Need Help to remove Gooochi [Archive] - Safer-Networking Forums

View Full Version : Need Help to remove Gooochi

racsw

2010-03-06, 00:19

Hello,
This problem, actually a piece of adware, pops up calling itself "Ads by Gooochi" or "Ron by Gooochi".
I use Avast Pro for A/V, it didn't catch it.
I use Spybot (Donated at least twice), but after an update, it didn't remove it, and I tried another piece of software that claimed to be able to remove it, but it didn't.
I also tried your RunAlyzer, but there was nothing there I recognized in the startup sections.
So I posted this a couple of days ago, and have done eveything it asked, including starting this new post. The result from HiJackThis follows:

Thank you in advance,
Robert

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:11:15 PM, on 3/5/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\WINDOWS\System32\regsvr32.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: ezLife browser enhancer qfxzrops - {13813032-6246-4D51-8468-7875BE5C5416} - C:\WINDOWS\system32\qfxzrops.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: gooochi browser enhancer - {A4A9A8E9-A525-6DDA-43C6-C4E5E103F498} - C:\WINDOWS\system32\ankvbgxlbf.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [wcgxujqujvvt] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\ankvbgxlbf.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266844280421
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8335 bytes

Shaba

2010-03-08, 19:20

Hi racsw

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here. (http://www.bleepingcomputer.com/forums/topic114351.html)

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

racsw

2010-03-09, 23:05

Hello,
Here are the two files you asked for. And thank you for all your help.

ComboFix 10-03-09.04 - Robert 03/09/2010 16:54:52.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2431.1675 [GMT -5:00]
Running from: c:\documents and settings\Robert.7F62BC5CA13948F\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100309-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\ezLife
c:\program files\ezLife
c:\program files\ezLife\ezLife\1.3.6.0\uninstall.exe
c:\windows\system32\Data
c:\windows\system32\qfxzrops.dll
c:\windows\system32\SOCKETX.DLL

.
((((((((((((((((((((((((( Files Created from 2010-02-09 to 2010-03-09 )))))))))))))))))))))))))))))))
.

2010-03-06 01:05 . 2010-03-06 01:05 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Local Settings\Application Data\Identities
2010-03-05 15:22 . 2010-03-05 15:22 -------- d-----w- c:\program files\ERUNT
2010-03-05 00:55 . 2010-03-05 00:55 -------- d-----w- c:\documents and settings\All Users\Application Data\XoftSpySE
2010-03-04 16:30 . 2010-03-04 16:30 -------- d-----w- c:\program files\Safer Networking
2010-03-04 14:15 . 2010-03-04 14:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-04 14:15 . 2010-03-04 14:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-04 08:07 . 2010-03-04 11:08 48283 ----a-w- c:\windows\system32\rrwoojtpxsol.exe
2010-03-04 07:59 . 2010-03-04 07:59 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\PKWARE
2010-03-04 07:59 . 2010-03-04 07:59 -------- d-----w- c:\documents and settings\All Users\Application Data\PKWARE
2010-03-04 07:49 . 2010-03-04 08:18 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\LimeWire
2010-03-04 07:48 . 2010-03-04 08:08 -------- d-----w- c:\program files\360Share Pro
2010-03-04 07:12 . 2010-03-04 07:12 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe
2010-03-04 07:12 . 2005-11-09 15:00 462848 ----a-w- c:\windows\system32\HHActiveX.dll
2010-03-04 07:12 . 2005-11-09 15:00 12800 ----a-w- c:\windows\system32\ogg.dll
2010-03-04 07:12 . 2005-11-09 15:00 1012736 ----a-w- c:\windows\system32\vorbis.dll
2010-03-04 07:12 . 2010-03-04 07:12 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Droppix
2010-03-04 07:12 . 2010-03-04 07:12 -------- d-----w- c:\program files\illiminable
2010-03-04 07:12 . 2010-03-04 07:12 -------- d-----w- c:\program files\Common Files\LightScribe
2010-03-04 07:11 . 2010-03-04 07:12 -------- d-----w- c:\program files\Common Files\Droppix
2010-03-04 07:11 . 2005-11-09 15:00 24576 ----a-w- c:\windows\system32\msxml3a.dll
2010-03-04 07:11 . 2005-11-09 15:00 1700352 ----a-w- c:\windows\system32\gdiplus.dll
2010-03-04 07:11 . 2010-03-04 07:11 -------- d-----w- c:\program files\Droppix
2010-03-04 07:11 . 2010-03-04 07:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Droppix
2010-03-03 00:24 . 2006-09-13 10:00 74240 ----a-w- c:\documents and settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP90\LanguageModules\0409\CNMsr71.dll
2010-03-03 00:24 . 2006-09-13 10:00 73216 ----a-w- c:\documents and settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP90\LanguageModules\0411\CNMlr71.dll
2010-03-03 00:24 . 2006-09-13 10:00 42496 ----a-w- c:\documents and settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP90\LanguageModules\0411\CNMsr71.dll
2010-03-03 00:24 . 2006-09-13 10:00 334848 ----a-w- c:\documents and settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP90\LanguageModules\0409\CNMur71.dll
2010-03-03 00:24 . 2006-09-13 10:00 249344 ----a-w- c:\documents and settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP90\LanguageModules\0411\CNMur71.dll
2010-03-03 00:24 . 2006-09-13 10:00 130048 ----a-w- c:\documents and settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon iP90\LanguageModules\0409\CNMlr71.dll
2010-03-03 00:23 . 2010-03-03 00:23 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonBJ
2010-03-03 00:23 . 2006-09-13 10:00 69632 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPP71.DLL
2010-03-03 00:23 . 2006-09-13 10:00 27136 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\CNMPD71.DLL
2010-03-03 00:23 . 2006-09-13 10:00 197632 ----a-w- c:\windows\system32\CNMLM71.DLL
2010-03-03 00:23 . 2010-03-03 00:23 -------- d--h--w- c:\windows\system32\CanonIJ Uninstaller Information
2010-03-03 00:23 . 2010-03-03 00:23 -------- d--h--w- c:\program files\CanonBJ
2010-03-03 00:04 . 2010-03-03 00:04 -------- d-sh--w- c:\documents and settings\Robert.7F62BC5CA13948F\PrivacIE
2010-03-02 23:58 . 2010-03-02 23:59 -------- d-----w- c:\program files\Amara - Flash Slide Show Builder
2010-03-02 23:57 . 2010-03-02 23:57 -------- d-----w- c:\program files\PKWARE
2010-03-02 23:57 . 2010-03-02 23:57 -------- d-----w- c:\program files\Common Files\PKWARE
2010-03-02 23:56 . 2010-03-02 23:56 -------- d-----w- c:\program files\Bonjour
2010-03-02 23:54 . 2010-03-02 23:54 -------- d-----w- c:\windows\Downloaded Installations
2010-03-02 23:52 . 2006-07-14 01:59 2859098 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Adobe\Dreamweaver CS4\en_US\Configuration\Shared\XML Flash Slideshow v3\wizards\ss_wizard_win.exe
2010-03-02 23:52 . 2006-07-14 01:54 2707125 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Adobe\Dreamweaver CS4\en_US\Configuration\Shared\XML Flash Slideshow v3\wizards\ss_styles_easy_wizard_win.exe
2010-03-02 23:52 . 2006-07-14 02:17 2921502 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Adobe\Dreamweaver CS4\en_US\Configuration\Shared\XML Flash Slideshow v3\wizards\layout_wizard_win.exe
2010-03-02 23:52 . 2006-07-14 01:55 3254205 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Adobe\Dreamweaver CS4\en_US\Configuration\Shared\XML Flash Slideshow v3\wizards\layout_easy_wizard_win.exe
2010-03-02 23:52 . 2010-03-02 23:52 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Library
2010-03-02 23:52 . 2010-03-02 23:52 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\com.adobe.ExMan
2010-03-02 20:22 . 2010-03-02 20:22 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-03-02 16:04 . 2010-03-02 16:04 -------- d-----w- c:\windows\system32\scripting
2010-03-02 16:04 . 2010-03-02 16:04 -------- d-----w- c:\windows\l2schemas
2010-03-02 16:04 . 2010-03-02 16:04 -------- d-----w- c:\windows\system32\en
2010-03-02 16:04 . 2010-03-02 16:04 -------- d-----w- c:\windows\system32\bits
2010-03-02 15:53 . 2010-03-02 15:53 -------- d-sh--w- c:\documents and settings\Robert.7F62BC5CA13948F\IETldCache
2010-03-02 15:50 . 2009-12-11 08:38 69120 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-03-02 15:49 . 2010-03-04 01:42 -------- d-----w- c:\windows\ie8updates
2010-03-02 15:49 . 2009-12-21 19:14 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-03-02 15:49 . 2009-12-21 19:14 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2010-03-02 15:49 . 2009-12-21 19:14 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-03-02 15:49 . 2009-12-21 19:14 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-03-02 15:49 . 2009-12-21 19:14 1985536 -c----w- c:\windows\system32\dllcache\iertutil.dll
2010-03-02 15:49 . 2009-12-21 19:14 11070464 -c----w- c:\windows\system32\dllcache\ieframe.dll
2010-03-02 15:48 . 2010-03-02 15:49 -------- dc-h--w- c:\windows\ie8
2010-03-01 22:24 . 2010-03-01 22:24 -------- d-----w- c:\program files\MSXML 4.0
2010-03-01 17:09 . 2008-04-13 18:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-02-28 22:32 . 2007-10-23 14:27 110592 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\U3\temp\cleanup.exe
2010-02-28 22:29 . 2010-02-28 22:29 -------- d-----w- c:\documents and settings\All Users\Application Data\GoodSync
2010-02-28 22:26 . 2010-02-28 22:31 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\GoodSync
2010-02-28 22:26 . 2010-02-28 22:26 -------- d-----w- c:\program files\Siber Systems
2010-02-28 22:23 . 2010-02-28 22:23 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\FastStone
2010-02-28 22:23 . 2010-02-28 22:23 -------- d-----w- c:\program files\FastStone Image Viewer
2010-02-28 22:17 . 2008-05-02 15:41 3493888 ---ha-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\U3\temp\Launchpad Removal.exe
2010-02-28 22:17 . 2010-03-03 20:33 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\U3
2010-02-28 19:10 . 2010-02-28 19:10 49152 ----a-r- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2010-02-28 19:10 . 2010-02-28 19:10 -------- d-----w- c:\program files\Common Files\muvee Technologies
2010-02-28 19:10 . 2010-02-28 19:10 -------- d-----w- c:\program files\Common Files\Nikon
2010-02-28 19:10 . 2010-02-28 19:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Nikon
2010-02-28 19:10 . 2010-02-28 19:10 -------- d-----w- c:\program files\Nikon
2010-02-28 19:09 . 2010-02-28 19:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Ultima_T15
2010-02-28 19:09 . 2010-02-28 19:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Track Settings
2010-02-28 19:09 . 2010-02-28 19:09 -------- d-----w- c:\documents and settings\All Users\Application Data\EnterNHelp
2010-02-28 18:54 . 2010-03-02 15:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-28 18:54 . 2010-02-28 18:54 1812 ----a-w- c:\windows\system32\OLE2SYS2.DLL
2010-02-28 18:54 . 2010-02-28 18:54 -------- d-----w- c:\program files\3D-FTP
2010-02-28 18:54 . 2010-02-28 18:54 -------- d-----w- c:\documents and settings\All Users\Application Data\3D-FTP
2010-02-28 17:52 . 2010-03-04 17:38 68208 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-02-28 17:45 . 2010-02-28 17:45 -------- d-----w- c:\program files\Adobe Media Player
2010-02-28 16:57 . 2010-02-28 17:01 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-02-28 16:56 . 2010-02-28 16:56 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-02-28 16:55 . 2009-08-20 04:50 22872 ----a-r- c:\windows\system32\AdobePDFUI.dll
2010-02-28 16:55 . 2009-08-20 04:50 46928 ----a-r- c:\windows\system32\AdobePDF.dll
2010-02-28 16:47 . 2010-02-28 16:47 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-02-28 16:46 . 2010-03-04 17:29 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-28 16:43 . 2010-02-28 16:43 -------- d-----w- c:\program files\Times Reader
2010-02-28 16:43 . 2010-02-28 16:43 38784 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-28 16:43 . 2010-02-28 16:43 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-02-28 16:43 . 2010-02-28 16:43 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-02-28 16:38 . 2010-03-01 18:43 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Local Settings\Application Data\Adobe
2010-02-28 16:38 . 2010-02-28 16:38 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-02-28 16:38 . 2010-02-28 16:56 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-02-24 13:15 . 2010-02-24 13:15 -------- d-----w- c:\program files\PremiumSoft
2010-02-24 10:55 . 2010-02-24 10:55 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-02-23 08:01 . 2010-03-02 16:02 -------- d-----w- c:\windows\ServicePackFiles
2010-02-23 00:40 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2010-02-23 00:40 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-02-23 00:39 . 2009-12-31 16:50 353792 -c----w- c:\windows\system32\dllcache\srv.sys
2010-02-23 00:34 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-02-23 00:31 . 2009-10-15 16:28 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2010-02-23 00:31 . 2009-10-15 16:28 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2010-02-23 00:30 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
2010-02-23 00:30 . 2009-06-25 08:25 730112 -c----w- c:\windows\system32\dllcache\lsasrv.dll
2010-02-23 00:30 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2010-02-23 00:30 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
2010-02-23 00:30 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
2010-02-23 00:30 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-02-23 00:30 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
2010-02-23 00:30 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe
2010-02-23 00:30 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2010-02-23 00:30 . 2009-08-05 01:44 2189184 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-23 00:30 . 2009-08-04 15:13 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-23 00:30 . 2009-08-04 14:20 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-23 00:25 . 2009-12-04 18:22 455424 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-23 00:22 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys
2010-02-23 00:21 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2010-02-23 00:21 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2010-02-23 00:18 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-04 17:01 . 2010-03-04 16:21 -------- d-----w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Download Manager
2010-03-04 16:21 . 2010-03-04 16:21 348160 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-22b8516e-n\msvcr71.dll
2010-03-04 16:21 . 2010-03-04 16:21 503808 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-22b8516e-n\msvcp71.dll
2010-03-04 16:21 . 2010-03-04 16:21 499712 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-22b8516e-n\jmc.dll
2010-03-04 16:21 . 2010-03-04 16:21 -------- d-----w- c:\program files\Common Files\Java
2010-03-04 16:21 . 2010-03-04 16:21 61440 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-21598f33-n\decora-sse.dll
2010-03-04 16:21 . 2010-03-04 16:21 12800 ----a-w- c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-21598f33-n\decora-d3d.dll
2010-03-04 16:21 . 2010-03-04 16:21 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-03-04 16:21 . 2010-03-04 16:21 -------- d-----w- c:\program files\Java
2010-03-02 16:07 . 2010-02-19 21:56 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-28 19:09 . 2010-02-28 19:09 20 ---h--w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2010-02-28 19:09 . 2010-02-22 12:52 -------- d-----w- c:\program files\Common Files\InstallShield
2010-02-22 14:47 . 2010-02-22 12:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-22 12:52 . 2010-02-22 12:52 294912 ----a-w- c:\windows\HideWin.exe
2010-02-22 12:52 . 2010-02-22 12:52 -------- d-----w- c:\program files\Realtek
2010-02-21 17:11 . 2010-01-27 01:14 553472 ----a-w- c:\windows\system32\ankvbgxlbf.dll
2010-02-19 21:56 . 2010-02-19 21:56 -------- d-----w- c:\program files\microsoft frontpage
2010-02-19 21:53 . 2010-02-19 21:53 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-12 04:03 . 2010-02-22 13:36 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-22 13:36 4104192 ----a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-22 13:36 4077672 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-22 13:36 2259560 ----a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-22 13:36 14458880 ----a-w- c:\windows\system32\nvoglnt.dll
2010-01-12 04:03 . 2010-02-22 13:36 10276768 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-01-12 04:03 . 2010-02-22 13:36 6359168 ----a-w- c:\windows\system32\nv4_disp.dll
2010-01-12 04:03 . 2010-02-22 13:36 2283526 ----a-w- c:\windows\system32\nvdata.bin
2010-01-12 04:03 . 2010-02-22 13:36 182888 ----a-w- c:\windows\system32\nvcodins.dll
2010-01-12 04:03 . 2010-02-22 13:36 182888 ----a-w- c:\windows\system32\nvcod.dll
2010-01-12 04:03 . 2010-02-22 13:36 11632640 ----a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2010-02-22 13:36 1081344 ----a-w- c:\windows\system32\nvapi.dll
2010-01-12 03:17 . 2010-01-12 03:17 278120 ----a-w- c:\windows\system32\nvmccs.dll
2010-01-12 03:17 . 2010-01-12 03:17 154216 ----a-w- c:\windows\system32\nvsvc32.exe
2010-01-12 03:17 . 2010-01-12 03:17 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-01-12 03:17 . 2010-01-12 03:17 13666408 ----a-w- c:\windows\system32\nvcpl.dll
2010-01-12 03:17 . 2010-01-12 03:17 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-01-12 03:17 . 2010-01-12 03:17 81920 ----a-w- c:\windows\system32\nvwddi.dll
2009-12-31 16:50 . 2004-08-04 04:14 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2004-08-04 05:56 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2010-02-19 21:52 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-08-04 05:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A4A9A8E9-A525-6DDA-43C6-C4E5E103F498}]
2010-02-21 17:11 553472 ----a-w- c:\windows\system32\ankvbgxlbf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2009-12-03 21:52 574096 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2009-12-03 21:52 574096 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2009-12-03 21:52 574096 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-05-18 2363392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-05-05 14396416]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-12 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-12 13666408]
"P17Helper"="P17.dll" [2005-05-04 64512]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2009-12-03 670864]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-12-22 38840]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-12-21 640440]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"wcgxujqujvvt"="c:\windows\system32\ankvbgxlbf.dll" [2010-02-21 553472]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Nikon Monitor.lnk - c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe [2007-10-18 479232]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"nwiz"=nwiz.exe /installquiet

