Message Center-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}\Setup.exe" -l0x9 -AddRemove
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A40409-6000-11D3-8CFE-0150048383C9}
Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Mozilla Firefox (3.0.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Multitrack Stopwatch-->C:\Windows\IsUninst.exe -f"C:\Program Files\Multitrack Stopwatch\Uninst.isu" -c"C:\Program Files\Multitrack Stopwatch\setupsub.dll" -c"C:\Program Files\Multitrack Stopwatch\setupsub.dll"
On Screen Display-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall.LH 132 C:\Program Files\Lenovo\HOTKEY\tphk_3k.inf
PC-Doctor 5 for Windows-->C:\Program Files\PCDR5\uninst.exe
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
PM Driver-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{62715632-A555-4D9E-9CEC-4F84EB55B07B}
Power Ux Customization-->MsiExec.exe /X{B1F625EB-9691-4889-A864-DA085739F3F0}
Presentation Director-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{65706020-7B6F-41F2-8047-FC69579E386A}\Setup.exe" -l0x9 -AddRemove
Prism-->C:\Program Files\NCH Software\Prism\uninst.exe
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Registry patch for Windows Vista USB S3 PM Enablement-->Rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 130 C:\Program Files\Lenovo\USBPMon\USBPMon.inf
Rescue and Recovery-->MsiExec.exe /X{7E4C16B8-8F76-4940-8505-98E93C00BF19}
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.33-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -l0x9 anything
ScanSoft OmniPage SE 4-->MsiExec.exe /X{DEE88727-779B-47A9-ACEF-F87CA5F92A65}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SquirrelSave (remove only)-->C:\Program Files\SquirrelSave\Uninst.exe
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Update-->MsiExec.exe /X{8675339C-128C-44DD-83BF-0A5D6ABD8297}
ThinkVantage Technologies Welcome Message-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1007F41F-7D69-468E-8017-3849A5A973C2}\SETUP.EXE" -l0x9 anything
TrueCrypt-->"C:\Program Files\TrueCrypt\TrueCrypt Setup.exe" /u C:\Program Files\TrueCrypt\
Uninstall Dual Mode Camera-->"C:\Program Files\JL2005C\unins000.exe"
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office Infopath 2007 Help (KB963662)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63}
Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Outlook 2007 Junk Email Filter (KB974810)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C05FBAD5-A211-4E86-BB51-7E07B80C9233}
VLC media player 1.0.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Wallpapers-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}\Setup.exe" -l0x9 UNINSTALL
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
======Hosts File======
127.0.0.1 007guard.com
127.0.0.1 www.007guard.com
127.0.0.1 008i.com
127.0.0.1 008k.com
127.0.0.1 www.008k.com
127.0.0.1 00hq.com
127.0.0.1 www.00hq.com
127.0.0.1 010402.com
127.0.0.1 032439.com
127.0.0.1 www.032439.com
======Security center information======
AS: Spybot - Search and Destroy (disabled)
AS: Windows Defender
======System event log======
Computer Name: Tiger-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB958481(Update) into Install Requested(Install Requested) state
Record Number: 208043
Source Name: Microsoft-Windows-Servicing
Time Written: 20090913092556.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB958481(Update) into Install Requested(Install Requested) state
Record Number: 208033
Source Name: Microsoft-Windows-Servicing
Time Written: 20090913092556.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB958481(Update) into Install Requested(Install Requested) state
Record Number: 208007
Source Name: Microsoft-Windows-Servicing
Time Written: 20090913092556.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB958481(Update) into Install Requested(Install Requested) state
Record Number: 208002
Source Name: Microsoft-Windows-Servicing
Time Written: 20090913092556.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 4376
Message: Servicing has required reboot to complete the operation of setting package KB958481(Update) into Install Requested(Install Requested) state
Record Number: 207992
Source Name: Microsoft-Windows-Servicing
Time Written: 20090913092556.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
=====Application event log=====
Computer Name: Tiger-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-3651928122-2745401850-1825127654-1003:
Process 2368 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2368 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2368 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2368 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 944 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Record Number: 131512
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20080830231223.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 3
Message:
Record Number: 131252
Source Name: SQLBrowser
Time Written: 20080829170307.000000-000
Event Type: Warning
User:
Computer Name: Tiger-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3651928122-2745401850-1825127654-1003_Classes:
Process 1016 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003_CLASSES
Record Number: 131238
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20080829092443.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-3651928122-2745401850-1825127654-1003:
Process 1016 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2392 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2392 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2392 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Process 2392 (\Device\HarddiskVolume2\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe) has opened key \REGISTRY\USER\S-1-5-21-3651928122-2745401850-1825127654-1003
Record Number: 131237
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20080829092443.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM
Computer Name: Tiger-PC
Event Code: 3
Message:
Record Number: 131195
Source Name: SQLBrowser
Time Written: 20080829085639.000000-000
Event Type: Warning
User:
=====Security event log=====
Computer Name: Tiger-PC
Event Code: 4672
Message: Special privileges assigned to new logon.
Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 56830
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080825093557.753710-000
Event Type: Audit Success
User:
Computer Name: Tiger-PC
Event Code: 4624
Message: An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: TIGER-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon Type: 5
New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x2c8
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name:
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 56829
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080825093557.753710-000
Event Type: Audit Success
User:
Computer Name: Tiger-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.
Subject:
Security ID: S-1-5-18
Account Name: TIGER-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}
Target Server:
Target Server Name: localhost
Additional Information: localhost
Process Information:
Process ID: 0x2c8
Process Name: C:\Windows\System32\services.exe
Network Information:
Network Address: -
Port: -
This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 56828
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080825093557.753710-000
Event Type: Audit Success
User:
Computer Name: Tiger-PC
Event Code: 4672
Message: Special privileges assigned to new logon.
Subject:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5
Privileges: SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeImpersonatePrivilege
Record Number: 56827
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080825093557.363708-000
Event Type: Audit Success
User:
Computer Name: Tiger-PC
Event Code: 4624
Message: An account was successfully logged on.
Subject:
Security ID: S-1-5-18
Account Name: TIGER-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon Type: 5
New Logon:
Security ID: S-1-5-19
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5
Logon GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x2c8
Process Name: C:\Windows\System32\services.exe
Network Information:
Workstation Name:
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 56826
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080825093557.363708-000
Event Type: Audit Success
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Diskeeper Corporation\Diskeeper\;C:\Program Files\Common Files\Lenovo;C:\Program Files\Lenovo\Client Security Solution
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"TPCCommon"=C:\PROGRA~1\Lenovo\LENOVO~2
"TVT"=C:\Program Files\Lenovo
"RR"=C:\Program Files\Lenovo\Rescue and Recovery
"TVTPYDIR"=C:\Program Files\Common Files\Lenovo\Python24
"TVTCOMMON"=C:\Program Files\Common Files\Lenovo
"SWSHARE"=C:\SWSHARE
-----------------EOF-----------------
Thanks
Regards
Candle
Candle,
Nothing really jumping out at me as malicious.
System drive C: has 21 GB (14%) free of 147 GB <--You have an awful lot on this hard drive, still plenty of free space but as full as it is it may tend to slow things down a bit.
Total RAM: 1014 MB (28% free) <--This is the basic amount of ram you should have with Vista, a memory upgrade will speed things up.
Download TFC (http://oldtimer.geekstogo.com/TFC.exe) to your desktop
Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean
Please download Malwarebytes from Here (http://www.malwarebytes.org/mbam-download.php) or Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
http://forums.whatthetech.com/post_a4255_MBAM.PNG
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report and also a new HJT log please
Hello Ken545
Step 1: I downloaded TFC and ran it.
TFC ran and cleaned 101.73 mb
It did not have to remove any files with a reboot, so it did not reboot the system.
