Page 2 of 4 FirstFirst 1234 LastLast
Results 11 to 20 of 32

Thread: Computer runs insanely slow, has never been checked for Malware (Resolved)

  1. 2009-07-10, 11:59 #11
    katana
    katana is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Manchester UK
    Posts
    3,425

    Default

    Information
    1) Still seems a bit sluggish at times.

    2) During the Add/Remove programs instrustions ~ would you like to remove from the add/remove program list" to which I said yes.
    1) This machine is never going to break any speed records, it is desperately low on RAM for modern software.

    Total RAM: 254 MB (15% free)


    2) That's fine


    ----------------------------------------------------------------------------------------
    Step 1

    Custom CFScript
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      Code:
      File::
c:\Program Files\ezStub.exe
C:\WINNT\wininit.ini
c:\winnt\system32\drivers\etc\hosts
Folder::
C:\WINNT\isrvs
C:\rsit
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23136:TCP"=-
"23136:UDP"=-
ADS::
    • Save this as CFScript.txt and place it on your desktop.




    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper


    ----------------------------------------------------------------------------------------
    Step 2

    Please run HostsXpert.exe again

    ----------------------------------------------------------------------------------------
    Step 3

    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/par...avwebscan.html

    Read the Requirements and limitations before you click Accept.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


    ----------------------------------------------------------------------------------------
    Step 4

    Please run RSIT again ( there should be two logs this time )

    ----------------------------------------------------------------------------------------
    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    Some of the logs I request will be quite large, You may need to split them over a couple of replies.
    • Combofix log
    • Kaspersky Log
    • RSIT Logs
    Microsoft MVP Consumer Security 2009 -2010
    If we have helped, please consider a donation
    THESE INSTRUCTIONS ARE FOR THIS USER ONLY
  2. 2009-07-10, 16:20 #12
    Scofield
    Scofield is offline
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    Katana...you're an artist. Thanks for what you do. Okay, so I'm not an idiot about these things, but I copied the custom notepad script and dragged it into Combofix...twice. The work completed but a log never appeared and I can't find it anywhere Tried to run Kaspersky online scanner but it said I needed Java version 1.5 to do so. I didn't want to download anything unless you gave the go-ahead. Please advise and thanks for being patient with me.

    Scofield.
  3. 2009-07-10, 16:29 #13
    katana
    katana is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Manchester UK
    Posts
    3,425

    Default

    Have a look for C:\Combofix.txt

    Please post a fresh RSIT log also
    Microsoft MVP Consumer Security 2009 -2010
    If we have helped, please consider a donation
    THESE INSTRUCTIONS ARE FOR THIS USER ONLY
  4. 2009-07-10, 18:00 #14
    Scofield
    Scofield is offline
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    Combofix:

    ComboFix 09-07-09.08 - Owner 07/10/2009 9:31:46.3.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.109 [GMT -4:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt

    FILE ::
    "c:\Program Files\ezStub.exe"
    "c:\winnt\system32\drivers\etc\hosts"
    "C:\WINNT\wininit.ini"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    c:\Program Files\ezStub.exe
    C:\rsit
    C:\rsit\info.txt
    C:\rsit\log.txt
    C:\WINNT\isrvs
    c:\winnt\system32\drivers\etc\hosts
    C:\WINNT\wininit.ini

    .
    ((((((((((((((((((((((((( Files Created from 2009-06-10 to 2009-07-10 )))))))))))))))))))))))))))))))
    .

    2009-07-09 01:54:08 . 2009-07-09 01:54:08 0 d-----w- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2009-07-09 01:53:58 . 2009-06-17 15:27:56 38160 ----a-w- C:\WINNT\system32\drivers\mbamswissarmy.sys
    2009-07-09 01:53:56 . 2009-07-09 01:53:56 0 d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-07-09 01:53:55 . 2009-07-09 01:54:06 0 d-----w- C:\Program Files\Malwarebytes' Anti-Malware
    2009-07-09 01:53:55 . 2009-06-17 15:27:44 19096 ----a-w- C:\WINNT\system32\drivers\mbam.sys
    2009-07-07 00:09:02 . 2009-07-07 00:09:28 0 d-----w- C:\Program Files\ERUNT
    2009-07-05 16:39:27 . 2009-07-08 01:02:44 0 d-----w- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2009-07-05 16:39:27 . 2009-07-05 16:46:44 0 d-----w- C:\Program Files\Spybot - Search & Destroy
    2009-07-05 15:48:57 . 2009-07-05 15:48:57 0 d-----w- C:\Documents and Settings\All Users\Application Data\Comcast

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-07-10 13:17:25 . 2003-09-08 01:59:48 0 d-----w- C:\Program Files\Common Files\AOL
    2009-07-10 13:15:12 . 2003-09-08 01:40:10 0 d-----w- C:\Documents and Settings\All Users\Application Data\AOL
    2009-07-10 13:13:55 . 2004-05-02 17:34:26 0 d-----w- C:\Documents and Settings\Owner\Application Data\AOL
    2009-07-10 11:40:05 . 2002-12-10 02:59:22 0 d-----w- C:\Program Files\Symantec
    2009-07-10 11:40:05 . 2002-12-10 02:59:16 0 d-----w- C:\Program Files\Common Files\Symantec Shared
    2009-07-10 02:47:39 . 2002-12-10 01:52:35 0 d--h--w- C:\Program Files\InstallShield Installation Information
    2009-07-10 02:46:16 . 2002-12-10 02:59:16 0 d-----w- C:\Documents and Settings\All Users\Application Data\Symantec
    2009-07-09 23:24:07 . 2007-10-15 20:10:45 0 d-----w- C:\Program Files\ComcastToolbar
    2009-07-09 23:21:35 . 2007-10-15 20:10:44 0 d-----w- C:\Documents and Settings\Owner\Application Data\ComcastToolbar
    2009-07-09 21:58:30 . 2006-10-20 21:59:39 0 d-----w- C:\Documents and Settings\Owner\Application Data\Skype
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-07-09_22.21.38 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-10 11:36:01 . 2009-07-10 11:36:01 155648 C:\WINNT\ERDNT\AutoBackup\7-10-2009\Users\00000002\UsrClass.dat
    + 2009-07-10 11:36:02 . 2005-10-20 16:02:28 163328 C:\WINNT\ERDNT\AutoBackup\7-10-2009\ERDNT.EXE
    + 2009-07-10 11:36:00 . 2009-07-10 11:36:01 8937472 C:\WINNT\ERDNT\AutoBackup\7-10-2009\Users\00000001\ntuser.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2002-12-10 02:53:52 26112]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-17 02:41:18 98304]
    "VX3000"="C:\WINNT\vVX3000.exe" [2006-06-29 23:55:44 707376]

    C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
    backup=C:\WINNT\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
    "C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\msncall.exe"=

    R2 RioPNP;RioPNP;C:\WINNT\system32\drivers\RioPnP.sys [12/9/2002 10:59:43 PM 6736]
    S3 PCDRDRV;Pcdr Helper Driver;\??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys --> C:\Atf\Qctest\PCDoc\PCDRDRV.sys [?]
    S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINNT\system32\drivers\usbscan.sys [4/20/2003 9:05:06 PM 15104]
    S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver;C:\WINNT\system32\drivers\rt2500usb.sys [9/14/2006 11:50:11 PM 79616]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - NMSCFG
    *NewlyCreated* - NMSSVC
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    mWindow Title = Windows Internet Explorer provided by Comcast
    uInternet Connection Wizard,ShellNext = iexplore
    DPF: DirectAnimation Java Classes - file://C:\WINNT\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://C:\WINNT\Java\classes\xmldso.cab
    DPF: {511073AD-BE56-4D43-AE68-93390514385E} - hcp://system/TechTools.CAB
    .
  5. 2009-07-10, 18:01 #15
    Scofield
    Scofield is offline
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    RSIT #1