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS4\\Dreamweaver.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Droppix\\Droppix Recorder XE 2.x\\Droppix Recorder\\DxRecord.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/22/2010 7:18 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/22/2010 7:18 PM 20560]
S3 Droppix Service;Droppix Service;c:\program files\Common Files\Droppix\DxService.exe [3/4/2010 2:11 AM 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-05-18 22:54 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.msn.com
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Robert.7F62BC5CA13948F\Application Data\Mozilla\Firefox\Profiles\lbr15ox1.default\
FF - prefs.js: browser.startup.homepage - hxxp://forecast.weather.gov/MapClick.php?CityName=Rochester&state=NY&site=BUF&textField1=43.1687&textField2=-77.6158
.
- - - - ORPHANS REMOVED - - - -

BHO-{13813032-6246-4D51-8468-7875BE5C5416} - c:\windows\system32\qfxzrops.dll
AddRemove-ezLife - c:\program files\ezLife\ezLife\1.3.6.0\uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-09 16:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(452)
c:\windows\system32\msxml3.dll
.
Completion time: 2010-03-09 17:00:45
ComboFix-quarantined-files.txt 2010-03-09 22:00

Pre-Run: 442,935,496,704 bytes free
Post-Run: 443,216,392,192 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30

- - End Of File - - 992FE62C9516ECF3C8E1C8F01CD4C655

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:04:20 PM, on 3/9/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\regsvr32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: gooochi browser enhancer - {A4A9A8E9-A525-6DDA-43C6-C4E5E103F498} - C:\WINDOWS\system32\ankvbgxlbf.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [wcgxujqujvvt] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\ankvbgxlbf.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266844280421
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8264 bytes

Shaba

2010-03-11, 05:57

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

http://img.bleepingcomputer.com/tutorials/hijackthis/uninstall-man.jpg

5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

racsw

2010-03-11, 17:06

Here you go:

3D-FTP
Acrobat.com
Acrobat.com
Adobe Acrobat 9 Pro
Adobe Acrobat 9 Pro
Adobe Acrobat 9.3.1 - CPSID_50570
Adobe AIR
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Dreamweaver CS4
Adobe Dreamweaver CS4
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS3
Adobe Extension Manager CS4
Adobe Fireworks CS3
Adobe Fireworks CS3
Adobe Fireworks CS4
Adobe Fireworks CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Media Player
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Reader 9.3.1
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Setup
Adobe Setup
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe XMP Panels CS3
Adobe XMP Panels CS4
Amara - Flash Slide Show Builder
avast! Antivirus
Canon iP90
Carbonite
Connect
Creative EAX Settings
Creative Speaker Settings
Device Control
Droppix Recorder XE 2.x
ERUNT 1.1j
FastStone Image Viewer 4.0
GoodSync
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Intel(R) PRO Network Adapters and Drivers
Java(TM) 6 Update 18
kuler
LightScribe System Software
Microsoft Office Small Business Edition 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.8)
Mozilla Thunderbird (3.0.3)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nikon Message Center
Nikon Transfer
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX
oggcodecs
Photoshop Camera Raw
PKZIP for Windows 8.00.0038
Realtek High Definition Audio Driver
RON Too1 Gooochi
RunAlyzer
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Spybot - Search & Destroy
Suite Shared Configuration CS4
Times Reader
Times Reader
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Windows XP Service Pack 3

Shaba

2010-03-12, 20:02

Do you recognize this program?

kuler

racsw

2010-03-14, 00:51

Although I owe you an apology for this, yes I do. I swore I looked in there in the beginning, as I usually do for removing unwanted programs, although it baffles me, I guess I overlooked it.

Not for a defense of my wasting your time, but I think I must have been lucky to some degree. When I first encountered this, and tried to get rid of it, I did a Google search on Gooochi. It brought up a lot of frustrated users that could not remove this, and there are, if you look, some lengthy reports detailing the difficulty many others have had.
While I obviously had it in my Applications list, I sincerely doubt that all the others who encountered this malware were as fortunate as I. Maybe it gets installed in some without appearing in the Installed Application.

Regardless, my sincere apologies for taking up your valuable time, and my appreciation for helping me anyway. I go to great lengths to try and not waste peoples time.

Regarding those two utilities that I installed, is there any recommendation for keeping either of these for some occasional purpose?

Thank you,
Robert

Shaba

2010-03-14, 19:39

No it isn't.

Which program it is then?

racsw

2010-03-15, 19:24

I'm sorry, I assumed you noticed it as quickly as I did:

RON Too1 Gooochi

Robert

Shaba

2010-03-16, 06:15

Yes that is bad but do you recognize that kuler?

racsw

2010-03-17, 00:16

Hi,
No I don't, and it was bothering me, but having never posted here before, I was leery about bringing up a second subject in this thread.

Is this malware also?

Here's the weird thing. It doesn't appear in the list of programs to uninstall from Windows, but it DOES appear in the list of programs to uninstall from HiJackThis. Below I have rerun both sequences as you asked me to do before:

3D-FTP
Acrobat.com
Acrobat.com
Adobe Acrobat 9 Pro
Adobe Acrobat 9 Pro
Adobe Acrobat 9.3.1 - CPSID_50570
Adobe AIR
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Dreamweaver CS4
Adobe Dreamweaver CS4
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS3
Adobe Extension Manager CS4
Adobe Fireworks CS3
Adobe Fireworks CS3
Adobe Fireworks CS4
Adobe Fireworks CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Media Player
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Reader 9.3.1
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Setup
Adobe Setup
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe XMP Panels CS3
Adobe XMP Panels CS4
Amara - Flash Slide Show Builder
avast! Antivirus
Canon iP90
Carbonite
Connect
Creative EAX Settings
Creative Speaker Settings
Device Control
Droppix Recorder XE 2.x
ERUNT 1.1j
FastStone Image Viewer 4.0
GoodSync
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Intel(R) PRO Network Adapters and Drivers
Java(TM) 6 Update 18
kuler
LightScribe System Software
Microsoft Office Small Business Edition 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.6)
Mozilla Thunderbird (3.0.3)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nikon Message Center
Nikon Transfer
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX
oggcodecs
Photoshop Camera Raw
PKZIP for Windows 8.00.0038
Realtek High Definition Audio Driver
RunAlyzer
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Spybot - Search & Destroy
Suite Shared Configuration CS4
Times Reader
Times Reader
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Windows XP Service Pack 3

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:12:25 PM, on 3/16/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266844280421
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8146 bytes

Regards,
Robert

Thanks,
Robert

Shaba

2010-03-17, 19:14

So we then continue with this:

Download random's system information tool (RSIT) by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<< will be maximized) and info.txt (<< will be minimized)

racsw

2010-03-19, 02:42

First, let me apologize for not getting back right away. I sincerely appreciate your help here. Twice I had to go out of town on business, so I wasn't able to get back on time.
Anyhow...here's the logs. Please note that your forum length was exceeded by posting both of these, so I had to do it in two Replies.