Step 2: I downloaded Malwarebytes and ran the program
Please find its log below
Malwarebytes' Anti-Malware 1.41
Database version: 3089
Windows 6.0.6002 Service Pack 2
02/11/2009 21:15:30
mbam-log-2009-11-02 (21-15-30).txt
Scan type: Quick Scan
Objects scanned: 99213
Time elapsed: 9 minute(s), 10 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Step 3:
I downloaded Hijackthis from download.cnet.com and ran the software.
Please find the contents of the log file below
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:27:48, on 02/11/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TPWAUDAP] C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [FingerPrintSoftware] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Startup: SquirrelSave.lnk = C:\Program Files\SquirrelSave\SquirrelSave.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_16.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_16.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {816BE035-1450-40D0-8A3B-BA7825A83A77} (IASRunner Class) - http://download.boulder.ibm.com/ibmdl/pub/pc/pccbbs/bp_pc/acpirexe.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Fn+F5 Service (FNF5SVC) - Lenovo. - C:\Program Files\LENOVO\HOTKEY\FNF5SVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PMSveH - Lenovo - C:\Program Files\Lenovo\PM Driver\PMSveH.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: System Update (SUService) - - c:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: On Screen Display (TPHKSVC) - Unknown owner - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TSS Core Service (TSSCoreService) - IBM - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
--
End of file - 8224 bytes
My one concern about Hijackthis is that there doesn’t seem to be a Windows Vista version. After the scan was completed and I exited Hijackthis, I got a popup from Windows saying something on the lines of “This software may not have installed correctly for this version.” It then gave me the option of reinstalling again using “recommended settings” or to just click a button that said “this program installed correctly.” I simply clicked on the cancel button.
Thanks
Regards
Candle
Hello Candle,
There is no special version of HJT for Vista, it works on all platforms, but with Vista you should have right clicked on the setup icon and selected Run As Administrator, but no harm done.
Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=
Your system appears to be ok, how are things running now ??
Hello Ken545
I ran Hijackthis system scan and checked the entries you asked me to and clicked Fix checked.
Those entries have now gone.
The system is still slow, but this could be due to the fact...like you said earlier...that I have too many things on the hard drive and a very small RAM.
Over the weekend, I will get rid of some stuff from the hard drive. Would you be able to recommend a reliable online backup facility?
I will also add some extra RAM. Hopefully that should do the trick.
Also could you please suggest a way of getting rid of some hard-to-get-rid-of crapware and some software that are not showing up on Windows Add/Remove programs.
Thanks
Candle
Hello Candle,
The best thing for backups are a removable USB Flash drive, you can just copy and paste all your pictures, documents and whatever you want from your hard drive to the flash drive. Take the flash drive out an keep it in a safeplace and you will always have your files if your computer heads south.
This is just an example, the drives from SanDisk are nice and Costco has them pretty reasonable
http://www.costco.com/Common/Category.aspx?ec=BC-EC10626-Cat31022&pos=0&whse=BC&topnav=&cat=31360&eCat=BC|84|31022|31360&lang=en-US
As far as your crapware, this forum is just for malware and virus infection removal, you can post in our sister site for help cleaning out all the not needed programs. Like here, its free but you need to register.
http://forums.whatthetech.com/Microsoft_Windows_f119.html
How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)
Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster and Spyware Guard, they will conflict with the TeaTimer in Spybot , you can still install Spybot Search and Destroy but do not enable the TeaTimer .
Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
Spybot Search and Destroy 1.6 (http://www.safer-networking.org/en/download/)
Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
Spyware Blaster (http://www.javacoolsoftware.com/spywareblaster.html) It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
Spyware Guard (http://www.javacoolsoftware.com/spywareguard.html) It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
IE-Spyad (http://www.pcworld.com/downloads/file/fid,23332-order,1-page,1-c,antispywaretools/description.html)
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
Firefox 3 (http://www.mozilla.org/products/firefox/) It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
Safe Surfn
Ken
Thanks for all your help Ken545
May your tribe increase
Regards
A grateful Candle
thanks for all your help Ken545
May your tribe increase
Regards
Candle
Your very welcome,
Take Care,
Ken :)