    Logfile of random's system information tool 1.06 (written by random/random)
    Run by Owner at 2009-07-10 11:59:23
    Microsoft Windows XP Home Edition Service Pack 2
    System drive C: has 24 GB (62%) free of 39 GB
    Total RAM: 254 MB (27% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:59:38 AM, on 7/10/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
    C:\WINNT\System32\NMSSvc.exe
    C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINNT\system32\wscntfy.exe
    C:\WINNT\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Documents and Settings\Owner\Desktop\RSIT.exe
    C:\Documents and Settings\Owner\Desktop\Owner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [VX3000] C:\WINNT\vVX3000.exe
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - hcp://system/TechTools.CAB
    O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysmedia.tv/axiscam/C...CamControl.ocx
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
    O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
    O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

    --
    End of file - 4050 bytes

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
    ST - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 155648]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
    MSNToolBandBHO - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - MSN - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "RealTray"=C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]
    "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]
    "VX3000"=C:\WINNT\vVX3000.exe [2006-06-29 707376]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CapFax]
    C:\Program Files\PhoneTools\CapFax.EXE [2001-11-07 20480]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccRegVfy]
    C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C84 Series]
    C:\WINNT\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE [2003-05-27 99840]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]
    C:\WINNT\GWMDMMSG.exe [2002-08-06 90112]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMpi]
    C:\WINNT\GWMDMpi.exe [2002-08-06 53248]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Hot Key Kbd 9910 Daemon]
    C:\WINNT\system32\SK9910DM.EXE [2001-01-03 66048]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    C:\WINNT\System32\hkcmd.exe [2002-09-09 114688]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    C:\WINNT\System32\igfxtray.exe [2002-09-09 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Keyboard Preload Check]
    C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:Keyboard Preload Check []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MediaFace Integration]
    C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe [2003-08-18 53248]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [2002-07-16 28672]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
    C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe [2004-08-13 86016]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    C:\Program Files\MSN Messenger\msnmsgr.exe [2006-07-29 5354792]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    C:\Program Files\QuickTime\qttask.exe [2006-09-16 98304]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    C:\Program Files\Real\RealPlayer\RealPlay.exe [2002-12-09 26112]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet []

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
    C:\PROGRA~1\AMERIC~2.0\aoltray.exe -check []

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

    C:\Documents and Settings\Owner\Start Menu\Programs\Startup
    ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\WINNT\system32\igfxsrvc.dll [2002-09-09 315392]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINNT\system32\WgaLogon.dll [2006-06-19 702768]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=323
    "NoDriveAutoRun"=67108863
    "NoDrives"=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveAutoRun"=
    "NoDriveTypeAutoRun"=
    "NoDrives"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
    "C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
    "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
    "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
    "C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

    ======List of files/folders created in the last 1 months======

    2009-07-10 11:59:23 ----D---- C:\rsit
    2009-07-10 10:05:26 ----SHD---- C:\RECYCLER
    2009-07-10 09:40:51 ----D---- C:\WINNT\temp
    2009-07-10 09:30:20 ----SD---- C:\ComboFix
    2009-07-10 09:30:18 ----A---- C:\WINNT\system32\CF5605.exe
    2009-07-10 09:11:11 ----A---- C:\WINNT\msoffice.ini
    2009-07-08 21:54:08 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2009-07-08 21:53:56 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-07-08 21:53:55 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-07-06 20:09:02 ----D---- C:\Program Files\ERUNT
    2009-07-06 18:12:06 ----A---- C:\Boot.bak
    2009-07-06 18:11:56 ----RASHD---- C:\cmdcons
    2009-07-06 18:08:48 ----A---- C:\WINNT\zip.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\SWXCACLS.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\SWSC.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\SWREG.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\sed.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\PEV.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\NIRCMD.exe
    2009-07-06 18:08:48 ----A---- C:\WINNT\grep.exe
    2009-07-06 18:08:41 ----D---- C:\WINNT\ERDNT
    2009-07-06 18:08:34 ----D---- C:\Qoobox
    2009-07-05 12:39:27 ----D---- C:\Program Files\Spybot - Search & Destroy
    2009-07-05 12:39:27 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2009-07-05 12:31:28 ----A---- C:\WINNT\ntbtlog.txt
    2009-07-05 12:10:57 ----HDC---- C:\WINNT\$NtUninstallKB956390$
    2009-07-05 11:48:57 ----D---- C:\Documents and Settings\All Users\Application Data\Comcast

    ======List of files/folders modified in the last 1 months======

    2009-07-10 11:55:24 ----RD---- C:\Program Files
    2009-07-10 09:41:56 ----AD---- C:\WINNT
    2009-07-10 09:41:56 ----A---- C:\WINNT\system.ini
    2009-07-10 09:41:02 ----D---- C:\WINNT\system32
    2009-07-10 09:38:13 ----D---- C:\WINNT\system32\drivers
    2009-07-10 09:38:13 ----D---- C:\WINNT\AppPatch
    2009-07-10 09:37:55 ----D---- C:\Program Files\Common Files
    2009-07-10 09:36:58 ----D---- C:\WINNT\system32\CatRoot2
    2009-07-10 09:30:53 ----A---- C:\WINNT\SchedLgU.Txt
    2009-07-10 09:17:56 ----D---- C:\WINNT\system32\ias
    2009-07-10 09:17:25 ----D---- C:\Program Files\Common Files\AOL
    2009-07-10 09:15:12 ----D---- C:\Documents and Settings\All Users\Application Data\AOL
    2009-07-10 09:14:39 ----D---- C:\Program Files\AOL
    2009-07-10 09:13:55 ----D---- C:\Documents and Settings\Owner\Application Data\AOL
    2009-07-10 09:13:35 ----A---- C:\WINNT\win.ini
    2009-07-10 07:40:24 ----SHD---- C:\WINNT\Installer
    2009-07-10 07:40:08 ----D---- C:\Config.Msi
    2009-07-10 07:40:05 ----D---- C:\Program Files\Symantec
    2009-07-10 07:40:05 ----D---- C:\Program Files\Common Files\Symantec Shared
    2009-07-09 22:47:39 ----HD---- C:\Program Files\InstallShield Installation Information
    2009-07-09 22:46:16 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
    2009-07-09 22:43:39 ----SD---- C:\WINNT\Tasks
    2009-07-09 19:55:09 ----D---- C:\WINNT\Prefetch
    2009-07-09 19:24:07 ----D---- C:\Program Files\ComcastToolbar
    2009-07-09 19:21:35 ----D---- C:\Documents and Settings\Owner\Application Data\ComcastToolbar
    2009-07-09 17:58:30 ----D---- C:\Documents and Settings\Owner\Application Data\Skype
    2009-07-06 18:33:55 ----RSHD---- C:\WINNT\system32\dllcache
    2009-07-06 18:22:07 ----SD---- C:\WINNT\Downloaded Program Files
    2009-07-06 18:12:06 ----RASH---- C:\boot.ini
    2009-07-05 12:24:15 ----HD---- C:\WINNT\inf
    2009-07-05 12:17:58 ----D---- C:\Program Files\Internet Explorer
    2009-07-05 12:05:55 ----D---- C:\WINNT\system32\CatRoot
    2009-07-05 12:00:52 ----A---- C:\WINNT\system32\PerfStringBackup.INI
    2009-07-05 11:53:52 ----D---- C:\WINNT\system32\CatRoot_bak
    2009-07-05 11:52:31 ----D---- C:\WINNT\WinSxS