Logfile of random's system information tool 1.06 (written by random/random)
Run by Robert at 2010-03-18 21:38:02
Microsoft Windows XP Professional Service Pack 3
System drive C: has 421 GB (88%) free of 477 GB
Total RAM: 2431 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:38:13 PM, on 3/18/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\RSIT.exe
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\Robert.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266844280421
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8138 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-04 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-05-04 14396416]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-01-11 110696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-01-11 13666408]
"P17Helper"=Rundll32 P17.dll,P17Helper []
"Carbonite Backup"=C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe [2009-12-03 670864]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-24 81000]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-12-22 38840]
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-12-21 640440]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-05-18 2363392]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe"="C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe:*:Enabled:Adobe Dreamweaver CS4"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Droppix\Droppix Recorder XE 2.x\Droppix Recorder\DxRecord.exe"="C:\Program Files\Droppix\Droppix Recorder XE 2.x\Droppix Recorder\DxRecord.exe:*:Enabled:Droppix Recorder"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-03-18 21:38:02 ----D---- C:\rsit
2010-03-12 16:39:35 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Nikon
2010-03-12 16:38:42 ----A---- C:\WINDOWS\system32\ptpusb.dll
2010-03-12 16:38:41 ----A---- C:\WINDOWS\system32\ptpusd.dll
2010-03-11 21:35:59 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-09 20:15:05 ----SHD---- C:\RECYCLER
2010-03-09 19:41:06 ----D---- C:\WINDOWS\system32\NtmsData
2010-03-09 19:39:37 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-03-09 18:00:45 ----A---- C:\ComboFix.txt
2010-03-09 17:54:06 ----A---- C:\Boot.bak
2010-03-09 17:54:04 ----RASHD---- C:\cmdcons
2010-03-09 17:50:29 ----A---- C:\WINDOWS\zip.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\SWSC.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\SWREG.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\sed.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\PEV.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\MBR.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\grep.exe
2010-03-09 17:49:17 ----D---- C:\Qoobox
2010-03-05 11:23:02 ----D---- C:\WINDOWS\ERDNT
2010-03-05 11:22:25 ----D---- C:\Program Files\ERUNT
2010-03-04 20:55:12 ----D---- C:\Documents and Settings\All Users\Application Data\XoftSpySE
2010-03-04 12:30:18 ----D---- C:\Program Files\Safer Networking
2010-03-04 12:21:50 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Download Manager
2010-03-04 12:21:37 ----D---- C:\WINDOWS\Sun
2010-03-04 12:21:29 ----D---- C:\Documents and Settings\All Users\Application Data\Sun
2010-03-04 12:21:28 ----D---- C:\Program Files\Common Files\Java
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\javaws.exe
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\javaw.exe
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\java.exe
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\deploytk.dll
2010-03-04 12:21:03 ----D---- C:\Program Files\Java
2010-03-04 12:19:52 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Sun
2010-03-04 10:15:40 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-04 10:15:40 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-04 03:59:09 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\PKWARE
2010-03-04 03:59:09 ----D---- C:\Documents and Settings\All Users\Application Data\PKWARE
2010-03-04 03:49:20 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\LimeWire
2010-03-04 03:48:49 ----D---- C:\Program Files\360Share Pro
2010-03-04 03:12:48 ----D---- C:\Documents and Settings\All Users\Application Data\LightScribe
2010-03-04 03:12:24 ----A---- C:\WINDOWS\system32\vorbis.dll
2010-03-04 03:12:24 ----A---- C:\WINDOWS\system32\ogg.dll
2010-03-04 03:12:24 ----A---- C:\WINDOWS\system32\HHActiveX.dll
2010-03-04 03:12:23 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Droppix
2010-03-04 03:12:10 ----D---- C:\Program Files\illiminable
2010-03-04 03:12:00 ----D---- C:\Program Files\Common Files\LightScribe
2010-03-04 03:11:53 ----D---- C:\Program Files\Common Files\Droppix
2010-03-04 03:11:53 ----A---- C:\WINDOWS\system32\msxml3a.dll
2010-03-04 03:11:53 ----A---- C:\WINDOWS\system32\gdiplus.dll
2010-03-04 03:11:52 ----D---- C:\Program Files\Droppix
2010-03-04 03:11:29 ----D---- C:\Documents and Settings\All Users\Application Data\Droppix
2010-03-03 21:42:46 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-03-03 21:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2010-03-03 21:42:25 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2010-03-02 20:23:41 ----HD---- C:\Documents and Settings\All Users\Application Data\CanonBJ
2010-03-02 20:23:39 ----A---- C:\WINDOWS\system32\CNMLM71.DLL
2010-03-02 20:23:38 ----HD---- C:\WINDOWS\system32\CanonIJ Uninstaller Information
2010-03-02 20:23:31 ----HD---- C:\Program Files\CanonBJ
2010-03-02 19:58:10 ----D---- C:\Program Files\Amara - Flash Slide Show Builder
2010-03-02 19:57:32 ----D---- C:\Program Files\PKWARE
2010-03-02 19:57:32 ----D---- C:\Program Files\Common Files\PKWARE
2010-03-02 19:56:01 ----D---- C:\Program Files\Bonjour
2010-03-02 19:54:49 ----D---- C:\WINDOWS\Downloaded Installations
2010-03-02 19:52:09 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\com.adobe.ExMan
2010-03-02 16:22:47 ----D---- C:\WINDOWS\Prefetch
2010-03-02 12:14:21 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-03-02 12:14:13 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-03-02 12:14:04 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-03-02 12:13:58 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-03-02 12:13:50 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-03-02 12:13:44 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-03-02 12:13:38 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-03-02 12:13:32 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-03-02 12:13:26 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-03-02 12:13:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-03-02 12:13:14 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-03-02 12:13:09 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-03-02 12:13:01 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-03-02 12:12:55 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-03-02 12:12:48 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-03-02 12:12:43 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-03-02 12:12:37 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-03-02 12:12:31 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-03-02 12:12:25 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-03-02 12:12:19 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-03-02 12:12:11 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-03-02 12:12:05 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-03-02 12:11:58 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-03-02 12:11:52 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-03-02 12:11:46 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-03-02 12:11:40 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-03-02 12:11:32 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-03-02 12:11:25 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-03-02 12:11:19 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-03-02 12:11:13 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-03-02 12:11:07 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-03-02 12:11:01 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-03-02 12:10:54 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-03-02 12:10:48 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-03-02 12:10:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-03-02 12:10:36 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-03-02 12:10:30 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-03-02 12:10:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-03-02 12:10:13 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-03-02 12:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_1$
2010-03-02 12:10:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-03-02 12:09:54 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-03-02 12:09:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-03-02 12:09:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-03-02 12:09:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-03-02 12:09:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-03-02 12:09:20 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-03-02 12:09:14 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-03-02 12:09:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-03-02 12:09:00 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-03-02 12:08:53 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-03-02 12:04:57 ----D---- C:\WINDOWS\system32\scripting
2010-03-02 12:04:57 ----D---- C:\WINDOWS\l2schemas
2010-03-02 12:04:56 ----D---- C:\WINDOWS\system32\en
2010-03-02 12:04:56 ----D---- C:\WINDOWS\system32\bits
2010-03-02 12:01:21 ----D---- C:\WINDOWS\network diagnostic
2010-03-02 11:57:55 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-03-02 11:49:56 ----D---- C:\WINDOWS\ie8updates
2010-03-02 11:49:21 ----D---- C:\WINDOWS\WBEM
2010-03-02 11:48:04 ----HDC---- C:\WINDOWS\ie8
2010-03-02 11:48:04 ----D---- C:\WINDOWS\system32\en-US
2010-03-01 18:24:00 ----D---- C:\Program Files\MSXML 4.0
2010-02-28 18:29:32 ----D---- C:\Documents and Settings\All Users\Application Data\GoodSync
2010-02-28 18:26:21 ----D---- C:\Program Files\Siber Systems
2010-02-28 18:26:21 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\GoodSync
2010-02-28 18:23:10 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\FastStone
2010-02-28 18:23:05 ----D---- C:\Program Files\FastStone Image Viewer
2010-02-28 18:21:13 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-28 18:21:03 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$
2010-02-28 18:17:47 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\U3
2010-02-28 15:10:17 ----D---- C:\Program Files\Common Files\muvee Technologies
2010-02-28 15:10:12 ----D---- C:\Program Files\Common Files\Nikon
2010-02-28 15:10:12 ----D---- C:\Documents and Settings\All Users\Application Data\Nikon
2010-02-28 15:10:09 ----D---- C:\Program Files\Nikon
2010-02-28 15:09:49 ----D---- C:\Documents and Settings\All Users\Application Data\Ultima_T15
2010-02-28 15:09:49 ----D---- C:\Documents and Settings\All Users\Application Data\Track Settings
2010-02-28 15:09:49 ----D---- C:\Documents and Settings\All Users\Application Data\EnterNHelp
2010-02-28 14:54:23 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-02-28 14:54:23 ----A---- C:\WINDOWS\system32\OLE2SYS2.DLL
2010-02-28 14:54:08 ----D---- C:\Program Files\3D-FTP
2010-02-28 14:54:08 ----D---- C:\Documents and Settings\All Users\Application Data\3D-FTP
2010-02-28 13:45:53 ----D---- C:\Program Files\Adobe Media Player
2010-02-28 12:57:28 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2010-02-28 12:56:08 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-02-28 12:55:54 ----RA---- C:\WINDOWS\system32\AdobePDFUI.dll
2010-02-28 12:55:54 ----RA---- C:\WINDOWS\system32\AdobePDF.dll
2010-02-28 12:46:19 ----D---- C:\Program Files\Common Files\Adobe
2010-02-28 12:43:32 ----D---- C:\Program Files\Times Reader
2010-02-28 12:43:22 ----D---- C:\Program Files\Adobe
2010-02-28 12:43:10 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-02-28 12:43:07 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-02-28 12:38:30 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2010-02-24 09:15:19 ----D---- C:\Program Files\PremiumSoft
2010-02-24 04:00:45 ----HDC---- C:\WINDOWS\$NtUninstallKB970430_0$
2010-02-24 04:00:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971737_0$
2010-02-24 04:00:16 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-23 04:06:36 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-23 04:06:32 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2010-02-23 04:06:26 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2010-02-23 04:06:21 ----HDC---- C:\WINDOWS\$NtUninstallKB959426_0$
2010-02-23 04:06:15 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2010-02-23 04:06:10 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2010-02-23 04:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$
2010-02-23 04:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB971468_0$
2010-02-23 04:05:53 ----HDC---- C:\WINDOWS\$NtUninstallKB935448$
2010-02-23 04:05:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978207$
2010-02-23 04:05:32 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2010-02-23 04:05:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-02-23 04:05:23 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2010-02-23 04:05:18 ----HDC---- C:\WINDOWS\$NtUninstallKB955759_0$
2010-02-23 04:05:07 ----HDC---- C:\WINDOWS\$NtUninstallKB974318_0$
2010-02-23 04:05:01 ----HDC---- C:\WINDOWS\$NtUninstallKB969059_0$
2010-02-23 04:04:55 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2010-02-23 04:04:50 ----HDC---- C:\WINDOWS\$NtUninstallKB978037_0$
2010-02-23 04:04:44 ----HDC---- C:\WINDOWS\$NtUninstallKB975713_0$
2010-02-23 04:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$
2010-02-23 04:04:34 ----HDC---- C:\WINDOWS\$NtUninstallKB960225_0$
2010-02-23 04:04:28 ----HDC---- C:\WINDOWS\$NtUninstallKB972270_0$
2010-02-23 04:04:23 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_0$
2010-02-23 04:04:14 ----HDC---- C:\WINDOWS\$NtUninstallKB956572_0$
2010-02-23 04:04:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956844_0$
2010-02-23 04:04:01 ----HDC---- C:\WINDOWS\$NtUninstallKB961501_0$
2010-02-23 04:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2010-02-23 04:03:52 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2010-02-23 04:03:48 ----HDC---- C:\WINDOWS\$NtUninstallKB978251_0$
2010-02-23 04:03:43 ----HDC---- C:\WINDOWS\$NtUninstallKB973869_0$
2010-02-23 04:03:38 ----HDC---- C:\WINDOWS\$NtUninstallKB975025_0$
2010-02-23 04:03:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2010-02-23 04:03:25 ----HDC---- C:\WINDOWS\$NtUninstallKB952004_0$
2010-02-23 04:03:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974571_0$
2010-02-23 04:03:14 ----HDC---- C:\WINDOWS\$NtUninstallKB975560_0$
2010-02-23 04:03:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973507_0$
2010-02-23 04:03:00 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_0$
2010-02-23 04:02:55 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2010-02-23 04:02:50 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2010-02-23 04:02:45 ----HDC---- C:\WINDOWS\$NtUninstallKB973354_0$
2010-02-23 04:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-02-23 04:02:31 ----HDC---- C:\WINDOWS\$NtUninstallKB967715_0$
2010-02-23 04:02:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2010-02-23 04:02:21 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2010-02-23 04:02:16 ----HDC---- C:\WINDOWS\$NtUninstallKB974392_0$
2010-02-23 04:02:09 ----HDC---- C:\WINDOWS\$NtUninstallKB977914_0$
2010-02-23 04:01:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
2010-02-23 04:01:53 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2010-02-23 04:01:48 ----HDC---- C:\WINDOWS\$NtUninstallKB970238_0$
2010-02-23 04:01:40 ----HDC---- C:\WINDOWS\$NtUninstallKB971486_0$
2010-02-23 04:01:35 ----HDC---- C:\WINDOWS\$NtUninstallKB978706_0$
2010-02-23 04:01:29 ----D---- C:\WINDOWS\ServicePackFiles
2010-02-23 04:01:28 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2010-02-23 04:01:22 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2010-02-23 04:01:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973815_0$
2010-02-23 04:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$
2010-02-23 04:01:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2010-02-23 04:00:57 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2010-02-23 04:00:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2010-02-23 04:00:47 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2010-02-23 04:00:40 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2010-02-23 04:00:35 ----HDC---- C:\WINDOWS\$NtUninstallKB975467_0$
2010-02-23 04:00:28 ----HDC---- C:\WINDOWS\$NtUninstallKB968389_0$
2010-02-23 04:00:19 ----HDC---- C:\WINDOWS\$NtUninstallKB969947_0$
2010-02-22 20:37:01 ----N---- C:\WINDOWS\system32\tzchange.exe
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\MFC71.dll
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-02-22 20:17:37 ----D---- C:\Program Files\Alwil Software
2010-02-22 20:16:42 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2010-02-22 20:16:42 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2010-02-22 19:58:34 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2010-02-22 19:55:40 ----A---- C:\WINDOWS\ODBC.INI
2010-02-22 19:55:37 ----A---- C:\WINDOWS\system32\mdimon.dll
2010-02-22 19:55:15 ----D---- C:\Program Files\Microsoft ActiveSync
2010-02-22 19:55:04 ----D---- C:\Program Files\Common Files\DESIGNER
2010-02-22 19:54:58 ----D---- C:\WINDOWS\SHELLNEW
2010-02-22 19:54:38 ----D---- C:\Program Files\Microsoft Office
2010-02-22 19:52:36 ----RD---- C:\MSOCache
2010-02-22 18:39:47 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Thunderbird
2010-02-22 18:39:43 ----D---- C:\Program Files\Mozilla Thunderbird
2010-02-22 18:30:39 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Mozilla
2010-02-22 18:30:32 ----D---- C:\Program Files\Mozilla Firefox
2010-02-22 17:52:36 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Macromedia
2010-02-22 17:52:35 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Adobe