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINNT\system32\drivers\ialmsbw.sys [2002-09-16 91678]
    R1 Cdr4_xp;Cdr4_xp; C:\WINNT\system32\drivers\Cdr4_xp.sys [2003-01-12 61424]
    R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2003-01-12 23420]
    R1 intelppm;Intel Processor Driver; C:\WINNT\System32\DRIVERS\intelppm.sys [2004-08-04 36096]
    R1 Sk9920nt;PS/2 Keyboard Filter Driver for NT 4.0; C:\WINNT\System32\DRIVERS\Sk9920nt.sys [2000-09-12 6208]
    R2 ASCTRM;ASCTRM; C:\WINNT\system32\drivers\ASCTRM.sys [2002-12-09 8552]
    R2 MASPINT;MASPINT; C:\WINNT\system32\drivers\MASPINT.sys [2000-03-29 8096]
    R2 RioPNP;RioPNP; C:\WINNT\system32\drivers\RioPNP.sys [2000-06-06 6736]
    R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINNT\system32\drivers\ialmkchw.sys [2002-09-16 71514]
    R3 catchme;catchme; \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys []
    R3 E100B;Intel(R) PRO Adapter Driver; C:\WINNT\System32\DRIVERS\e100b325.sys [2002-02-25 139776]
    R3 GTWModem;GTW V.92 Voicemodem; C:\WINNT\System32\DRIVERS\GWMDM.sys [2002-08-06 1107680]
    R3 ialm;ialm; C:\WINNT\System32\DRIVERS\ialmnt5.sys [2002-09-16 79323]
    R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINNT\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
    R3 MxlW2k;MxlW2k; C:\WINNT\system32\drivers\MxlW2k.sys [2003-01-03 28276]
    R3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINNT\system32\drivers\NMSCFG.SYS []
    R3 Sk99202k;PS/2 Keyboard Filter Driver for Win2000; C:\WINNT\System32\DRIVERS\Sk99202k.sys [2000-09-11 7552]
    R3 smwdm;smwdm; C:\WINNT\system32\drivers\smwdm.sys [2002-04-04 459944]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2004-08-04 26624]
    R3 usbhub;USB2 Enabled Hub; C:\WINNT\System32\DRIVERS\usbhub.sys [2004-08-04 57600]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbuhci.sys [2004-08-04 20480]
    S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINNT\system32\drivers\ac97intc.sys [2001-08-17 96256]
    S3 ATWPKT2;ATWPKT2; \??\C:\WINNT\system32\drivers\ATWPKT2.SYS []
    S3 BCMModem;BCM V.90 56K Modem; C:\WINNT\System32\DRIVERS\BCMDM.sys [2001-08-17 871388]
    S3 Bridge;MAC Bridge; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
    S3 BridgeMP;MAC Bridge Miniport; C:\WINNT\System32\DRIVERS\bridge.sys [2004-08-04 71552]
    S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
    S3 GTNDIS5;GTNDIS5 NDIS Protocol Driver; \??\C:\WINNT\system32\GTNDIS5.SYS []
    S3 HidUsb;Microsoft HID Class Driver; C:\WINNT\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
    S3 mouhid;Mouse HID Driver; C:\WINNT\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2004-08-04 5504]
    S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
    S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
    S3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2004-08-04 1897408]
    S3 PCDRDRV;Pcdr Helper Driver; \??\C:\Atf\Qctest\PCDoc\PCDRDRV.sys []
    S3 PcdrNt;PcdrNt; C:\WINNT\System32\drivers\PcdrNt.sys []
    S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service; C:\WINNT\system32\drivers\usbscan.sys [2004-08-04 15104]
    S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
    S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
    S3 usbaudio;USB Audio Driver (WDM); C:\WINNT\system32\drivers\usbaudio.sys [2004-08-04 59264]
    S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINNT\System32\DRIVERS\usbccgp.sys [2004-08-04 31616]
    S3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2004-08-04 25856]
    S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2004-08-04 15104]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
    S3 VX3000;VX-3000; C:\WINNT\system32\DRIVERS\VX3000.sys [2006-06-29 1966256]
    S3 wanatw;WAN Miniport (ATW); C:\WINNT\System32\DRIVERS\wanatw4.sys [2003-01-10 33588]
    S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
    S3 WUSB54GV4SRV;Linksys Wireless-G USB Network Adapter Driver; C:\WINNT\System32\DRIVERS\rt2500usb.sys [2004-05-07 79616]
    S4 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINNT\System32\drivers\ws2ifsl.sys [2002-08-29 12032]

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-29 187184]
    R2 NMSSvc;Intel(R) NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
    R2 PrismXL;PrismXL; C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS [2002-08-19 57388]
    R2 sprtsvc_ddoctorv2;SupportSoft Sprocket Service (ddoctorv2); C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2008-04-24 202560]
    R2 UMWdf;Windows User Mode Driver Framework; C:\WINNT\system32\wdfmgr.exe [2005-01-28 38912]
    S3 usnsvc;Messenger Sharing USN Journal Reader service; C:\WINNT\system32\svchost.exe [2004-08-04 14336]

    -----------------EOF-----------------
  6. 2009-07-10, 18:03 #16
    Scofield
    Scofield is offline
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    RSIT #2