2010-02-22 14:51:44 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Identities
2010-02-22 14:51:26 ----ASH---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\desktop.ini
2010-02-22 14:51:25 ----SD---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Microsoft
2010-02-22 14:41:39 ----D---- C:\Program Files\Carbonite
2010-02-22 14:41:39 ----D---- C:\Documents and Settings\All Users\Application Data\Carbonite
2010-02-22 10:47:30 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2010-02-22 10:47:30 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2010-02-22 10:47:22 ----A---- C:\WINDOWS\system32\ludap17.ini
2010-02-22 10:47:22 ----A---- C:\WINDOWS\system32\ctzapxx.ini
2010-02-22 10:47:22 ----A---- C:\WINDOWS\INRES.DLL
2010-02-22 10:47:21 ----D---- C:\Program Files\Creative
2010-02-22 09:49:28 ----D---- C:\Program Files\AGEIA Technologies
2010-02-22 09:49:23 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-02-22 09:49:23 ----D---- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
2010-02-22 09:49:14 ----D---- C:\Program Files\NVIDIA Corporation
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\OpenCL.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvcuda.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvcodins.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvcod.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvapi.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2010-02-22 09:36:30 ----D---- C:\NVIDIA
2010-02-22 09:14:10 ----D---- C:\WINDOWS\system32\PreInstall
2010-02-22 09:14:09 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2010-02-22 09:14:09 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-22 09:13:56 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-02-22 09:13:50 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2010-02-22 09:11:57 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wups2.dll
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2010-02-22 08:59:13 ----D---- C:\WINDOWS\system32\Lang
2010-02-22 08:56:54 ----D---- C:\Program Files\Intel
2010-02-22 08:56:16 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-22 08:55:12 ----D---- C:\WINDOWS\Drivers
2010-02-22 08:52:58 ----A---- C:\WINDOWS\system32\ksuser.dll
2010-02-22 08:52:52 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-02-22 08:52:51 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2010-02-22 08:52:50 ----A---- C:\WINDOWS\HideWin.exe
2010-02-22 08:52:49 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2010-02-22 08:52:49 ----A---- C:\WINDOWS\RTHDCPL.EXE
2010-02-22 08:52:49 ----A---- C:\WINDOWS\ALCWZRD.EXE
2010-02-22 08:52:49 ----A---- C:\WINDOWS\ALCMTR.EXE
2010-02-22 08:52:48 ----N---- C:\WINDOWS\system32\ChCfg.exe
2010-02-22 08:52:48 ----D---- C:\WINDOWS\system32\RTCOM
2010-02-22 08:52:48 ----A---- C:\WINDOWS\system32\RTLCPAPI.dll
2010-02-22 08:52:48 ----A---- C:\WINDOWS\RTLCPL.EXE
2010-02-22 08:52:22 ----D---- C:\Program Files\Realtek
2010-02-22 08:52:21 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-22 08:52:18 ----N---- C:\WINDOWS\RtlExUpd.dll
2010-02-22 08:52:16 ----D---- C:\Program Files\Common Files\InstallShield
2010-02-22 08:51:24 ----RA---- C:\WINDOWS\system32\Prounstl.exe
2010-02-22 08:51:24 ----RA---- C:\WINDOWS\system32\IntelNic.dll
2010-02-22 08:51:24 ----RA---- C:\WINDOWS\system32\e100bmsg.dll
2010-02-22 08:48:41 ----D---- C:\TempEI4
2010-02-19 18:09:32 ----HD---- C:\Program Files\Uninstall Information
2010-02-19 18:00:23 ----AD---- C:\i386
2010-02-19 18:00:17 ----D---- C:\WINDOWS\SoftwareDistribution
2010-02-19 18:00:15 ----SD---- C:\WINDOWS\system32\Microsoft
2010-02-19 18:00:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-19 17:56:58 ----D---- C:\WINDOWS\system32\xircom
2010-02-19 17:56:58 ----D---- C:\Program Files\xerox
2010-02-19 17:56:58 ----D---- C:\Program Files\microsoft frontpage
2010-02-19 17:56:41 ----A---- C:\WINDOWS\control.ini
2010-02-19 17:56:41 ----A---- C:\AUTOEXEC.BAT
2010-02-19 17:56:33 ----A---- C:\WINDOWS\OEWABLog.txt
2010-02-19 17:56:30 ----A---- C:\WINDOWS\system32\mapi32.dll
2010-02-19 17:55:51 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-02-19 17:55:51 ----RD---- C:\WINDOWS\Offline Web Pages
2010-02-19 17:55:51 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2010-02-19 17:55:46 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2010-02-19 17:55:43 ----HD---- C:\Program Files\WindowsUpdate
2010-02-19 17:55:23 ----D---- C:\WINDOWS\system32\DirectX
2010-02-19 17:55:01 ----A---- C:\WINDOWS\system32\atrace.dll
2010-02-19 17:54:58 ----A---- C:\WINDOWS\system32\desktop.ini
2010-02-19 17:54:58 ----A---- C:\WINDOWS\desktop.ini
2010-02-19 17:54:50 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2010-02-19 17:54:49 ----A---- C:\WINDOWS\system32\acctres.dll
2010-02-19 17:54:48 ----D---- C:\Program Files\Common Files\Services
2010-02-19 17:54:45 ----SD---- C:\WINDOWS\Tasks
2010-02-19 17:54:45 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2010-02-19 17:54:44 ----D---- C:\Program Files\Common Files\MSSoap
2010-02-19 17:54:40 ----D---- C:\WINDOWS\system32\Macromed
2010-02-19 17:54:40 ----D---- C:\WINDOWS\srchasst
2010-02-19 17:54:37 ----A---- C:\WINDOWS\system32\wuweb.dll
2010-02-19 17:54:37 ----A---- C:\WINDOWS\system32\wucltui.dll
2010-02-19 17:54:36 ----N---- C:\WINDOWS\system32\wuauclt.exe
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wups.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuauserv.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuaueng.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuapi.dll
2010-02-19 17:54:35 ----N---- C:\WINDOWS\system32\qmgr.dll
2010-02-19 17:54:35 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2010-02-19 17:54:35 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2010-02-19 17:54:35 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2010-02-19 17:54:32 ----D---- C:\Program Files\Movie Maker
2010-02-19 17:54:28 ----A---- C:\WINDOWS\system32\safrslv.dll
2010-02-19 17:54:28 ----A---- C:\WINDOWS\system32\safrdm.dll
2010-02-19 17:54:28 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2010-02-19 17:54:27 ----A---- C:\WINDOWS\system32\racpldlg.dll
2010-02-19 17:54:24 ----D---- C:\WINDOWS\system32\Restore
2010-02-19 17:54:24 ----A---- C:\WINDOWS\system32\fltmc.exe
2010-02-19 17:54:24 ----A---- C:\WINDOWS\system32\fltlib.dll
2010-02-19 17:54:23 ----N---- C:\WINDOWS\system32\srsvc.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\srrstr.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\srclient.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\ils.dll
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\msconf.dll
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\mnmdd.dll
2010-02-19 17:54:19 ----D---- C:\Program Files\NetMeeting
2010-02-19 17:54:19 ----A---- C:\WINDOWS\system32\msoert2.dll
2010-02-19 17:54:19 ----A---- C:\WINDOWS\system32\msoeacct.dll
2010-02-19 17:54:18 ----A---- C:\WINDOWS\system32\inetres.dll
2010-02-19 17:54:18 ----A---- C:\WINDOWS\system32\inetcomm.dll
2010-02-19 17:54:16 ----N---- C:\WINDOWS\system32\schedsvc.dll
2010-02-19 17:54:16 ----D---- C:\Program Files\Outlook Express
2010-02-19 17:54:16 ----A---- C:\WINDOWS\system32\mstinit.exe
2010-02-19 17:54:16 ----A---- C:\WINDOWS\system32\mstask.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\isign32.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\inetcfg.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\icwphbk.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\icwdial.dll
2010-02-19 17:54:09 ----D---- C:\Program Files\Common Files\System
2010-02-19 17:54:07 ----D---- C:\Program Files\Internet Explorer
2010-02-19 17:53:40 ----D---- C:\Program Files\ComPlus Applications
2010-02-19 17:53:39 ----A---- C:\WINDOWS\vbaddin.ini
2010-02-19 17:53:39 ----A---- C:\WINDOWS\vb.ini
2010-02-19 17:53:35 ----D---- C:\WINDOWS\Registration
2010-02-19 17:53:29 ----D---- C:\Program Files\Windows Media Player
2010-02-19 17:53:29 ----D---- C:\Program Files\Online Services
2010-02-19 17:53:25 ----D---- C:\Program Files\Messenger
2010-02-19 17:53:20 ----D---- C:\Program Files\MSN Gaming Zone
2010-02-19 17:53:20 ----A---- C:\WINDOWS\system32\write.exe
2010-02-19 17:53:10 ----A---- C:\WINDOWS\system32\sndvol32.exe
2010-02-19 17:53:10 ----A---- C:\WINDOWS\system32\hticons.dll
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\winchat.exe
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\avwav.dll
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\avtapi.dll
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\avmeter.dll
2010-02-19 17:53:01 ----A---- C:\WINDOWS\system32\getuname.dll
2010-02-19 17:53:01 ----A---- C:\WINDOWS\system32\charmap.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\winmine.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\sol.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\mshearts.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\calc.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tslabels.ini
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tskill.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tscon.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\shadow.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\reset.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\freecell.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\rwinsta.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\regini.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\qwinsta.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\qappsrv.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\msg.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\logoff.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\cdmodem.dll
2010-02-19 17:52:57 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\stclient.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\mtxex.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\mtxdm.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\comsnap.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\comrepl.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\comaddin.dll
2010-02-19 17:52:50 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2010-02-19 17:52:40 ----D---- C:\Program Files\MSN
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\sndrec32.exe
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\mplay32.exe
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\hypertrm.dll
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\accwiz.exe
2010-02-19 17:52:38 ----D---- C:\Program Files\Windows NT
2010-02-19 17:52:38 ----A---- C:\WINDOWS\system32\spider.exe
2010-02-19 17:52:38 ----A---- C:\WINDOWS\system32\mspaint.exe
2010-02-19 17:52:38 ----A---- C:\WINDOWS\system32\clipbrd.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\sessmgr.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\remotepg.dll
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\rdshost.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\mstscax.dll
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\mstsc.exe
2010-02-19 17:52:36 ----N---- C:\WINDOWS\system32\termsrv.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdpclip.exe
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdchost.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\qprocess.exe
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\icaapi.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2010-02-19 17:52:35 ----D---- C:\WINDOWS\system32\MsDtc
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\xolehlp.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\mtxoci.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\msdtctm.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2010-02-19 17:52:34 ----D---- C:\WINDOWS\system32\Com
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\msdtclog.dll
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\msdtc.exe
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\colbact.dll
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\catsrvps.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\comuid.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\comsvcs.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\clbcatq.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\clbcatex.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\catsrvut.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\catsrv.dll
2010-02-19 17:52:27 ----A---- C:\WINDOWS\system32\servdeps.dll
2010-02-19 17:52:26 ----A---- C:\WINDOWS\system32\mmfutil.dll
2010-02-19 17:52:26 ----A---- C:\WINDOWS\system32\licwmi.dll
2010-02-19 17:52:26 ----A---- C:\WINDOWS\system32\cmprops.dll
2010-02-19 12:51:47 ----A---- C:\WINDOWS\system32\h323log.txt
2010-02-19 12:51:26 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-02-19 12:50:21 ----A---- C:\WINDOWS\system32\usbui.dll
2010-02-19 12:49:13 ----A---- C:\WINDOWS\imsins.BAK
2010-02-19 12:49:10 ----SHD---- C:\WINDOWS\Installer
2010-02-19 12:49:10 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-19 12:49:09 ----D---- C:\Program Files\Common Files\ODBC
2010-02-19 12:49:09 ----A---- C:\WINDOWS\ODBCINST.INI
2010-02-19 12:49:07 ----D---- C:\Program Files\Common Files\SpeechEngines
2010-02-19 12:49:06 ----RD---- C:\Program Files
2010-02-19 12:49:06 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-02-19 12:49:06 ----D---- C:\Program Files\Common Files
2010-02-19 12:49:03 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2010-02-19 12:49:03 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2010-02-19 12:49:03 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdur.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdru.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdest.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdro.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\spxcoins.dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\irclass.dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\dgsetup.dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2010-02-19 12:48:48 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2010-02-19 12:48:48 ----A---- C:\WINDOWS\TASKMAN.EXE
2010-02-19 12:48:48 ----A---- C:\WINDOWS\system32\batt.dll
2010-02-19 12:48:47 ----A---- C:\WINDOWS\notepad.exe
2010-02-19 12:48:46 ----A---- C:\WINDOWS\system32\storprop.dll
2010-02-19 12:48:40 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2010-02-19 12:48:35 ----RA---- C:\WINDOWS\SET8.tmp
2010-02-19 12:48:33 ----RA---- C:\WINDOWS\SET4.tmp
2010-02-19 12:48:32 ----RA---- C:\WINDOWS\SET3.tmp
2010-02-19 12:48:27 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-19 12:48:27 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-19 12:48:22 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-02-19 12:48:07 ----A---- C:\WINDOWS\setuplog.txt
2010-02-19 12:48:05 ----SHD---- C:\System Volume Information
2010-02-19 12:48:05 ----D---- C:\Documents and Settings
2010-02-19 12:46:41 ----RASH---- C:\boot.ini
2010-02-19 12:43:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-19 12:43:00 ----RSD---- C:\WINDOWS\Fonts
2010-02-19 12:43:00 ----RD---- C:\WINDOWS\Web
2010-02-19 12:43:00 ----HD---- C:\WINDOWS\inf
2010-02-19 12:43:00 ----D---- C:\WINDOWS\WinSxS
2010-02-19 12:43:00 ----D---- C:\WINDOWS\twain_32
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Temp
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\wins
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\wbem
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\usmt
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\spool
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\ShellExt
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\Setup
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\ras
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\oobe
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\npp
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\mui
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\inetsrv
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\IME
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\icsxml
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\ias
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\export
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\drivers
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\dhcp
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\config
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\3com_dmi
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\3076
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\2052
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1054
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1042
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1041
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1037
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1033
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1031
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1028
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1025
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system
2010-02-19 12:43:00 ----D---- C:\WINDOWS\security
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Resources
2010-02-19 12:43:00 ----D---- C:\WINDOWS\repair
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Provisioning
2010-02-19 12:43:00 ----D---- C:\WINDOWS\PeerNet
2010-02-19 12:43:00 ----D---- C:\WINDOWS\pchealth
2010-02-19 12:43:00 ----D---- C:\WINDOWS\mui
2010-02-19 12:43:00 ----D---- C:\WINDOWS\msapps
2010-02-19 12:43:00 ----D---- C:\WINDOWS\msagent
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Media
2010-02-19 12:43:00 ----D---- C:\WINDOWS\java
2010-02-19 12:43:00 ----D---- C:\WINDOWS\ime
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Help
2010-02-19 12:43:00 ----D---- C:\WINDOWS\ehome
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Driver Cache
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Debug
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Cursors
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Connection Wizard
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Config
2010-02-19 12:43:00 ----D---- C:\WINDOWS\AppPatch
2010-02-19 12:43:00 ----D---- C:\WINDOWS\addins
2010-02-19 12:43:00 ----D---- C:\WINDOWS