    info.txt logfile of random's system information tool 1.06 2009-07-10 11:59:41

    ======Uninstall list======

    -->C:\WINNT\IsUninst.exe -fC:\WINNT\orun32.isu
    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINNT\INF\PCHealth.inf
    Adobe Acrobat 5.0-->C:\WINNT\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
    Adobe Flash Player 9 ActiveX-->C:\WINNT\System32\Macromed\Flash\UninstFl.exe -q
    Adobe Reader 7.0.8-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70800000002}
    Comcast Toolbar-->C:\Program Files\ComcastToolbar\uninstall.exe
    Creative Jukebox Driver-->C:\Program Files\Creative\Jukebox Driver\DrvUnins.exe /s
    DelFin Media Viewer-->C:\WINNT\unvise32.exe C:\Program Files\DelFin\PromulGate\uninstal.log
    Desktop Doctor-->MsiExec.exe /I{D87149B3-7A1D-4548-9CBF-032B791E5908}
    Do More-->C:\WINNT\IsUninst.exe -f"C:\Program Files\Gateway\Do More\Uninst.isu"
    DVD-->"C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
    Easy CD Creator 5 Platinum-->MsiExec.exe /I{8851E12C-0EF9-11D4-A788-009027ABA5D0}
    EPSON Printer Software-->C:\WINNT\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
    ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
    Film Factory-->C:\WINNT\IsUninst.exe -f"C:\Program Files\EPSON Software\Film Factory\Uninst.isu"
    FinePixViewer Ver.4.2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ED4D80-8294-11D5-96CD-0040266301AD}\SETUP.EXE"
    FUJIFILM USB Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE"
    Gateway Rhapsody-->"C:\Program Files\Gateway Rhapsody\Unwise32.exe" C:\PROGRA~1\GATEWA~1\Install.log
    Gateway Rhapsody-->"C:\Program Files\SIFXINST\SIFXINST.EXE" /UnapplyFile 20BBF229-A337-40AD-9FEB-2C98CDA53D1C /Prompt
    GTW V.92 Voicemodem-->C:\WINNT\GWMDMU.exe verbose
    HijackThis 2.0.2-->"C:\Documents and Settings\Owner\Desktop\HijackThis.exe" /uninstall
    ImageMixer VCD2 for FinePix-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{934E9442-D305-4ACF-AD87-A6C11D677CB9}\setup.exe"
    Intel(R) PRO Ethernet Adapter and Software-->Prounstl.exe
    Intel(R) PROSet II-->MsiExec.exe /I{01A4AEDE-F219-49A2-B855-16A016EAF9A4}
    IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe
    Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
    Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
    MediaFACE 4.01 Image Library-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{82AF77BC-423D-42DA-BE5B-FFCA04752181} /l1033
    MediaFACE 4.01-->C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{41979C2F-34B8-4F92-8111-B13C5864682D} /l1033
    MediaLoads Installer-->"C:\Program Files\DownloadWare\dw.exe" /R
    Microsoft .NET Framework (English) v1.0.3705-->C:\WINNT\Microsoft.NET\Framework\Install.exe /u /p Microsoft .NET Framework Full v1.0.3705 (1033)
    Microsoft .NET Framework (English)-->MsiExec.exe /X{B43357AA-3A6D-4D94-B56E-43C44D09E548}
    Microsoft Encarta Encyclopedia Standard 2003-->MsiExec.exe /I{03410014-3975-4267-9F39-1DC4745090B7}
    Microsoft LifeCam-->MsiExec.exe /X{4DEE75B1-B201-4DA3-A50F-007CDB00DA23}
    Microsoft Office 2000 Small Business-->MsiExec.exe /I{00030409-78E1-11D2-B60F-006097C998E7}
    Microsoft Picture It! Photo 7.0-->MsiExec.exe /I{369B36BE-3D64-4641-9AEA-808D436FE132}
    Microsoft Streets and Trips 2002-->MsiExec.exe /I{12BDDF23-B1DB-49C8-92D3-3E6841CCED61}
    Microsoft Word 2002-->MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
    Microsoft Works 2003 Setup Launcher-->C:\Program Files\Microsoft Works Suite 2003\Setup\Launcher.exe d:\
    Microsoft Works 7.0-->MsiExec.exe /I{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}
    Microsoft Works Suite Add-in for Microsoft Word-->MsiExec.exe /I{7EE9DE0D-9228-4C33-B80E-FDD1773600DF}
    MicroStaff WINASPI-->C:\MWASPI\uninst.exe
    mIRC-->"c:\winnt\ntconfig\windows\bootup\sysconfig\lsass.exe" -uninstall
    MSN Music Assistant-->rundll32 advpack.dll,LaunchINFSection C:\WINNT\INF\msninst.inf,Uninstall
    MSN Toolbar-->C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\mtbs.exe c
    MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    MUSICMATCH Jukebox-->C:\WINNT\IsUninst.exe -f"C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\Uninst.isu" -cC:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.dll
    MUSTEK 1200 UB v2.1-->C:\WINNT\TWAIN_32\1200UB\UNINST.EXE
    Need2Find Bar-->rundll32 C:\PROGRA~1\NEED2F~1\bar\1.bin\Nd2fnBar.dll,O
    NOMAD Jukebox 3 Driver-->C:\Program Files\Creative\Jukebox 3 Drivers\DrvUnins.exe /s
    PhotoParade Player-->"C:\Program Files\PhotoParade\Uninstall PhotoParade Player.exe" "PhotoParade.exe"
    PS/2 Millennium Keyboard-->SKUninst.exe SK_PS2MillenniumKeyboard
    QuickTime-->C:\WINNT\unvise32qt.exe C:\WINNT\System32\QuickTime\Uninstall.log
    RAW FILE CONVERTER LE-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D680C913-5955-469D-9D88-C1940F7506D6}\SETUP.EXE" -l0x9
    RealPlayer Basic-->C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
    Rhapsody Player Engine-->MsiExec.exe /I{30C2FCD0-FF7B-4FFA-8DDE-43A22E01A1E7}
    Search Assistant-->"C:\Program Files\se\v11\se.EXE" /R W
    Search Function-->"C:\Program Files\se\v11\se.EXE" /R S
    Search MS.C-->"C:\Program Files\msnet\v9\msnet.EXE" /R S
    Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINNT\$NtUninstallKB898458$\spuninst\spuninst.exe"
    Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINNT\$NtUninstallKB923723$\spuninst\spuninst.exe"
    Security Update for Windows Media Player (KB911564)-->"C:\WINNT\$NtUninstallKB911564$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 10 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 10 (KB936782)-->"C:\WINNT\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINNT\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
    Security Update for Windows Media Player 8 (KB917734)-->"C:\WINNT\$NtUninstallKB917734_WMP8$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB890046)-->"C:\WINNT\$NtUninstallKB890046$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB893756)-->"C:\WINNT\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896358)-->"C:\WINNT\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896423)-->"C:\WINNT\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896424)-->"C:\WINNT\$NtUninstallKB896424$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB896428)-->"C:\WINNT\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB899587)-->"C:\WINNT\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB899591)-->"C:\WINNT\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB900725)-->"C:\WINNT\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901017)-->"C:\WINNT\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB901214)-->"C:\WINNT\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB902400)-->"C:\WINNT\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB905414)-->"C:\WINNT\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB905749)-->"C:\WINNT\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB908519)-->"C:\WINNT\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911562)-->"C:\WINNT\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911567)-->"C:\WINNT\$NtUninstallKB911567$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB911927)-->"C:\WINNT\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB912919)-->"C:\WINNT\$NtUninstallKB912919$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB913580)-->"C:\WINNT\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB914388)-->"C:\WINNT\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB914389)-->"C:\WINNT\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917159)-->"C:\WINNT\$NtUninstallKB917159$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917344)-->"C:\WINNT\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917422)-->"C:\WINNT\$NtUninstallKB917422$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB917953)-->"C:\WINNT\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB918118)-->"C:\WINNT\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB918899)-->"C:\WINNT\$NtUninstallKB918899$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB919007)-->"C:\WINNT\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920213)-->"C:\WINNT\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920214)-->"C:\WINNT\$NtUninstallKB920214$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920670)-->"C:\WINNT\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920683)-->"C:\WINNT\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB920685)-->"C:\WINNT\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB921398)-->"C:\WINNT\$NtUninstallKB921398$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB921503)-->"C:\WINNT\$NtUninstallKB921503$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB921883)-->"C:\WINNT\$NtUninstallKB921883$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922616)-->"C:\WINNT\$NtUninstallKB922616$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922760)-->"C:\WINNT\$NtUninstallKB922760$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB922819)-->"C:\WINNT\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923191)-->"C:\WINNT\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923414)-->"C:\WINNT\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923689)-->"C:\WINNT\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923694)-->"C:\WINNT\$NtUninstallKB923694$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB923980)-->"C:\WINNT\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924191)-->"C:\WINNT\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924270)-->"C:\WINNT\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924496)-->"C:\WINNT\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB924667)-->"C:\WINNT\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925454)-->"C:\WINNT\$NtUninstallKB925454$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925486)-->"C:\WINNT\$NtUninstallKB925486$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB925902)-->"C:\WINNT\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB926255)-->"C:\WINNT\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB926436)-->"C:\WINNT\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB927779)-->"C:\WINNT\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB927802)-->"C:\WINNT\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928090)-->"C:\WINNT\$NtUninstallKB928090$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928255)-->"C:\WINNT\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB928843)-->"C:\WINNT\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB929123)-->"C:\WINNT\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB929969)-->"C:\WINNT\$NtUninstallKB929969$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB930178)-->"C:\WINNT\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931261)-->"C:\WINNT\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931768)-->"C:\WINNT\$NtUninstallKB931768$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB931784)-->"C:\WINNT\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB932168)-->"C:\WINNT\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB933566)-->"C:\WINNT\$NtUninstallKB933566$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB933729)-->"C:\WINNT\$NtUninstallKB933729$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB935839)-->"C:\WINNT\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB935840)-->"C:\WINNT\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB936021)-->"C:\WINNT\$NtUninstallKB936021$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB937143)-->"C:\WINNT\$NtUninstallKB937143$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938127)-->"C:\WINNT\$NtUninstallKB938127$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB938829)-->"C:\WINNT\$NtUninstallKB938829$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB939653)-->"C:\WINNT\$NtUninstallKB939653$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941202)-->"C:\WINNT\$NtUninstallKB941202$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941568)-->"C:\WINNT\$NtUninstallKB941568$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941569)-->"C:\WINNT\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB941644)-->"C:\WINNT\$NtUninstallKB941644$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB942615)-->"C:\WINNT\$NtUninstallKB942615$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943055)-->"C:\WINNT\$NtUninstallKB943055$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943460)-->"C:\WINNT\$NtUninstallKB943460$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB943485)-->"C:\WINNT\$NtUninstallKB943485$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944338-v2)-->"C:\WINNT\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944533)-->"C:\WINNT\$NtUninstallKB944533$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB944653)-->"C:\WINNT\$NtUninstallKB944653$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB946026)-->"C:\WINNT\$NtUninstallKB946026$\spuninst\spuninst.exe"
    Security Update for Windows XP (KB956390)-->"C:\WINNT\$NtUninstallKB956390$\spuninst\spuninst.exe"
    Select CashBack-->C:\WINNT\vcp41t2q.exe
    Shockwave-->C:\WINNT\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINNT\System32\Macromed\SHOCKW~1\Install.log
    Sidebar Search-->"C:\Program Files\se\v11\se.EXE" /R R
    Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    Update for Windows XP (KB898461)-->"C:\WINNT\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Update for Windows XP (KB900485)-->"C:\WINNT\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Update for Windows XP (KB908531)-->"C:\WINNT\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Update for Windows XP (KB910437)-->"C:\WINNT\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Update for Windows XP (KB911280)-->"C:\WINNT\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Update for Windows XP (KB916595)-->"C:\WINNT\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Update for Windows XP (KB920872)-->"C:\WINNT\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Update for Windows XP (KB922582)-->"C:\WINNT\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Update for Windows XP (KB927891)-->"C:\WINNT\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Update for Windows XP (KB929338)-->"C:\WINNT\$NtUninstallKB929338$\spuninst\spuninst.exe"
    Update for Windows XP (KB930916)-->"C:\WINNT\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Update for Windows XP (KB931836)-->"C:\WINNT\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Update for Windows XP (KB933360)-->"C:\WINNT\$NtUninstallKB933360$\spuninst\spuninst.exe"
    Update for Windows XP (KB936357)-->"C:\WINNT\$NtUninstallKB936357$\spuninst\spuninst.exe"
    Update for Windows XP (KB938828)-->"C:\WINNT\$NtUninstallKB938828$\spuninst\spuninst.exe"
    Update for Windows XP (KB942763)-->"C:\WINNT\$NtUninstallKB942763$\spuninst\spuninst.exe"
    Update for Windows XP (KB942840)-->"C:\WINNT\$NtUninstallKB942840$\spuninst\spuninst.exe"
    Update for Windows XP (KB946627)-->"C:\WINNT\$NtUninstallKB946627$\spuninst\spuninst.exe"
    Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
    WebSearch Tools-->C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe uninstesies
    Win Search-->"C:\Program Files\winex\v2\winex.EXE" /R F
    Windows Installer 3.1 (KB893803)-->"C:\WINNT\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
    Windows Live Messenger-->MsiExec.exe /I{FCE50DB8-C610-4C42-BE5C-193F46C6F812}
    Windows Live Sign-in Assistant-->MsiExec.exe /I{22B3CC30-77B8-419C-AA4B-F571FDF5D66D}
    Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
    Windows Media Player 10 Hotfix - KB895316-->"C:\WINNT\$NtUninstallKB895316$\spuninst\spuninst.exe"
    Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
    Windows XP Hotfix - KB873333-->C:\WINNT\$NtUninstallKB873333$\spuninst\spuninst.exe
    Windows XP Hotfix - KB873339-->C:\WINNT\$NtUninstallKB873339$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885835-->C:\WINNT\$NtUninstallKB885835$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885836-->C:\WINNT\$NtUninstallKB885836$\spuninst\spuninst.exe
    Windows XP Hotfix - KB885884-->C:\WINNT\$NtUninstallKB885884$\spuninst\spuninst.exe
    Windows XP Hotfix - KB886185-->C:\WINNT\$NtUninstallKB886185$\spuninst\spuninst.exe
    Windows XP Hotfix - KB887472-->C:\WINNT\$NtUninstallKB887472$\spuninst\spuninst.exe
    Windows XP Hotfix - KB888113-->C:\WINNT\$NtUninstallKB888113$\spuninst\spuninst.exe
    Windows XP Hotfix - KB888302-->C:\WINNT\$NtUninstallKB888302$\spuninst\spuninst.exe
    Windows XP Hotfix - KB890175-->C:\WINNT\$NtUninstallKB890175$\spuninst\spuninst.exe
    Windows XP Hotfix - KB890859-->"C:\WINNT\$NtUninstallKB890859$\spuninst\spuninst.exe"
    Windows XP Hotfix - KB891781-->C:\WINNT\$NtUninstallKB891781$\spuninst\spuninst.exe
    Windows XP Hotfix - KB893066-->"C:\WINNT\$NtUninstallKB893066$\spuninst\spuninst.exe"
    Windows XP Hotfix - KB893086-->"C:\WINNT\$NtUninstallKB893086$\spuninst\spuninst.exe"
    Windows XP Service Pack 2-->C:\WINNT\$NtServicePackUninstall$\spuninst\spuninst.exe
    Your MS.C Assistant-->"C:\Program Files\msnet\v9\msnet.EXE" /R H