======List of files/folders modified in the last 1 months======

2010-03-09 17:59:17 ----A---- C:\WINDOWS\system.ini
2010-02-19 17:56:41 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-24 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-24 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-24 48560]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-24 94160]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-24 23120]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-10 138752]
R3 Dot4;MS IEEE-1284.4 Driver; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-01-12 10276768]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-10 106496]
R3 P17;SB Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2007-06-15 1127936]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 catchme;catchme; \??\C:\DOCUME~1\ROBERT~1.7F6\LOCALS~1\Temp\catchme.sys []
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-05-04 2951680]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-24 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-24 138680]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CarboniteService;CarboniteService; C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe [2009-12-03 1980560]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-04 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-05-18 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-01-11 154216]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-24 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-24 352920]
S3 Droppix Service;Droppix Service; C:\Program Files\Common Files\Droppix\DxService.exe [2009-08-28 221184]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-02-28 655624]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

racsw

2010-03-19, 02:44

Here's the HiJackThis one:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Robert at 2010-03-18 21:38:02
Microsoft Windows XP Professional Service Pack 3
System drive C: has 421 GB (88%) free of 477 GB
Total RAM: 2431 MB (70% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:38:13 PM, on 3/18/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\RSIT.exe
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\Robert.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266844280421
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8138 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-03-04 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-03-04 79648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2009-12-21 349640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\HDAShCut.exe [2005-01-07 61952]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-05-04 14396416]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2010-01-11 110696]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2010-01-11 13666408]
"P17Helper"=Rundll32 P17.dll,P17Helper []
"Carbonite Backup"=C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe [2009-12-03 670864]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-11-24 81000]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-12-11 948672]
"Adobe Acrobat Speed Launcher"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [2009-12-22 38840]
"Acrobat Assistant 8.0"=C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2009-12-21 640440]
"AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-05-18 2363392]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Nikon Monitor.lnk - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe"="C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe:*:Enabled:Adobe Dreamweaver CS4"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Droppix\Droppix Recorder XE 2.x\Droppix Recorder\DxRecord.exe"="C:\Program Files\Droppix\Droppix Recorder XE 2.x\Droppix Recorder\DxRecord.exe:*:Enabled:Droppix Recorder"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2010-03-18 21:38:02 ----D---- C:\rsit
2010-03-12 16:39:35 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Nikon
2010-03-12 16:38:42 ----A---- C:\WINDOWS\system32\ptpusb.dll
2010-03-12 16:38:41 ----A---- C:\WINDOWS\system32\ptpusd.dll
2010-03-11 21:35:59 ----HDC---- C:\WINDOWS\$NtUninstallKB975561$
2010-03-09 20:15:05 ----SHD---- C:\RECYCLER
2010-03-09 19:41:06 ----D---- C:\WINDOWS\system32\NtmsData
2010-03-09 19:39:37 ----HDC---- C:\WINDOWS\$NtUninstallKB977165-v2$
2010-03-09 18:00:45 ----A---- C:\ComboFix.txt
2010-03-09 17:54:06 ----A---- C:\Boot.bak
2010-03-09 17:54:04 ----RASHD---- C:\cmdcons
2010-03-09 17:50:29 ----A---- C:\WINDOWS\zip.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\SWSC.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\SWREG.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\sed.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\PEV.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\NIRCMD.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\MBR.exe
2010-03-09 17:50:29 ----A---- C:\WINDOWS\grep.exe
2010-03-09 17:49:17 ----D---- C:\Qoobox
2010-03-05 11:23:02 ----D---- C:\WINDOWS\ERDNT
2010-03-05 11:22:25 ----D---- C:\Program Files\ERUNT
2010-03-04 20:55:12 ----D---- C:\Documents and Settings\All Users\Application Data\XoftSpySE
2010-03-04 12:30:18 ----D---- C:\Program Files\Safer Networking
2010-03-04 12:21:50 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Download Manager
2010-03-04 12:21:37 ----D---- C:\WINDOWS\Sun
2010-03-04 12:21:29 ----D---- C:\Documents and Settings\All Users\Application Data\Sun
2010-03-04 12:21:28 ----D---- C:\Program Files\Common Files\Java
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\javaws.exe
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\javaw.exe
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\java.exe
2010-03-04 12:21:16 ----A---- C:\WINDOWS\system32\deploytk.dll
2010-03-04 12:21:03 ----D---- C:\Program Files\Java
2010-03-04 12:19:52 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Sun
2010-03-04 10:15:40 ----D---- C:\Program Files\Spybot - Search & Destroy
2010-03-04 10:15:40 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-04 03:59:09 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\PKWARE
2010-03-04 03:59:09 ----D---- C:\Documents and Settings\All Users\Application Data\PKWARE
2010-03-04 03:49:20 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\LimeWire
2010-03-04 03:48:49 ----D---- C:\Program Files\360Share Pro
2010-03-04 03:12:48 ----D---- C:\Documents and Settings\All Users\Application Data\LightScribe
2010-03-04 03:12:24 ----A---- C:\WINDOWS\system32\vorbis.dll
2010-03-04 03:12:24 ----A---- C:\WINDOWS\system32\ogg.dll
2010-03-04 03:12:24 ----A---- C:\WINDOWS\system32\HHActiveX.dll
2010-03-04 03:12:23 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Droppix
2010-03-04 03:12:10 ----D---- C:\Program Files\illiminable
2010-03-04 03:12:00 ----D---- C:\Program Files\Common Files\LightScribe
2010-03-04 03:11:53 ----D---- C:\Program Files\Common Files\Droppix
2010-03-04 03:11:53 ----A---- C:\WINDOWS\system32\msxml3a.dll
2010-03-04 03:11:53 ----A---- C:\WINDOWS\system32\gdiplus.dll
2010-03-04 03:11:52 ----D---- C:\Program Files\Droppix
2010-03-04 03:11:29 ----D---- C:\Documents and Settings\All Users\Application Data\Droppix
2010-03-03 21:42:46 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2010-03-03 21:42:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2010-03-03 21:42:25 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2010-03-02 20:23:41 ----HD---- C:\Documents and Settings\All Users\Application Data\CanonBJ
2010-03-02 20:23:39 ----A---- C:\WINDOWS\system32\CNMLM71.DLL
2010-03-02 20:23:38 ----HD---- C:\WINDOWS\system32\CanonIJ Uninstaller Information
2010-03-02 20:23:31 ----HD---- C:\Program Files\CanonBJ
2010-03-02 19:58:10 ----D---- C:\Program Files\Amara - Flash Slide Show Builder
2010-03-02 19:57:32 ----D---- C:\Program Files\PKWARE
2010-03-02 19:57:32 ----D---- C:\Program Files\Common Files\PKWARE
2010-03-02 19:56:01 ----D---- C:\Program Files\Bonjour
2010-03-02 19:54:49 ----D---- C:\WINDOWS\Downloaded Installations
2010-03-02 19:52:09 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\com.adobe.ExMan
2010-03-02 16:22:47 ----D---- C:\WINDOWS\Prefetch
2010-03-02 12:14:21 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-03-02 12:14:13 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-03-02 12:14:04 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-03-02 12:13:58 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-03-02 12:13:50 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-03-02 12:13:44 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-03-02 12:13:38 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2010-03-02 12:13:32 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2010-03-02 12:13:26 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2010-03-02 12:13:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$
2010-03-02 12:13:14 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$
2010-03-02 12:13:09 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2010-03-02 12:13:01 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2010-03-02 12:12:55 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2010-03-02 12:12:48 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$
2010-03-02 12:12:43 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2010-03-02 12:12:37 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2010-03-02 12:12:31 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$
2010-03-02 12:12:25 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$
2010-03-02 12:12:19 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2010-03-02 12:12:11 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2010-03-02 12:12:05 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-03-02 12:11:58 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$
2010-03-02 12:11:52 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2010-03-02 12:11:46 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2010-03-02 12:11:40 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2010-03-02 12:11:32 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2010-03-02 12:11:25 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2010-03-02 12:11:19 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2010-03-02 12:11:13 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2010-03-02 12:11:07 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2010-03-02 12:11:01 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2010-03-02 12:10:54 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2010-03-02 12:10:48 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2010-03-02 12:10:42 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2010-03-02 12:10:36 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2010-03-02 12:10:30 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2010-03-02 12:10:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2010-03-02 12:10:13 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-03-02 12:10:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_1$
2010-03-02 12:10:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-03-02 12:09:54 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2010-03-02 12:09:48 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2010-03-02 12:09:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2010-03-02 12:09:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2010-03-02 12:09:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2010-03-02 12:09:20 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2010-03-02 12:09:14 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2010-03-02 12:09:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2010-03-02 12:09:00 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2010-03-02 12:08:53 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2010-03-02 12:04:57 ----D---- C:\WINDOWS\system32\scripting
2010-03-02 12:04:57 ----D---- C:\WINDOWS\l2schemas
2010-03-02 12:04:56 ----D---- C:\WINDOWS\system32\en
2010-03-02 12:04:56 ----D---- C:\WINDOWS\system32\bits
2010-03-02 12:01:21 ----D---- C:\WINDOWS\network diagnostic
2010-03-02 11:57:55 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2010-03-02 11:49:56 ----D---- C:\WINDOWS\ie8updates
2010-03-02 11:49:21 ----D---- C:\WINDOWS\WBEM
2010-03-02 11:48:04 ----HDC---- C:\WINDOWS\ie8
2010-03-02 11:48:04 ----D---- C:\WINDOWS\system32\en-US
2010-03-01 18:24:00 ----D---- C:\Program Files\MSXML 4.0
2010-02-28 18:29:32 ----D---- C:\Documents and Settings\All Users\Application Data\GoodSync
2010-02-28 18:26:21 ----D---- C:\Program Files\Siber Systems
2010-02-28 18:26:21 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\GoodSync
2010-02-28 18:23:10 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\FastStone
2010-02-28 18:23:05 ----D---- C:\Program Files\FastStone Image Viewer
2010-02-28 18:21:13 ----A---- C:\WINDOWS\system32\MRT.exe
2010-02-28 18:21:03 ----HDC---- C:\WINDOWS\$NtUninstallKB932823-v3$
2010-02-28 18:17:47 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\U3
2010-02-28 15:10:17 ----D---- C:\Program Files\Common Files\muvee Technologies
2010-02-28 15:10:12 ----D---- C:\Program Files\Common Files\Nikon
2010-02-28 15:10:12 ----D---- C:\Documents and Settings\All Users\Application Data\Nikon
2010-02-28 15:10:09 ----D---- C:\Program Files\Nikon
2010-02-28 15:09:49 ----D---- C:\Documents and Settings\All Users\Application Data\Ultima_T15
2010-02-28 15:09:49 ----D---- C:\Documents and Settings\All Users\Application Data\Track Settings
2010-02-28 15:09:49 ----D---- C:\Documents and Settings\All Users\Application Data\EnterNHelp
2010-02-28 14:54:23 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2010-02-28 14:54:23 ----A---- C:\WINDOWS\system32\OLE2SYS2.DLL
2010-02-28 14:54:08 ----D---- C:\Program Files\3D-FTP
2010-02-28 14:54:08 ----D---- C:\Documents and Settings\All Users\Application Data\3D-FTP
2010-02-28 13:45:53 ----D---- C:\Program Files\Adobe Media Player
2010-02-28 12:57:28 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
2010-02-28 12:56:08 ----D---- C:\Program Files\Common Files\Macrovision Shared
2010-02-28 12:55:54 ----RA---- C:\WINDOWS\system32\AdobePDFUI.dll
2010-02-28 12:55:54 ----RA---- C:\WINDOWS\system32\AdobePDF.dll
2010-02-28 12:46:19 ----D---- C:\Program Files\Common Files\Adobe
2010-02-28 12:43:32 ----D---- C:\Program Files\Times Reader
2010-02-28 12:43:22 ----D---- C:\Program Files\Adobe
2010-02-28 12:43:10 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2010-02-28 12:43:07 ----D---- C:\Program Files\Common Files\Adobe AIR
2010-02-28 12:38:30 ----D---- C:\Documents and Settings\All Users\Application Data\NOS
2010-02-24 09:15:19 ----D---- C:\Program Files\PremiumSoft
2010-02-24 04:00:45 ----HDC---- C:\WINDOWS\$NtUninstallKB970430_0$
2010-02-24 04:00:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971737_0$
2010-02-24 04:00:16 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-23 04:06:36 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-23 04:06:32 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$
2010-02-23 04:06:26 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$
2010-02-23 04:06:21 ----HDC---- C:\WINDOWS\$NtUninstallKB959426_0$
2010-02-23 04:06:15 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$
2010-02-23 04:06:10 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2010-02-23 04:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$
2010-02-23 04:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB971468_0$
2010-02-23 04:05:53 ----HDC---- C:\WINDOWS\$NtUninstallKB935448$
2010-02-23 04:05:39 ----HDC---- C:\WINDOWS\$NtUninstallKB978207$
2010-02-23 04:05:32 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2010-02-23 04:05:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2010-02-23 04:05:23 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$
2010-02-23 04:05:18 ----HDC---- C:\WINDOWS\$NtUninstallKB955759_0$
2010-02-23 04:05:07 ----HDC---- C:\WINDOWS\$NtUninstallKB974318_0$
2010-02-23 04:05:01 ----HDC---- C:\WINDOWS\$NtUninstallKB969059_0$
2010-02-23 04:04:55 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$
2010-02-23 04:04:50 ----HDC---- C:\WINDOWS\$NtUninstallKB978037_0$
2010-02-23 04:04:44 ----HDC---- C:\WINDOWS\$NtUninstallKB975713_0$
2010-02-23 04:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$
2010-02-23 04:04:34 ----HDC---- C:\WINDOWS\$NtUninstallKB960225_0$
2010-02-23 04:04:28 ----HDC---- C:\WINDOWS\$NtUninstallKB972270_0$
2010-02-23 04:04:23 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_0$
2010-02-23 04:04:14 ----HDC---- C:\WINDOWS\$NtUninstallKB956572_0$
2010-02-23 04:04:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956844_0$
2010-02-23 04:04:01 ----HDC---- C:\WINDOWS\$NtUninstallKB961501_0$
2010-02-23 04:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2010-02-23 04:03:52 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2010-02-23 04:03:48 ----HDC---- C:\WINDOWS\$NtUninstallKB978251_0$
2010-02-23 04:03:43 ----HDC---- C:\WINDOWS\$NtUninstallKB973869_0$
2010-02-23 04:03:38 ----HDC---- C:\WINDOWS\$NtUninstallKB975025_0$
2010-02-23 04:03:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2010-02-23 04:03:25 ----HDC---- C:\WINDOWS\$NtUninstallKB952004_0$
2010-02-23 04:03:20 ----HDC---- C:\WINDOWS\$NtUninstallKB974571_0$
2010-02-23 04:03:14 ----HDC---- C:\WINDOWS\$NtUninstallKB975560_0$
2010-02-23 04:03:06 ----HDC---- C:\WINDOWS\$NtUninstallKB973507_0$
2010-02-23 04:03:00 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_0$
2010-02-23 04:02:55 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$
2010-02-23 04:02:50 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$
2010-02-23 04:02:45 ----HDC---- C:\WINDOWS\$NtUninstallKB973354_0$
2010-02-23 04:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$
2010-02-23 04:02:31 ----HDC---- C:\WINDOWS\$NtUninstallKB967715_0$
2010-02-23 04:02:26 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2010-02-23 04:02:21 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$
2010-02-23 04:02:16 ----HDC---- C:\WINDOWS\$NtUninstallKB974392_0$
2010-02-23 04:02:09 ----HDC---- C:\WINDOWS\$NtUninstallKB977914_0$
2010-02-23 04:01:58 ----HDC---- C:\WINDOWS\$NtUninstallKB951748_0$
2010-02-23 04:01:53 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2010-02-23 04:01:48 ----HDC---- C:\WINDOWS\$NtUninstallKB970238_0$
2010-02-23 04:01:40 ----HDC---- C:\WINDOWS\$NtUninstallKB971486_0$
2010-02-23 04:01:35 ----HDC---- C:\WINDOWS\$NtUninstallKB978706_0$
2010-02-23 04:01:29 ----D---- C:\WINDOWS\ServicePackFiles
2010-02-23 04:01:28 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2010-02-23 04:01:22 ----HDC---- C:\WINDOWS\$NtUninstallKB960803_0$
2010-02-23 04:01:17 ----HDC---- C:\WINDOWS\$NtUninstallKB973815_0$
2010-02-23 04:01:09 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$
2010-02-23 04:01:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2010-02-23 04:00:57 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$
2010-02-23 04:00:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$
2010-02-23 04:00:47 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2010-02-23 04:00:40 ----HDC---- C:\WINDOWS\$NtUninstallKB923561_0$
2010-02-23 04:00:35 ----HDC---- C:\WINDOWS\$NtUninstallKB975467_0$
2010-02-23 04:00:28 ----HDC---- C:\WINDOWS\$NtUninstallKB968389_0$
2010-02-23 04:00:19 ----HDC---- C:\WINDOWS\$NtUninstallKB969947_0$
2010-02-22 20:37:01 ----N---- C:\WINDOWS\system32\tzchange.exe
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\MSVCR71.dll
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\MSVCP71.dll
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\MFC71.dll
2010-02-22 20:17:40 ----A---- C:\WINDOWS\system32\aswBoot.exe
2010-02-22 20:17:37 ----D---- C:\Program Files\Alwil Software
2010-02-22 20:16:42 ----N---- C:\WINDOWS\system32\xpsp4res.dll
2010-02-22 20:16:42 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2010-02-22 19:58:34 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2010-02-22 19:55:40 ----A---- C:\WINDOWS\ODBC.INI
2010-02-22 19:55:37 ----A---- C:\WINDOWS\system32\mdimon.dll
2010-02-22 19:55:15 ----D---- C:\Program Files\Microsoft ActiveSync
2010-02-22 19:55:04 ----D---- C:\Program Files\Common Files\DESIGNER
2010-02-22 19:54:58 ----D---- C:\WINDOWS\SHELLNEW
2010-02-22 19:54:38 ----D---- C:\Program Files\Microsoft Office
2010-02-22 19:52:36 ----RD---- C:\MSOCache
2010-02-22 18:39:47 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Thunderbird
2010-02-22 18:39:43 ----D---- C:\Program Files\Mozilla Thunderbird
2010-02-22 18:30:39 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Mozilla
2010-02-22 18:30:32 ----D---- C:\Program Files\Mozilla Firefox
2010-02-22 17:52:36 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Macromedia
2010-02-22 17:52:35 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Adobe
2010-02-22 14:51:44 ----D---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Identities
2010-02-22 14:51:26 ----ASH---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\desktop.ini
2010-02-22 14:51:25 ----SD---- C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Microsoft
2010-02-22 14:41:39 ----D---- C:\Program Files\Carbonite
2010-02-22 14:41:39 ----D---- C:\Documents and Settings\All Users\Application Data\Carbonite
2010-02-22 10:47:30 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2010-02-22 10:47:30 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2010-02-22 10:47:22 ----A---- C:\WINDOWS\system32\ludap17.ini
2010-02-22 10:47:22 ----A---- C:\WINDOWS\system32\ctzapxx.ini
2010-02-22 10:47:22 ----A---- C:\WINDOWS\INRES.DLL
2010-02-22 10:47:21 ----D---- C:\Program Files\Creative
2010-02-22 09:49:28 ----D---- C:\Program Files\AGEIA Technologies
2010-02-22 09:49:23 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-02-22 09:49:23 ----D---- C:\Documents and Settings\All Users\Application Data\NVIDIA Corporation
2010-02-22 09:49:14 ----D---- C:\Program Files\NVIDIA Corporation
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\OpenCL.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvcuvenc.dll
2010-02-22 09:36:35 ----A---- C:\WINDOWS\system32\nvcuda.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvcodins.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvcod.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nvapi.dll
2010-02-22 09:36:33 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2010-02-22 09:36:30 ----D---- C:\NVIDIA
2010-02-22 09:14:10 ----D---- C:\WINDOWS\system32\PreInstall
2010-02-22 09:14:09 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2010-02-22 09:14:09 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-22 09:13:56 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-02-22 09:13:50 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2010-02-22 09:11:57 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wups2.dll
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2010-02-22 09:11:57 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2010-02-22 08:59:13 ----D---- C:\WINDOWS\system32\Lang
2010-02-22 08:56:54 ----D---- C:\Program Files\Intel
2010-02-22 08:56:16 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-02-22 08:55:12 ----D---- C:\WINDOWS\Drivers
2010-02-22 08:52:58 ----A---- C:\WINDOWS\system32\ksuser.dll
2010-02-22 08:52:52 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-02-22 08:52:51 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2010-02-22 08:52:50 ----A---- C:\WINDOWS\HideWin.exe
2010-02-22 08:52:49 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2010-02-22 08:52:49 ----A---- C:\WINDOWS\RTHDCPL.EXE
2010-02-22 08:52:49 ----A---- C:\WINDOWS\ALCWZRD.EXE
2010-02-22 08:52:49 ----A---- C:\WINDOWS\ALCMTR.EXE
2010-02-22 08:52:48 ----N---- C:\WINDOWS\system32\ChCfg.exe
2010-02-22 08:52:48 ----D---- C:\WINDOWS\system32\RTCOM
2010-02-22 08:52:48 ----A---- C:\WINDOWS\system32\RTLCPAPI.dll
2010-02-22 08:52:48 ----A---- C:\WINDOWS\RTLCPL.EXE
2010-02-22 08:52:22 ----D---- C:\Program Files\Realtek
2010-02-22 08:52:21 ----HD---- C:\Program Files\InstallShield Installation Information
2010-02-22 08:52:18 ----N---- C:\WINDOWS\RtlExUpd.dll
2010-02-22 08:52:16 ----D---- C:\Program Files\Common Files\InstallShield
2010-02-22 08:51:24 ----RA---- C:\WINDOWS\system32\Prounstl.exe
2010-02-22 08:51:24 ----RA---- C:\WINDOWS\system32\IntelNic.dll
2010-02-22 08:51:24 ----RA---- C:\WINDOWS\system32\e100bmsg.dll
2010-02-22 08:48:41 ----D---- C:\TempEI4
2010-02-19 18:09:32 ----HD---- C:\Program Files\Uninstall Information
2010-02-19 18:00:23 ----AD---- C:\i386
2010-02-19 18:00:17 ----D---- C:\WINDOWS\SoftwareDistribution
2010-02-19 18:00:15 ----SD---- C:\WINDOWS\system32\Microsoft
2010-02-19 18:00:15 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-19 17:56:58 ----D---- C:\WINDOWS\system32\xircom
2010-02-19 17:56:58 ----D---- C:\Program Files\xerox
2010-02-19 17:56:58 ----D---- C:\Program Files\microsoft frontpage
2010-02-19 17:56:41 ----A---- C:\WINDOWS\control.ini
2010-02-19 17:56:41 ----A---- C:\AUTOEXEC.BAT
2010-02-19 17:56:33 ----A---- C:\WINDOWS\OEWABLog.txt
2010-02-19 17:56:30 ----A---- C:\WINDOWS\system32\mapi32.dll
2010-02-19 17:55:51 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-02-19 17:55:51 ----RD---- C:\WINDOWS\Offline Web Pages
2010-02-19 17:55:51 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2010-02-19 17:55:46 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2010-02-19 17:55:43 ----HD---- C:\Program Files\WindowsUpdate
2010-02-19 17:55:23 ----D---- C:\WINDOWS\system32\DirectX
2010-02-19 17:55:01 ----A---- C:\WINDOWS\system32\atrace.dll
2010-02-19 17:54:58 ----A---- C:\WINDOWS\system32\desktop.ini
2010-02-19 17:54:58 ----A---- C:\WINDOWS\desktop.ini
2010-02-19 17:54:50 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2010-02-19 17:54:49 ----A---- C:\WINDOWS\system32\acctres.dll
2010-02-19 17:54:48 ----D---- C:\Program Files\Common Files\Services
2010-02-19 17:54:45 ----SD---- C:\WINDOWS\Tasks
2010-02-19 17:54:45 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2010-02-19 17:54:44 ----D---- C:\Program Files\Common Files\MSSoap
2010-02-19 17:54:40 ----D---- C:\WINDOWS\system32\Macromed
2010-02-19 17:54:40 ----D---- C:\WINDOWS\srchasst
2010-02-19 17:54:37 ----A---- C:\WINDOWS\system32\wuweb.dll
2010-02-19 17:54:37 ----A---- C:\WINDOWS\system32\wucltui.dll
2010-02-19 17:54:36 ----N---- C:\WINDOWS\system32\wuauclt.exe
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wups.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuauserv.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuaueng.dll