    =====HijackThis Backups=====

    O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM [2009-07-09]
    O24 - Desktop Component 0: (no name) - http://www.3dwallpaper.com/fg/trinity2k2.jpg [2009-07-09]
    R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank [2009-07-09]
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2009-07-09]
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank [2009-07-09]
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank [2009-07-09]
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2009-07-09]
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) [2009-07-09]
    O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2009-07-09]
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [2009-07-09]
    O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL [2009-07-09]
    O1 - Hosts: 127.0.0.3 allforadult.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.sexfiles.nu [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.allforadult.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 slutmania.biz [2009-07-09]
    O1 - Hosts: 127.0.0.3 virgin-tgp.net [2009-07-09]
    O1 - Hosts: 127.0.0.3 nylonsexy.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.toolbarpartner.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.slutmania.biz [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.virgin-tgp.net [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.nylonsexy.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 sexfiles.nu [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.megapornix.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 toolbarpartner.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 aaasexypics.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.aaasexypics.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 megapornix.com [2009-07-09]
    O1 - Hosts: 127.0.0.3 www.sp2fucked.biz [2009-07-09]
    O1 - Hosts: 127.0.0.3 sp2fucked.biz [2009-07-09]
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-07-10]
    O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINNT\wanmpsvc.exe [2009-07-10]
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background [2009-07-10]
    O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe [2009-07-10]
    O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe [2009-07-10]
    O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 [2009-07-10]
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158460677\ee\AOLSoftware.exe [2009-07-10]
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [2009-07-10]
    O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2009-07-10]
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/ [2009-07-10]

    ======Hosts File======

    127.0.0.1 localhost

    ======System event log======

    Computer Name: CHRISTYNA
    Event Code: 36
    Message: The time service has not been able to synchronize the system time
    for 49152 seconds because none of the time providers has been able to
    provide a usable time stamp. The system clock is unsynchronized.