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2010-02-19 17:54:36 ----A---- C:\WINDOWS\system32\wuapi.dll
2010-02-19 17:54:35 ----N---- C:\WINDOWS\system32\qmgr.dll
2010-02-19 17:54:35 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2010-02-19 17:54:35 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2010-02-19 17:54:35 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2010-02-19 17:54:32 ----D---- C:\Program Files\Movie Maker
2010-02-19 17:54:28 ----A---- C:\WINDOWS\system32\safrslv.dll
2010-02-19 17:54:28 ----A---- C:\WINDOWS\system32\safrdm.dll
2010-02-19 17:54:28 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2010-02-19 17:54:27 ----A---- C:\WINDOWS\system32\racpldlg.dll
2010-02-19 17:54:24 ----D---- C:\WINDOWS\system32\Restore
2010-02-19 17:54:24 ----A---- C:\WINDOWS\system32\fltmc.exe
2010-02-19 17:54:24 ----A---- C:\WINDOWS\system32\fltlib.dll
2010-02-19 17:54:23 ----N---- C:\WINDOWS\system32\srsvc.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\srrstr.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\srclient.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2010-02-19 17:54:23 ----A---- C:\WINDOWS\system32\ils.dll
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\msconf.dll
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2010-02-19 17:54:22 ----A---- C:\WINDOWS\system32\mnmdd.dll
2010-02-19 17:54:19 ----D---- C:\Program Files\NetMeeting
2010-02-19 17:54:19 ----A---- C:\WINDOWS\system32\msoert2.dll
2010-02-19 17:54:19 ----A---- C:\WINDOWS\system32\msoeacct.dll
2010-02-19 17:54:18 ----A---- C:\WINDOWS\system32\inetres.dll
2010-02-19 17:54:18 ----A---- C:\WINDOWS\system32\inetcomm.dll
2010-02-19 17:54:16 ----N---- C:\WINDOWS\system32\schedsvc.dll
2010-02-19 17:54:16 ----D---- C:\Program Files\Outlook Express
2010-02-19 17:54:16 ----A---- C:\WINDOWS\system32\mstinit.exe
2010-02-19 17:54:16 ----A---- C:\WINDOWS\system32\mstask.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\isign32.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\inetcfg.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\icwphbk.dll
2010-02-19 17:54:15 ----A---- C:\WINDOWS\system32\icwdial.dll
2010-02-19 17:54:09 ----D---- C:\Program Files\Common Files\System
2010-02-19 17:54:07 ----D---- C:\Program Files\Internet Explorer
2010-02-19 17:53:40 ----D---- C:\Program Files\ComPlus Applications
2010-02-19 17:53:39 ----A---- C:\WINDOWS\vbaddin.ini
2010-02-19 17:53:39 ----A---- C:\WINDOWS\vb.ini
2010-02-19 17:53:35 ----D---- C:\WINDOWS\Registration
2010-02-19 17:53:29 ----D---- C:\Program Files\Windows Media Player
2010-02-19 17:53:29 ----D---- C:\Program Files\Online Services
2010-02-19 17:53:25 ----D---- C:\Program Files\Messenger
2010-02-19 17:53:20 ----D---- C:\Program Files\MSN Gaming Zone
2010-02-19 17:53:20 ----A---- C:\WINDOWS\system32\write.exe
2010-02-19 17:53:10 ----A---- C:\WINDOWS\system32\sndvol32.exe
2010-02-19 17:53:10 ----A---- C:\WINDOWS\system32\hticons.dll
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\winchat.exe
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\avwav.dll
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\avtapi.dll
2010-02-19 17:53:09 ----A---- C:\WINDOWS\system32\avmeter.dll
2010-02-19 17:53:01 ----A---- C:\WINDOWS\system32\getuname.dll
2010-02-19 17:53:01 ----A---- C:\WINDOWS\system32\charmap.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\winmine.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\sol.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\mshearts.exe
2010-02-19 17:53:00 ----A---- C:\WINDOWS\system32\calc.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tslabels.ini
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tskill.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\tscon.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\shadow.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\reset.exe
2010-02-19 17:52:59 ----A---- C:\WINDOWS\system32\freecell.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\rwinsta.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\regini.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\qwinsta.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\qappsrv.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\msg.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\logoff.exe
2010-02-19 17:52:58 ----A---- C:\WINDOWS\system32\cdmodem.dll
2010-02-19 17:52:57 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\stclient.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\mtxex.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\mtxdm.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\comsnap.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\comrepl.dll
2010-02-19 17:52:56 ----A---- C:\WINDOWS\system32\comaddin.dll
2010-02-19 17:52:50 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2010-02-19 17:52:40 ----D---- C:\Program Files\MSN
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\sndrec32.exe
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\mplay32.exe
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\hypertrm.dll
2010-02-19 17:52:39 ----A---- C:\WINDOWS\system32\accwiz.exe
2010-02-19 17:52:38 ----D---- C:\Program Files\Windows NT
2010-02-19 17:52:38 ----A---- C:\WINDOWS\system32\spider.exe
2010-02-19 17:52:38 ----A---- C:\WINDOWS\system32\mspaint.exe
2010-02-19 17:52:38 ----A---- C:\WINDOWS\system32\clipbrd.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\sessmgr.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\remotepg.dll
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\rdshost.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\mstscax.dll
2010-02-19 17:52:37 ----A---- C:\WINDOWS\system32\mstsc.exe
2010-02-19 17:52:36 ----N---- C:\WINDOWS\system32\termsrv.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdpclip.exe
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\rdchost.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\qprocess.exe
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\icaapi.dll
2010-02-19 17:52:36 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2010-02-19 17:52:35 ----D---- C:\WINDOWS\system32\MsDtc
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\xolehlp.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\mtxoci.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\msdtctm.dll
2010-02-19 17:52:35 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2010-02-19 17:52:34 ----D---- C:\WINDOWS\system32\Com
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\msdtclog.dll
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\msdtc.exe
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\colbact.dll
2010-02-19 17:52:34 ----A---- C:\WINDOWS\system32\catsrvps.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\comuid.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\comsvcs.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\clbcatq.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\clbcatex.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\catsrvut.dll
2010-02-19 17:52:33 ----A---- C:\WINDOWS\system32\catsrv.dll
2010-02-19 17:52:27 ----A---- C:\WINDOWS\system32\servdeps.dll
2010-02-19 17:52:26 ----A---- C:\WINDOWS\system32\mmfutil.dll
2010-02-19 17:52:26 ----A---- C:\WINDOWS\system32\licwmi.dll
2010-02-19 17:52:26 ----A---- C:\WINDOWS\system32\cmprops.dll
2010-02-19 12:51:47 ----A---- C:\WINDOWS\system32\h323log.txt
2010-02-19 12:51:26 ----A---- C:\WINDOWS\system32\hidserv.dll
2010-02-19 12:50:21 ----A---- C:\WINDOWS\system32\usbui.dll
2010-02-19 12:49:13 ----A---- C:\WINDOWS\imsins.BAK
2010-02-19 12:49:10 ----SHD---- C:\WINDOWS\Installer
2010-02-19 12:49:10 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-19 12:49:09 ----D---- C:\Program Files\Common Files\ODBC
2010-02-19 12:49:09 ----A---- C:\WINDOWS\ODBCINST.INI
2010-02-19 12:49:07 ----D---- C:\Program Files\Common Files\SpeechEngines
2010-02-19 12:49:06 ----RD---- C:\Program Files
2010-02-19 12:49:06 ----D---- C:\Program Files\Common Files\Microsoft Shared
2010-02-19 12:49:06 ----D---- C:\Program Files\Common Files
2010-02-19 12:49:03 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2010-02-19 12:49:03 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2010-02-19 12:49:03 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdur.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdru.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2010-02-19 12:49:01 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2010-02-19 12:48:58 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2010-02-19 12:48:56 ----RA---- C:\WINDOWS\system32\kbdest.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdro.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2010-02-19 12:48:54 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\spxcoins.dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\irclass.dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\dgsetup.dll
2010-02-19 12:48:51 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2010-02-19 12:48:48 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2010-02-19 12:48:48 ----A---- C:\WINDOWS\TASKMAN.EXE
2010-02-19 12:48:48 ----A---- C:\WINDOWS\system32\batt.dll
2010-02-19 12:48:47 ----A---- C:\WINDOWS\notepad.exe
2010-02-19 12:48:46 ----A---- C:\WINDOWS\system32\storprop.dll
2010-02-19 12:48:40 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2010-02-19 12:48:35 ----RA---- C:\WINDOWS\SET8.tmp
2010-02-19 12:48:33 ----RA---- C:\WINDOWS\SET4.tmp
2010-02-19 12:48:32 ----RA---- C:\WINDOWS\SET3.tmp
2010-02-19 12:48:27 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-19 12:48:27 ----D---- C:\WINDOWS\system32\CatRoot
2010-02-19 12:48:22 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2010-02-19 12:48:07 ----A---- C:\WINDOWS\setuplog.txt
2010-02-19 12:48:05 ----SHD---- C:\System Volume Information
2010-02-19 12:48:05 ----D---- C:\Documents and Settings
2010-02-19 12:46:41 ----RASH---- C:\boot.ini
2010-02-19 12:43:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-19 12:43:00 ----RSD---- C:\WINDOWS\Fonts
2010-02-19 12:43:00 ----RD---- C:\WINDOWS\Web
2010-02-19 12:43:00 ----HD---- C:\WINDOWS\inf
2010-02-19 12:43:00 ----D---- C:\WINDOWS\WinSxS
2010-02-19 12:43:00 ----D---- C:\WINDOWS\twain_32
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Temp
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\wins
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\wbem
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\usmt
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\spool
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\ShellExt
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\Setup
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\ras
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\oobe
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\npp
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\mui
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\inetsrv
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\IME
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\icsxml
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\ias
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\export
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\drivers
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\dhcp
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\config
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\3com_dmi
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\3076
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\2052
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1054
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1042
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1041
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1037
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1033
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1031
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1028
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32\1025
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system32
2010-02-19 12:43:00 ----D---- C:\WINDOWS\system
2010-02-19 12:43:00 ----D---- C:\WINDOWS\security
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Resources
2010-02-19 12:43:00 ----D---- C:\WINDOWS\repair
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Provisioning
2010-02-19 12:43:00 ----D---- C:\WINDOWS\PeerNet
2010-02-19 12:43:00 ----D---- C:\WINDOWS\pchealth
2010-02-19 12:43:00 ----D---- C:\WINDOWS\mui
2010-02-19 12:43:00 ----D---- C:\WINDOWS\msapps
2010-02-19 12:43:00 ----D---- C:\WINDOWS\msagent
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Media
2010-02-19 12:43:00 ----D---- C:\WINDOWS\java
2010-02-19 12:43:00 ----D---- C:\WINDOWS\ime
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Help
2010-02-19 12:43:00 ----D---- C:\WINDOWS\ehome
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Driver Cache
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Debug
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Cursors
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Connection Wizard
2010-02-19 12:43:00 ----D---- C:\WINDOWS\Config
2010-02-19 12:43:00 ----D---- C:\WINDOWS\AppPatch
2010-02-19 12:43:00 ----D---- C:\WINDOWS\addins
2010-02-19 12:43:00 ----D---- C:\WINDOWS

======List of files/folders modified in the last 1 months======

2010-03-09 17:59:17 ----A---- C:\WINDOWS\system.ini
2010-02-19 17:56:41 ----A---- C:\WINDOWS\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-11-24 27408]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-11-24 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-11-24 48560]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-11-24 94160]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-11-24 23120]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-10 138752]
R3 Dot4;MS IEEE-1284.4 Driver; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
R3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-02-10 154112]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2010-01-12 10276768]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-10 106496]
R3 P17;SB Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2007-06-15 1127936]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 catchme;catchme; \??\C:\DOCUME~1\ROBERT~1.7F6\LOCALS~1\Temp\catchme.sys []
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2005-01-07 145920]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-05-04 2951680]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-11-24 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-11-24 138680]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 CarboniteService;CarboniteService; C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe [2009-12-03 1980560]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2010-03-04 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-05-18 73728]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2010-01-11 154216]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-11-24 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-11-24 352920]
S3 Droppix Service;Droppix Service; C:\Program Files\Common Files\Droppix\DxService.exe [2009-08-28 221184]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-02-28 655624]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

racsw

2010-03-19, 02:46

I'm sorry, I posted the same one twice. Here's the other log:

info.txt logfile of random's system information tool 1.06 2010-03-18 21:38:17

======Uninstall list======

-->MsiExec /X{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9194237B-7B58-40B4-A739-184AD59531A2}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C64409FA-42A7-49C6-837A-D2E5D813BD57}\setup.exe" -l0x9
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3D-FTP-->MsiExec.exe /I{47FB1A60-9DDC-42B0-8430-8F6FBCF89651}
Acrobat.com-->msiexec /qb /x {6421F085-1FAA-DE13-D02A-CFB412C522A4}
Acrobat.com-->MsiExec.exe /I{6421F085-1FAA-DE13-D02A-CFB412C522A4}
Adobe Acrobat 9 Pro-->msiexec /I {AC76BA86-1033-0000-7760-000000000004}
Adobe Acrobat 9 Pro-->msiexec /I {AC76BA86-1033-0000-7760-000000000004}
Adobe Acrobat 9.3.1 - CPSID_50570-->msiexec /I {AC76BA86-1033-0000-7760-000000000004}
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe Dreamweaver CS4-->C:\Program Files\Common Files\Adobe\Installers\acce07fd2c8fe7f9e3f26243e626578\Setup.exe --uninstall=1
Adobe Dreamweaver CS4-->MsiExec.exe /I{30C8AA56-4088-426F-91D1-0EDFD3A25678}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS3-->MsiExec.exe /I{D7A53E41-3F32-4A44-989C-53DDEBB2130C}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Fireworks CS3-->C:\Program Files\Common Files\Adobe\Installers\bbef028176efa5abf0233d3e1747be8\Setup.exe
Adobe Fireworks CS3-->MsiExec.exe /I{7DFC1012-D346-46CE-B03E-FF79125AE029}
Adobe Fireworks CS4-->C:\Program Files\Common Files\Adobe\Installers\ccb135070a90ff24d6e7cc4bc5a59cb\Setup.exe --uninstall=1
Adobe Fireworks CS4-->MsiExec.exe /I{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Reader 9.3.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A93000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{14AFE241-FC6E-4FDB-BCA0-7AD6F4974171}
Adobe Setup-->MsiExec.exe /I{28773E11-6E44-46DC-90BD-273A3FA2CAC1}
Adobe Setup-->MsiExec.exe /I{C92A5A89-B218-46F7-8898-77C52113FFE0}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
Amara - Flash Slide Show Builder-->"C:\Program Files\Amara - Flash Slide Show Builder\uninstall.exe"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Canon iP90-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP90\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP90 /L0x0009
Carbonite-->C:\Program Files\Carbonite\Carbonite Backup\CarboniteSetup.exe /remove
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
Creative EAX Settings-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C64409FA-42A7-49C6-837A-D2E5D813BD57}\setup.exe" -l0x9 /remove
Creative Speaker Settings-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9 /remove
Device Control-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9194237B-7B58-40B4-A739-184AD59531A2}\setup.exe" -l0x9 /remove
Droppix Recorder XE 2.x-->"C:\Program Files\Droppix\Droppix Recorder XE 2.x\unins000.exe"
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
FastStone Image Viewer 4.0-->C:\Program Files\FastStone Image Viewer\uninst.exe
GoodSync-->"C:\Program Files\Siber Systems\GoodSync\uninstall.exe"
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"
Intel(R) PRO Network Adapters and Drivers-->Prounstl.exe
Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF}
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
LightScribe System Software-->MsiExec.exe /X{DD6C316A-FE75-4FBB-9D22-4C1920232B72}
Microsoft Office Small Business Edition 2003-->MsiExec.exe /I{91CA0409-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.6)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (3.0.3)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Nikon Message Center-->MsiExec.exe /X{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}
Nikon Transfer-->MsiExec.exe /X{E9757890-7EC5-46C8-99AB-B00F07B6525C}
NVIDIA Display Control Panel-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe DisplayControlPanel
NVIDIA Drivers-->C:\Program Files\NVIDIA Corporation\Uninstall\nvuninst.exe UninstallGUI
NVIDIA nView Desktop Manager-->C:\Program Files\NVIDIA Corporation\nView\nViewSetup.exe -uninstall
NVIDIA PhysX-->MsiExec.exe /X{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}
oggcodecs-->MsiExec.exe /I{D65F0073-A820-4085-B997-A061171595A7}
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
PKZIP for Windows 8.00.0038-->MsiExec.exe /I{10623A59-3362-4646-95F9-EE1368C9F2B2}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" REMOVE
RunAlyzer-->"C:\Program Files\Safer Networking\RunAlyzer\unins000.exe"
Security Update for Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Security Update for Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Security Update for Windows XP (KB977165-v2)-->"C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Security Update for Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
Times Reader-->msiexec /qb /x {A75BC59B-10BF-6B87-DCC7-3501F158ACC6}
Times Reader-->MsiExec.exe /I{A75BC59B-10BF-6B87-DCC7-3501F158ACC6}
Update for Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Update for Windows Internet Explorer 8 (KB978506)-->"C:\WINDOWS\ie8updates\KB978506-IE8\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update for Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Update for Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Update for Windows XP (KB978207)-->"C:\WINDOWS\$NtUninstallKB978207$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: avast! antivirus 4.8.1368 [VPS 100318-1]

======System event log======

Computer Name: 7F62BC5CA13948F
Event Code: 20
Message: Printer Driver Microsoft Office Document Image Writer Driver for Windows NT x86 Version-3 was added or updated. Files:- mdigraph.dll, mdiui.dll, mdiui.dll.

Record Number: 281
Source Name: Print
Time Written: 20100222185537.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 7F62BC5CA13948F
Event Code: 57
Message: The system failed to flush data to the transaction log. Corruption may occur.

Record Number: 273
Source Name: Ftdisk
Time Written: 20100222173922.000000-300
Event Type: warning
User:

Computer Name: 7F62BC5CA13948F
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.

Record Number: 272
Source Name: Disk
Time Written: 20100222173833.000000-300
Event Type: warning
User:

Computer Name: 7F62BC5CA13948F
Event Code: 20
Message: Printer Driver HP LaserJet 1200 Series PCL for Windows NT x86 Version-3 was added or updated. Files:- UNIDRV.DLL, UNIDRVUI.DLL, HPLJ1200.GPD, UNIDRV.HLP, UNIRES.DLL, hpcfont.dll, hpcstr.dll, hpcljx.hlp, hpcmacro.gpd, hpcfont.gpd, TTFSUB.GPD, STDNAMES.GPD.

Record Number: 247
Source Name: Print
Time Written: 20100222133758.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 7F62BC5CA13948F
Event Code: 1002
Message: The IP address lease 192.168.0.78 for the Network Card with network address 001676241B58 has been
denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

Record Number: 233
Source Name: Dhcp
Time Written: 20100222133712.000000-300
Event Type: error
User:

=====Application event log=====

Computer Name: 7F62BC5CA13948F
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 17
Source Name: WinMgmt
Time Written: 20100219165622.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 7F62BC5CA13948F
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 16
Source Name: WinMgmt
Time Written: 20100219165622.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 7F62BC5CA13948F
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 12
Source Name: WinMgmt
Time Written: 20100219165401.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 7F62BC5CA13948F
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 11
Source Name: WinMgmt
Time Written: 20100219165401.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: 7F62BC5CA13948F
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 10
Source Name: WinMgmt
Time Written: 20100219165400.000000-300
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\wbem;C:\Program Files\NVIDIA Corporation\PhysX\Common
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0304
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

Shaba

2010-03-19, 09:32

Ok that didn't tell much.

Please download Malwarebytes Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) and save it to your desktop.
alternate download link 1 (http://malwarebytes.gt500.org/mbam-setup.exe)
alternate download link 2 (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)
Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware

Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here (http://www.malwarebytes.org/mbam/database/mbam-rules.exe) and just double-click on mbam-rules.exe to install.
On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.

If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

racsw

2010-03-19, 16:47

Hello Shaba,
Below is the log file you requested:

Malwarebytes' Anti-Malware 1.44
Database version: 3885
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/19/2010 11:44:07 AM
mbam-log-2010-03-19 (11-44-07).txt

Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 255624
Time elapsed: 40 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{e0ec6fba-f009-3535-95d6-b6390db27da1} (Adware.EZlife) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Robert.7F62BC5CA13948F\Local Settings\temp\COM Security Update Level 9 (Adware.Adrotator) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qfxzrops.dll.vir (Adware.EzLife) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{759AA0D2-7C57-4054-8C31-2AF0E620E1C8}\RP30\A0005967.exe (P2P.Dropper.A) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{759AA0D2-7C57-4054-8C31-2AF0E620E1C8}\RP30\A0006059.dll (Adware.EzLife) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{759AA0D2-7C57-4054-8C31-2AF0E620E1C8}\RP31\A0006177.exe (Adware.Adrotator) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{759AA0D2-7C57-4054-8C31-2AF0E620E1C8}\RP32\A0006213.exe (Adware.Adrotator) -> Quarantined and deleted successfully.

I am accumulating quite a list of utility programs concerning this issue. Is there any of them I should keep or delete?

Shaba

2010-03-20, 12:12

Well please uninstall kuler if you have no idea what it is.

Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

racsw

2010-03-22, 00:14

Hello Shaba,
I am going to do what you said, but please note: As I said earlier, the "kuler" program is not available to uninstall under Windows. It does not appear in the list. However, it DOES appear as an installed program using the utilities you have been advising for me. (check above) So I don't know how to uninstall this.

Robert

racsw

2010-03-22, 13:43

OK, here's the results:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, March 22, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, March 21, 2010 22:40:44
Records in database: 3840740
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Objects scanned: 126643
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 02:49:54

File name / Threat / Threats count
C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Thunderbird\Profiles\3ypsfks0.default\ImapMail\imap.innovativebalancing.com\INBOX.sbd\Contact Infected: Trojan.Win32.FraudPack.aodx 1
C:\Documents and Settings\Robert.7F62BC5CA13948F\Application Data\Thunderbird\Profiles\3ypsfks0.default\ImapMail\imap.innovativebalancing.com\INBOX.sbd\Trash Infected: Trojan.Win32.FraudPack.aodx 1

Selected area has been scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:41:46 AM, on 3/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Robert.7F62BC5CA13948F\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1266844280421
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Droppix Service - Droppix - C:\Program Files\Common Files\Droppix\DxService.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7968 bytes

Shaba

2010-03-22, 20:29

That is fine then :)

Still some issues left?

racsw

2010-03-24, 14:16

Hi. Just one issue remaining. As you can see from the listing below from HiJackThis, that program "kuler" is still installed.
The problem is, I can't uninstall it because it's not listed in the Windows "Installed programs" list.
What should I do?

3D-FTP
Acrobat.com
Acrobat.com
Adobe Acrobat 9 Pro
Adobe Acrobat 9 Pro
Adobe Acrobat 9.3.1 - CPSID_50570
Adobe AIR
Adobe AIR
Adobe Anchor Service CS3
Adobe Anchor Service CS4
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge CS4
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps CS4
Adobe CSI CS4
Adobe Default Language CS4
Adobe Device Central CS4
Adobe Dreamweaver CS4
Adobe Dreamweaver CS4
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit CS4
Adobe Extension Manager CS3
Adobe Extension Manager CS4
Adobe Fireworks CS3
Adobe Fireworks CS3
Adobe Fireworks CS4
Adobe Fireworks CS4
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Media Player
Adobe Media Player
Adobe Output Module
Adobe PDF Library Files CS4
Adobe Reader 9.3.1
Adobe Search for Help
Adobe Service Manager Extension
Adobe Setup
Adobe Setup
Adobe Setup
Adobe Type Support CS4
Adobe Update Manager CS3
Adobe Update Manager CS4
Adobe Version Cue CS3 Client
Adobe XMP Panels CS3
Adobe XMP Panels CS4
Alien Skin Eye Candy 5 Impact
Amara - Flash Slide Show Builder
avast! Antivirus
Canon iP90
Carbonite
Connect
Creative EAX Settings
Creative Speaker Settings
Device Control
Droppix Recorder XE 2.x
ERUNT 1.1j
FastStone Image Viewer 4.0
GoodSync
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Intel(R) PRO Network Adapters and Drivers
Java(TM) 6 Update 18
kuler
LightScribe System Software
Malwarebytes' Anti-Malware
Microsoft Office Small Business Edition 2003
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.6.2)
Mozilla Thunderbird (3.0.3)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nikon Message Center
Nikon Transfer
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA nView Desktop Manager
NVIDIA PhysX
oggcodecs
Photoshop Camera Raw
PKZIP for Windows 8.00.0038
Realtek High Definition Audio Driver
RunAlyzer
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Spybot - Search & Destroy
Suite Shared Configuration CS4
Times Reader
Times Reader
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Windows XP Service Pack 3

racsw

2010-03-24, 14:23

Hello Shaba,
I found out that "kuler" is a legitimate Adobe product:
http://www.adobe.com/products/kuler/

I don't know why it can't be uninstalled, but I'm not concerned about it at this point.

Thank you very much for all your help and assistance.

Does all your work on these types of malware go into later versions of SpyBot to improve it or are these pieces of malware something that SpyBot is not designed to catch?

Thanks again,
Robert

Shaba

2010-03-24, 21:43

OK, then let's leave it alone :)

No program can catch everything. There are so much new malware coming every day that you are not able to even add them all.

Are you ready for final instructions?

racsw

2010-03-25, 00:18

OK, I'm ready :bigthumb:

Robert

Shaba

2010-03-26, 17:23

Good :)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Looking over your log, it seems you don't have any evidence of a third party firewall.

As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

1) Comodo (http://www.personalfirewall.comodo.com/download_firewall.html) (Uncheck during installation "Install COMODO Antivirus (Recommended)"!, "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage")
2) Online Armor (http://www.tallemu.com/online_armor_free.html)
3) PC Tools (http://www.pctools.com/firewall/download/)
4) Sunbelt/Kerio (http://www.sunbelt-software.com/Kerio-Download.cfm)
5) ZoneAlarm (http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za) (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

Next we remove all used tools.

Please download OTCleanIt (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt

Change the Download unsigned ActiveX controls to Disable

Change the Initialize and script ActiveX controls not marked as safe to Disable

Change the Installation of desktop items to Prompt

Change the Launching programs and files in an IFRAME to Prompt

Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software and keep your other programs up-to-date Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Malwarebytes' Anti-Malware - Malwarebytes''Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:

Malwarebytes' Anti-Malware Setup Guide (http://www.lognrock.com/forum/index.php?showtopic=6926)

Malwarebytes' Anti-Malware Scanning Guide (http://www.lognrock.com/forum/index.php?showtopic=6913)

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)

Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer. See also a hosts file tutorial here (http://malwareremoval.com/forum/viewtopic.php?t=22187)
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)

Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://forums.spybot.info/showthread.php?t=279)

Happy surfing and stay clean! :bigthumb:

racsw

2010-03-26, 23:24

First, let me thank you for doing all this work and helping me out.

We don't use IE and never have, so instructions regarding that I will ignore.
Our business computers all use FireFox and Thunderbird.

Firewalls are a touchy issue with me, no disrespect. I invested a lot of money at one point buying ZoneAlarm for everybody, but have also had Norton, and Panda. We also tried Comodo on a couple. They each had their own problems, but ZA & Comodo drove everyone crazy with all the popup alarms asking questions that nobody could answer, so to shut the damn thing up, we would always say "allow". It got to be too much and interrupted our business, so we got Avast Pro, and have not had a problem since, except for this one. I may be wrong, but I think Avast Pro has outgoing protection, but I'll check. It has been an excellent program and has intercepted many viruses and attachments.
And the truth is, I caused this problem by buying questionable software I suspected to be bad. My gut told me "no", but my fingers typed "yes". It's my fault, not the fault of my software. When I ran the executable, Avast went into Hypersonic Alarm mode as it knew this was bad stuff, it did catch it. But it got in regardless.
I don't like to have too many of these resident programs running for protection, because they tend to interfere with one another to some degree. That's why I look for a single solution, or at least maybe one solid one, and something like SpyBot.

I will look into the Firewall issue some more and see if I can find a good solution rather than windows. I try it first before giving it to anyone else.

Thank you again,
Robert