    Record Number: 76288
    Source Name: W32Time
    Time Written: 20071128165424.000000-300
    Event Type: warning
    User:

    Computer Name: CHRISTYNA
    Event Code: 1003
    Message: Your computer was not able to renew its address from the network (from the
    DHCP Server) for the Network Card with network address 0007E9C1FD13. The following
    error occurred:
    The semaphore timeout period has expired.
    .
    Your computer will continue to try and obtain an address on its own from
    the network address (DHCP) server.

    Record Number: 76251
    Source Name: Dhcp
    Time Written: 20071126183931.000000-300
    Event Type: warning
    User:

    Computer Name: CHRISTYNA
    Event Code: 10010
    Message: The server {0006F03A-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

    Record Number: 76160
    Source Name: DCOM
    Time Written: 20071121222450.000000-300
    Event Type: error
    User: CHRISTYNA\Owner

    Computer Name: CHRISTYNA
    Event Code: 10010
    Message: The server {0006F03A-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

    Record Number: 76159
    Source Name: DCOM
    Time Written: 20071121222414.000000-300
    Event Type: error
    User: CHRISTYNA\Owner

    Computer Name: CHRISTYNA
    Event Code: 36
    Message: The time service has not been able to synchronize the system time
    for 49152 seconds because none of the time providers has been able to
    provide a usable time stamp. The system clock is unsynchronized.

    Record Number: 76151
    Source Name: W32Time
    Time Written: 20071121165408.000000-300
    Event Type: warning
    User:

    =====Application event log=====

    Computer Name: CHRISTYNA
    Event Code: 11
    Message: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.


    Record Number: 42575
    Source Name: crypt32
    Time Written: 20090705123839.000000-240
    Event Type: error
    User:

    Computer Name: CHRISTYNA
    Event Code: 1002
    Message: Hanging application ccApp.exe, version 103.0.1.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Record Number: 42573
    Source Name: Application Hang
    Time Written: 20090705122309.000000-240
    Event Type: error
    User:

    Computer Name: CHRISTYNA
    Event Code: 1002
    Message: Hanging application ccApp.exe, version 103.0.1.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Record Number: 42572
    Source Name: Application Hang
    Time Written: 20090705122309.000000-240
    Event Type: error
    User:

    Computer Name: CHRISTYNA
    Event Code: 1000
    Message: Faulting application skype.exe, version 2.5.0.151, faulting module skype.exe, version 2.5.0.151, fault address 0x00004302.

    Record Number: 42571
    Source Name: Application Error
    Time Written: 20090705120134.000000-240
    Event Type: error
    User:

    Computer Name: CHRISTYNA
    Event Code: 56
    Message:
    Record Number: 42540
    Source Name: LiveUpdate
    Time Written: 20081206100806.000000-300
    Event Type: error
    User: NT AUTHORITY\SYSTEM

    ======Environment variables======

    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Common Files\Adaptec Shared\System
    "windir"=%SystemRoot%
    "OS"=Windows_NT
    "PROCESSOR_ARCHITECTURE"=x86
    "PROCESSOR_LEVEL"=15
    "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 7, GenuineIntel
    "PROCESSOR_REVISION"=0207
    "NUMBER_OF_PROCESSORS"=1
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "FP_NO_HOST_CHECK"=NO

    -----------------EOF-----------------
  7. 2009-07-10, 22:46 #17
    katana
    katana is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Manchester UK
    Posts
    3,425

    Default

    ----------------------------------------------------------------------------------------
    Step 1

    Download and Run SystemLook

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :regfind
DelFin
Need2Find
msnet
vcp41t2q.exe
Program Files\se
WToolsA.exe
winex.EXE
:comment
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

    ----------------------------------------------------------------------------------------
    Step 2

    Active Scan
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Please go to this site Link >> ActiveScan << LINK
    • Click the Scan Now button
    • Follow the prompts to install the Active X if necessary
    • Go and make a cup of tea/coffee/beverage of your choice and watch some TV
    • When the scan is finished, a report will be generated
    • Next to Scan Details click the small export to notepad button and save the report to your desktop.
    • Please post the report in your reply.
    Microsoft MVP Consumer Security 2009 -2010
    If we have helped, please consider a donation
    THESE INSTRUCTIONS ARE FOR THIS USER ONLY
  8. 2009-07-11, 02:31 #18
    Scofield
    Scofield is offline
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    We are making great progess Katana. Thanks again! Following are the requested logs...

    SystemLook v1.0 by jpshortstuff (22.05.09)
    Log created at 18:11 on 10/07/2009 by Owner (Administrator - Elevation successful)

    ========== regfind ==========

    Searching for "DelFin"
    [HKEY_CURRENT_USER\Software\DelFin]
    [HKEY_CURRENT_USER\Software\DelFin\PromulGate]
    ""Install""=="C:\Program Files\DelFin\PromulGate"
    [HKEY_CURRENT_USER\Software\DelFin\PromulGate]
    ""Install""=="C:\Program Files\DelFin\PromulGate"
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
    [HKEY_LOCAL_MACHINE\SOFTWARE\DelFin]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
    ""DisplayName""=="DelFin Media Viewer"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
    ""DisplayName""=="DelFin Media Viewer"
    [HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin]
    [HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin\PromulGate]
    ""Install""=="C:\Program Files\DelFin\PromulGate"
    [HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin\PromulGate]
    ""Install""=="C:\Program Files\DelFin\PromulGate"
    [HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]

    Searching for "Need2Find"
    [HKEY_CURRENT_USER\Software\Need2Find]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}]
    "@"=="Need2Find Bar"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}]
    "@"=="Need2Find Bar Settings"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\InprocServer32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\ProgID]
    "@"=="Need2FindBar.SettingsPlugin.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E8B-A32A-416b-BCDB-33B3EF3617D3}\VersionIndependentProgID]
    "@"=="Need2FindBar.SettingsPlugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
    "@"=="Need2Find Toolbar Plugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\InprocServer32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\InprocServer32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\ProgID]
    "@"=="Need2FindBar.ToolbarPlugin.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}\VersionIndependentProgID]
    "@"=="Need2FindBar.ToolbarPlugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
    "@"=="INeed2FindBarSettings"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8C-A32A-416B-BCDB-33B3EF3617D3}]
    "@"=="_INeed2FindBarSettingsEvents"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
    "@"=="Need2Find Bar Settings Plugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin\CurVer]
    "@"=="Need2FindBar.SettingsPlugin.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
    "@"=="Need2Find Bar Settings Plugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
    "@"=="Need2Find Toolbar Plugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin\CurVer]
    "@"=="Need2FindBar.ToolbarPlugin.1"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
    "@"=="Need2Find Toolbar Plugin"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3}\1.0\0\win32]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3}\1.0\HELPDIR]
    "@"=="C:\Program Files\Need2Find\bar\1.bin\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
    ""DisplayName""=="Need2Find Bar"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
    ""DisplayName""=="Need2Find Bar"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
    ""DisplayName""=="Need2Find Bar"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
    ""DisplayName""=="Need2Find Bar"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
    ""DisplayName""=="Need2Find Bar"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find\bar]
    ""Dir""=="C:\Program Files\Need2Find\bar\"
    [HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find]

    Searching for "msnet"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9EA69F99-F8FF-415E-8B90-35D6DFAF160E}\InProcServer32]
    "@"=="C:\WINNT\System32\msnetobj.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9EA69F99-F8FF-415E-8B90-35D6DFAF160E}\InProcServer32]
    "@"=="C:\WINNT\System32\msnetobj.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9FC132B-096D-460B-B7D5-1DB0FAE0C062}\InprocServer32]
    "@"=="C:\WINNT\system32\msnetobj.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A9FC132B-096D-460B-B7D5-1DB0FAE0C062}\InprocServer32]
    "@"=="C:\WINNT\system32\msnetobj.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8AA720BF-7468-4DA1-97DA-66D2E41B3DDA}\1.0]
    "@"=="msnetobj 1.0 Type Library"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{8AA720BF-7468-4DA1-97DA-66D2E41B3DDA}\1.0\0\win32]
    "@"=="C:\WINNT\system32\msnetobj.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
    ""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R S"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
    ""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R S"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
    ""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R H"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
    ""UninstallString""==""C:\Program Files\msnet\v9\msnet.EXE" /R H"
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\MUILanguages\RCV2\msnetobj.dll]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\msnetobj.dll]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\msnetobj.dll]

    Searching for "vcp41t2q.exe"
    No data found.

    Searching for "Program Files\se"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
    ""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R W"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
    ""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R W"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
    ""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R S"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
    ""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R S"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
    ""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R R"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
    ""UninstallString""==""C:\Program Files\se\v11\se.EXE" /R R"

    Searching for "WToolsA.exe"
    No data found.

    Searching for "winex.EXE"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
    ""UninstallString""==""C:\Program Files\winex\v2\winex.EXE" /R F"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
    ""UninstallString""==""C:\Program Files\winex\v2\winex.EXE" /R F"

    -=End Of File=-
  9. 2009-07-11, 02:32 #19
    Scofield
    Scofield is offline
    Member
    Join Date
    Apr 2006
    Posts
    69

    Default

    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2009-07-10 20:25:51
    PROTECTIONS: 0
    MALWARE: 94
    SUSPECTS: 1
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    00001888 adware/dyfuca Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer
    00013876 Application/Psexec.A HackTools No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\boot.exe
    00013991 Application/RebootN.A HackTools No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\restart.exe
    00018331 adware/gator Adware No 0 Yes No c:\winnt\gatorpatch.log
    00020900 spyware/apropos Spyware No 1 Yes No c:\winnt\system32\auto_update_uninstall.log
    00024343 adware/keenvalue Adware No 0 Yes No c:\program files\perfectnav
    00024343 adware/keenvalue Adware No 0 Yes No hkey_local_machine\software\perfectnav
    00027660 adware/savenow Adware No 0 Yes No c:\winnt\system32\wsxsvc
    00027660 adware/savenow Adware No 0 Yes No hkey_local_machine\software\whenu
    00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\classes\appid\adm.exe
    00029258 application/altnet HackTools No 0 Yes No hkey_local_machine\software\classes\appid\altnet signing module.exe
    00029258 application/altnet HackTools No 0 Yes No hkey_classes_root\appid\adm.exe
    00029767 adware/delfinmedia Adware No 1 Yes No hkey_current_user\software\delfin
    00029767 adware/delfinmedia Adware No 1 Yes No hkey_local_machine\software\delfin
    00034279 adware/mediatickets Adware No 1 Yes No c:\winnt\downloaded program files\mediaticketsinstaller.inf
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-games-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-autos-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-entertainment-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-health and fitness-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-music-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-computers and internet-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-business directory-
    00039204 adware/cws Adware No 0 Yes No c:\documents and settings\owner\favorites\-travel-
    00040415 adware/wintools Adware No 0 Yes No hkey_local_machine\system\controlset001\enum\root\legacy_tbpssvc
    00040415 adware/wintools Adware No 0 Yes No hkey_classes_root\wsg.wsgobj
    00040471 adware/downloadware Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware
    00046160 adware/searchexe Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant
    00046160 adware/searchexe Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\search function
    00048503 spyware/clipgenie Spyware No 1 Yes No hkey_current_user\software\traynotifier
    00049442 adware/scbar Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search
    00049468 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129522.dll
    00049470 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129497.exe
    00049470 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129490.exe
    00049471 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129491.dll
    00049471 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129498.dll
    00055559 Adware/DownloadWare Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129537.exe
    00065614 Bck/IRCFlood.G Virus/Trojan No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll
    00091847 Application/PrcView.A HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1695\A0133795.exe
    00095999 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129521.dll
    00096565 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129540.dll
    00097149 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129493.dll
    00097150 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129504.dll
    00097984 Adware/Cydoor Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129526.dll
    00099224 Application/MyWay HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129515.DLL
    00099503 Adware/Medload Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1694\A0133792.exe
    00099617 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129541.exe
    00103402 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129546.dll
    00103403 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129611.exe
    00103404 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129544.dll
    00103405 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129550.dll
    00106277 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129551.dll
    00107290 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129606.dll
    00107291 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129609.dll
    00107296 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129542.dll
    00107366 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129548.dll
    00107367 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129543.dll
    00107368 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129545.dll
    00107369 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129607.dll
    00107370 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129547.dll
    00107371 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129552.dll
    00107387 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129608.dll
    00107388 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129612.exe
    00107389 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129614.exe
    00107390 Adware/Gator Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129610.dll
    00114504 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129503.dll
    00114505 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129500.dll
    00114506 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129501.dll
    00114508 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129495.exe
    00114509 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129494.dll
    00114510 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129496.dll
    00116708 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129489.exe
    00121953 Adware/eZula Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134996.exe
    00121953 Adware/eZula Adware No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\ezStub.exe.vir
    00122010 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129524.exe
    00130110 Hacktool/CCProxyOver HackTools No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\mscfg32bit.exe
    00132145 Adware/DownloadWare Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129620.exe
    00132146 Adware/DownloadWare Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129619.DLL
    00132694 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129523.dll
    00132695 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129525.dll
    00135485 Adware/MediaTickets Adware No 1 Yes No C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx
    00135485 Adware/MediaTickets Adware No 1 Yes No C:\Qoobox\Quarantine\C\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx.vir
    00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@casalemedia[1].txt
    00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt
    00139864 Adware/TopMoxie Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129615.exe
    00142033 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129492.dll
    00144676 Adware/CWS.Searchmeup Adware No 1 Yes No C:\Qoobox\Quarantine\C\WINNT\hosts.vir
    00156692 Adware/nCase Adware No 0 Yes No C:\WINNT\Downloaded Program Files\RCXF39.tmp
    00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@ad.yieldmanager[1].txt
    00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt
    00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.toolbarplugin.1
    00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.settingsplugin
    00169752 application/need2find HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}
    00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.toolbarplugin
    00169752 application/need2find HackTools No 0 Yes No hkey_current_user\software\need2find
    00169752 application/need2find HackTools No 0 Yes No HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}
    00169752 Application/Need2Find HackTools No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\Need2Find\bar\1.bin\NPND2FN.DLL.vir
    00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\need2findbar.settingsplugin.1
    00169752 application/need2find HackTools No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall
    00169752 application/need2find HackTools No 0 Yes No hkey_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}
    00169752 application/need2find HackTools No 0 Yes No hkey_local_machine\software\need2find
    00169753 Application/Need2Find HackTools No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\Need2Find\bar\1.bin\N2PLUGIN.DLL.vir
    00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@overture[1].txt
    00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129519.exe
    00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129518.exe
    00172889 Spyware/New.net Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129517.exe
    00174723 Adware/SAHAgent Adware No 0 Yes No C:\WINNT\system32\4o256jcj.exe
    00178289 Spyware/MarketScore Spyware No 1 Yes No C:\Qoobox\Quarantine\C\WINNT\system32\rk.bin.vir
    00180282 Application/Need2Find HackTools No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL.vir
    00184065 Adware/SAHAgent Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129509.exe
    00184066 Adware/SAHAgent Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129508.dll
    00184067 Adware/SAHAgent Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129507.exe
    00215582 Adware/WebHancer Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129487.exe
    00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@atwola[1].txt
    00278769 Application/PRScheduler HackTools No 0 Yes No C:\WINNT\pss\PowerReg SchedulerV2.exeStartup
    00285172 Application/BrilliantDigital HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129502.dll
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134338.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134339.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134340.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134341.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134342.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134343.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134346.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134347.dll
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134350.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134351.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134352.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134355.dll
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134356.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134360.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134362.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134363.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134367.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134370.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134336.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134372.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134385.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134386.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134393.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134396.ocx
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134397.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134335.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134399.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134400.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134401.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134402.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134404.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134405.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134406.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134408.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134409.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134410.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134416.dll
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134417.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134420.dll
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134425.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134426.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134427.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134429.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134326.exe
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134371.dll
    00447834 Adware/Lop Adware No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1696\A0134398.exe
    00501626 Spyware/Clipgenie Spyware No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129505.DLL
    00527202 Application/PRScheduler HackTools No 0 Yes No C:\WINNT\pss\PowerReg Scheduler.exeStartup
    00532291 Trj/Downloader.LTJ Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129516.dll
    00590315 Rootkit/Agent.LNB HackTools No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1695\A0133798.sys
    02834437 W32/Randon.GB.worm Virus/Worm No 0 Yes No C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll
    03008302 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129482.exe
    03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129533.exe
    03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129538.exe
    03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129536.exe
    03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\Qoobox\Quarantine\C\Program Files\webHancer\Programs\webhdll.dll.vir
    03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129534.exe
    03950453 Generic Trojan Virus/Trojan No 0 No No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1695\A0133921.exe[²≡\Mutex.dll]
    03950453 Generic Trojan Virus/Trojan No 0 No No C:\Qoobox\Quarantine\C\Program Files\Morpheus\update.exe.vir[²≡\Mutex.dll]
    04199668 Generic Malware Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{30F71744-7195-4A81-BC43-76AFE6B4AF0F}\RP1692\A0129485.dll
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location 
    ;===================================================================================================================================================================================
    No C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll 
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description 
    ;===================================================================================================================================================================================
    210625 HIGH MS09-026 
    210624 HIGH MS09-025 
    210621 HIGH MS09-022 
    210618 HIGH MS09-019 
    208380 HIGH MS09-015 
    208379 HIGH MS09-014 
    208378 HIGH MS09-013 
    208377 HIGH MS09-012 
    206981 HIGH MS09-007 
    206980 HIGH MS09-006 
    204670 HIGH MS09-001 
    203806 HIGH MS08-078 
    203508 HIGH MS08-073 
    203505 HIGH MS08-071 
    202465 HIGH MS08-068 
    201683 HIGH MS08-067 
    201258 HIGH MS08-066 
    201256 HIGH MS08-064 
    201255 HIGH MS08-063 
    201253 HIGH MS08-061 
    209275 HIGH MS08-049 
    196455 MEDIUM MS08-037 
    194860 HIGH MS08-030 
    191618 HIGH MS08-025 
    191614 HIGH MS08-021 
    191613 HIGH MS08-020 
    120815 HIGH MS06-022 
    ;===================================================================================================================================================================================
  10. 2009-07-11, 11:51 #20
    katana
    katana is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Manchester UK
    Posts
    3,425

    Default

    OTMoveIt
    Please download OTM by OldTimer and save it to your desktop
    • Double-click OTM.exe to run it.
    • Copy the lines in the codebox below. ( Make sure you include :Processes )

    Code:
    :Processes
:Reg
[-HKEY_CLASSES_ROOT\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
[-HKEY_CURRENT_USER\Software\DelFin]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[-HKEY_CURRENT_USER\Software\Need2Find]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D1C4E89-A32A-416b-BCDB-33B3EF3617D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D1C4E8A-A32A-416B-BCDB-33B3EF3617D3}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.SettingsPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Need2FindBar.ToolbarPlugin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D1C4E80-A32A-416B-BCDB-33B3EF3617D3]
[-HKEY_LOCAL_MACHINE\SOFTWARE\DelFin]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DelFin Media Viewer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Need2FindBar Uninstall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Need2FindBar Uninstall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Assistant]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Function]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search MS.C]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Select CashBack]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sidebar Search]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebSearch Tools]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Search]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Your MS.C Assistant]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Need2Find]
[-HKEY_LOCAL_MACHINE\software\classes\CLSID\{630D6140-04C5-4db0-B27A-020D766FF09B}]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\DelFin]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\DelFin Media Viewer]
[-HKEY_USERS\S-1-5-21-2411869081-1018091610-1310527055-1003\Software\Need2Find]
[-HKEY_classes_root\appid\adm.exe]
[-HKEY_classes_root\clsid\{630d6140-04c5-4db0-b27a-020d766ff09b}]
[-HKEY_classes_root\need2findbar.settingsplugin.1]
[-HKEY_classes_root\need2findbar.settingsplugin]
[-HKEY_classes_root\need2findbar.toolbarplugin.1]
[-HKEY_classes_root\need2findbar.toolbarplugin]
[-HKEY_classes_root\wsg.wsgobj]
[-HKEY_current_user\software\delfin]
[-HKEY_current_user\software\need2find]
[-HKEY_current_user\software\traynotifier]
[-HKEY_local_machine\software\classes\appid\adm.exe]
[-HKEY_local_machine\software\classes\appid\altnet signing module.exe]
[-HKEY_local_machine\software\delfin]
[-HKEY_local_machine\software\microsoft\windows\currentversion\app management\arpcache\internet optimizer]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\downloadware]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\need2findbar uninstall]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search assistant]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\search function]
[-HKEY_local_machine\software\microsoft\windows\currentversion\uninstall\sidebar search]
[-HKEY_local_machine\software\need2find]
[-HKEY_local_machine\software\perfectnav]
[-HKEY_local_machine\software\whenu]
[-HKEY_local_machine\system\controlset001\enum\root\legacy_tbpssvc]
:Files
C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx
C:\WINNT\Downloaded Program Files\RCXF39.tmp
C:\WINNT\ntconfig\windows\bootup\sysconfig\boot.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\java.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\mscfg32bit.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\nhtml.dll
C:\WINNT\ntconfig\windows\bootup\sysconfig\restart.exe
C:\WINNT\ntconfig\windows\bootup\sysconfig\uuid.dll 
C:\WINNT\pss\PowerReg Scheduler.exeStartup
C:\WINNT\pss\PowerReg SchedulerV2.exeStartup
C:\WINNT\system32\4o256jcj.exe
c:\documents and settings\owner\favorites\-autos-
c:\documents and settings\owner\favorites\-business directory-
c:\documents and settings\owner\favorites\-computers and internet-
c:\documents and settings\owner\favorites\-entertainment-
c:\documents and settings\owner\favorites\-games-
c:\documents and settings\owner\favorites\-health and fitness-
c:\documents and settings\owner\favorites\-music-
c:\documents and settings\owner\favorites\-travel-
c:\program files\perfectnav
c:\winnt\downloaded program files\mediaticketsinstaller.inf
c:\winnt\gatorpatch.log
c:\winnt\system32\auto_update_uninstall.log
c:\winnt\system32\wsxsvc
:Commands
[Purity]
[EmptyTemp]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

    • - Close ALL open windows (especially Internet Explorer!)-
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.
    • Close OTM


    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
    Microsoft MVP Consumer Security 2009 -2010
    If we have helped, please consider a donation
    THESE INSTRUCTIONS ARE FOR THIS USER ONLY
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules