Virtumonde

pippen · Aug 8, 2008

Hi-
You guys hooked me up awhile back (thanks again

) and now I'm here again :sad:. I would appreciate the help once more. S&D detected Virtumonde as a trojan. Thanks in advance.
Here is my highjack this log-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:48:49 PM, on 8/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Lycosa\razerhid.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Gateway\EzTune\DTHtml.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Gateway\EzTune\DTSRVC.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe -H
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Lycosa] "C:\Program Files\Razer\Lycosa\razerhid.exe"
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT Task] C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [e443864e] rundll32.exe "C:\WINDOWS\system32\agqchaku.dll",b
O4 - HKLM\..\Run: [Norton Save and Restore] "C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe"
O4 - HKLM\..\Run: [NSWosCheck] C:\Program Files\Norton SystemWorks Premier\osCheck.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Gateway\EzTune\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

Shaba · Aug 10, 2008

Hi pippen

Rename HijackThis.exe to pippen.exe and post back a fresh HijackThis log, please

pippen · Aug 11, 2008

Hi Shaba-

I think I might have cleaned it up and I see you guys are busy. I'd hate to waste your time, but I would feel a little safer if you could check it out for me. Thanks bro.

Here is my log. (I hope I did it right)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:46:27 PM, on 8/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Gateway\EzTune\DTSRVC.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\pippen\pippen.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {C59B4682-322F-4F9E-B29D-A67184052F73} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Norton Save and Restore] "C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe"
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\X\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: qoMcdEuu - qoMcdEuu.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Gateway\EzTune\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 9547 bytes

Shaba · Aug 11, 2008

At least some leftovers there:

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post.

pippen · Aug 12, 2008

Hey Shaba-

The link you provided for Deckard's System Scanner (DSS) was broken. i did find it here though. -

http://www.geekstogo.com/forum/index.php?autocom=downloads&showfile=19

The problem is, I ran it three times, and it only gives me the maximized window for for main.txt. It won't give me the extra.txt.

Thanks bro.

Here is what I have-

Deckard's System Scanner v20071014.68
Run by X on 2008-08-11 23:59:48
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as X.exe) ---------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:51 PM, on 8/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Gateway\EzTune\DTSRVC.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Steam\Steam.exe
C:\Documents and Settings\X\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\pippen\X.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {C59B4682-322F-4F9E-B29D-A67184052F73} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Norton Save and Restore] "C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe"
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\X\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: qoMcdEuu - qoMcdEuu.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Gateway\EzTune\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 9558 bytes

-- Files created between 2008-07-11 and 2008-08-11 -----------------------------

2008-08-09 22:50:54 0 d-------- C:\Documents and Settings\X\Application Data\WinRAR
2008-08-09 22:43:13 0 d-------- C:\Program Files\Easy GIF Animator
2008-08-08 20:24:46 0 d-------- C:\WINDOWS\WinRAR
2008-08-08 19:49:32 0 d-------- C:\Documents and Settings\X\Application Data\TuneUp Software
2008-08-08 19:49:26 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-08-08 19:49:23 0 d-------- C:\Program Files\TuneUp Utilities 2008
2008-08-08 19:48:56 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-08 19:16:09 0 d-------- C:\Program Files\Ashampoo
2008-08-08 19:05:28 0 d-------- C:\Program Files\Yamicsoft
2008-08-08 19:01:22 0 d-------- C:\Documents and Settings\X\Application Data\Thinstall
2008-08-08 18:48:07 0 d-------- C:\Program Files\Stardock
2008-08-08 05:36:15 0 d-------- C:\Program Files\Apple Software Update
2008-08-08 05:32:11 0 d-------- C:\Program Files\iTunes
2008-08-08 05:29:24 0 d-------- C:\Program Files\Bonjour
2008-08-08 05:28:07 0 d-------- C:\Program Files\Common Files\Apple
2008-08-08 05:28:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-08-07 22:25:00 0 d-------- C:\Program Files\CCleaner
2008-08-07 21:31:55 0 d-------- C:\Program Files\Trend Micro
2008-08-07 20:33:57 215144 --a------ C:\WINDOWS\patchw32.dll
2008-08-07 20:33:20 215144 --a------ C:\WINDOWS\pw32a.dll
2008-08-07 20:22:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-07 20:03:39 0 d-------- C:\WINDOWS\pss
2008-08-07 19:32:34 0 d-------- C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-08-07 19:16:32 0 d-------- C:\Program Files\Steam
2008-08-07 18:59:56 0 d-------- C:\Documents and Settings\X\Application Data\URSoft
2008-08-07 18:59:56 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-07 18:56:41 540923 --ahs---- C:\WINDOWS\system32\vyGiRXbc.ini2
2008-08-07 18:47:44 339968 --a------ C:\WINDOWS\wnlmdakqonf.dll
2008-08-07 18:23:59 0 d-------- C:\Program Files\uTorrent
2008-08-07 18:23:53 0 d-------- C:\Documents and Settings\X\Application Data\uTorrent
2008-08-07 18:08:42 0 d-------- C:\Documents and Settings\X\Application Data\Symantec
2008-08-07 16:09:04 0 d-------- C:\Documents and Settings\X\Application Data\Google
2008-08-07 16:02:16 0 d-------- C:\Program Files\Common Files\Adobe AIR
2008-08-07 15:59:55 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
2008-08-07 15:44:23 0 d-------- C:\Documents and Settings\X\Application Data\DisplayTune
2008-08-07 15:39:54 30208 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-08-07 15:39:54 8096 -----n--- C:\WINDOWS\system32\drivers\MASPINT.SYS <Not Verified; MicroStaff Co.,Ltd.; Aspi32 Driver for WinNT>
2008-08-07 15:39:54 4030 -----n--- C:\WINDOWS\system\WINASPI.DLL
2008-08-07 15:39:54 2486 -----n--- C:\WINDOWS\system\AS16POST.BIN
2008-08-07 15:39:54 0 d-------- C:\MWASPI
2008-08-07 15:38:22 0 d-------- C:\Program Files\PIXELA
2008-08-07 15:37:48 380928 --a------ C:\WINDOWS\system32\FE05F3D7.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:48 401408 --a------ C:\WINDOWS\system32\FE05F3D6.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:48 401408 --a------ C:\WINDOWS\system32\FE05EFED.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:47 106496 --a------ C:\WINDOWS\system32\FPXS2Pro.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FPXS2Pro.dll>
2008-08-07 15:37:47 299008 --a------ C:\WINDOWS\system32\FE05F3D5.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:47 299008 --a------ C:\WINDOWS\system32\FE05F051.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:47 299008 --a------ C:\WINDOWS\system32\FE05DA0D.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:21 274432 --a------ C:\WINDOWS\system32\FFTIFF16.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM TIFF Image Library>
2008-08-07 15:37:21 159744 --a------ C:\WINDOWS\system32\FFRAFLIB.DLL <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:16 0 d-------- C:\Program Files\FinePixViewer
2008-08-07 15:35:15 0 d-------- C:\Documents and Settings\X\Application Data\Macromedia
2008-08-07 15:34:34 45056 --a------ C:\WINDOWS\system32\FINFCOPY.dll <Not Verified; FUJIFILM; FUJIFILM FINFCOPY>
2008-08-07 15:34:34 65536 --a------ C:\WINDOWS\system32\FINFCHECK.dll <Not Verified; FUJIFILM; FUJIFILM FINFCHECK>
2008-08-07 15:34:34 0 d-------- C:\Program Files\REGSHAVE
2008-08-07 15:34:33 69632 --a------ C:\WINDOWS\system32\FREGSHEX.DLL <Not Verified; FUJIFILM; FUJIFILM Fregshave>
2008-08-07 15:34:33 45056 --a------ C:\WINDOWS\system32\FCLKBTN.DLL <Not Verified; FUJIFILM; FUJIFILM FCLKBTN>
2008-08-07 15:31:24 0 d-------- C:\Program Files\Dell J740
2008-08-07 15:28:12 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-08-07 15:28:03 0 d-------- C:\Documents and Settings\X\WINDOWS
2008-08-07 15:12:56 0 d-------- C:\Documents and Settings\X\Application Data\Apple Computer
2008-08-07 15:12:28 0 d-------- C:\Program Files\QuickTime
2008-08-07 15:11:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-07 15:11:20 38229 -----n--- C:\WINDOWS\system32\drivers\StMp3Rec.sys <Not Verified; Generic; Generic MP3 Player>
2008-08-07 15:11:17 0 d-------- C:\Program Files\iPod
2008-08-07 15:07:39 0 d-------- C:\WINDOWS\Downloaded Installations
2008-08-07 15:04:17 0 d-------- C:\Program Files\Microsoft Works
2008-08-07 15:03:41 0 d-------- C:\Program Files\Microsoft.NET
2008-08-07 15:01:41 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2008-08-07 15:01:15 0 d-------- C:\WINDOWS\SHELLNEW
2008-08-07 15:01:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-07 15:00:44 0 dr-h----- C:\MSOCache
2008-08-07 14:59:04 62009 --a------ C:\WINDOWS\system32\WPFB.DLL <Not Verified; Portrait Displays, Inc.; Pivot Sofware>
2008-08-07 14:59:04 2304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-08-07 14:59:04 11323 --a------ C:\WINDOWS\system32\drivers\pivotmou.sys <Not Verified; Portrait Displays, Inc.; Pivot (R) Software (R)>
2008-08-07 14:59:04 17465 --a------ C:\WINDOWS\system32\drivers\pivot.sys <Not Verified; Portrait Displays, Inc.; Windows (R) 2000 DDK driver>
2008-08-07 14:59:04 0 d-------- C:\Program Files\Portrait Displays
2008-08-07 14:58:53 11776 --a------ C:\WINDOWS\system32\drivers\pdiddcci.sys <Not Verified; Portrait Displays, Inc.; Portrait Displays DDC/CI Monitor Device Driver>
2008-08-07 14:58:52 8960 --a------ C:\WINDOWS\system32\drivers\PdiPorts.sys <Not Verified; Portrait Displays, Inc.; PDI Kernel Ports Driver>
2008-08-07 14:58:45 0 d-------- C:\Program Files\Gateway
2008-08-07 14:57:01 0 d-------- C:\Temp
2008-08-07 14:56:08 102912 --a------ C:\WINDOWS\system32\Vb6stkit.dll <Not Verified; Microsoft Corporation; Microsoft(R) Visual Basic for Windows>
2008-08-07 14:56:08 102160 --a------ C:\WINDOWS\system32\VB6KO.DLL <Not Verified; Microsoft Corporation; Visual Basic Environment>
2008-08-07 14:56:08 16384 --a------ C:\WINDOWS\system32\lgfwunis.exe <Not Verified; CST; LG Firmware Autoupdate>
2008-08-07 14:56:08 0 d-------- C:\Program Files\lg_fwupdate
2008-08-07 14:54:52 0 d-------- C:\Documents and Settings\X\Application Data\Adobe
2008-08-07 14:54:48 0 d-------- C:\MyWorks
2008-08-07 14:54:02 0 d-------- C:\Program Files\CyberLink
2008-08-07 14:52:18 0 d-------- C:\Documents and Settings\X\Application Data\ArcSoft
2008-08-07 14:51:14 163840 --a------ C:\WINDOWS\system32\PhotoImpression Screen Saver.scr <Not Verified; ArcSoft Inc.; Saver>
2008-08-07 14:50:52 212480 --a------ C:\WINDOWS\pcdlib32.dll <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit>
2008-08-07 14:50:52 0 d-------- C:\Program Files\ArcSoft
2008-08-07 14:48:23 162900 -----n--- C:\WINDOWS\system32\drivers\USBICP.sys <Not Verified; Motorola; >
2008-08-07 14:48:16 22144 --a------ C:\WINDOWS\system32\drivers\dadder.sys <Not Verified; Razer (Asia-Pacific) Pte Ltd; Razer Habu USB Optical Mouse>
2008-08-07 14:46:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Razer
2008-08-07 14:46:00 0 d-------- C:\Program Files\DIFX
2008-08-07 14:45:55 0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-08-07 14:45:54 0 d-------- C:\Program Files\Razer
2008-08-07 14:44:42 0 d-------- C:\WINDOWS\NV9362684.TMP
2008-08-07 14:44:26 0 d-------- C:\NVIDIA
2008-08-07 14:37:54 0 d-------- C:\WINDOWS\nview
2008-08-07 14:29:38 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-08-07 14:17:15 0 d-------- C:\WINDOWS\system32\Lang
2008-08-07 14:10:59 0 d-------- C:\Program Files\Norton AntiVirus
2008-08-07 14:08:04 0 d-------- C:\Program Files\Norton SystemWorks Premier
2008-08-07 14:06:49 0 d-------- C:\Program Files\Symantec
2008-08-07 14:06:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-07 14:06:14 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-07 14:03:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-08-07 14:02:57 0 d-------- C:\Program Files\Common Files\Adobe
2008-08-07 14:02:13 49152 --a------ C:\WINDOWS\system32\ChCfg.exe
2008-08-07 14:02:01 0 d-------- C:\WINDOWS\system32\RTCOM
2008-08-07 14:01:56 0 d-------- C:\Program Files\Realtek
2008-08-07 14:01:51 520192 --a------ C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
2008-08-07 14:01:51 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-08-07 14:01:48 0 d-------- C:\Program Files\Common Files\InstallShield
2008-08-07 14:00:59 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-08-07 13:59:27 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-08-07 13:58:51 3276 -ra------ C:\WINDOWS\system32\drivers\nvphy.bin
2008-08-07 13:58:08 0 d-------- C:\Documents and Settings\X\Application Data\InstallShield
2008-08-07 13:55:40 0 d-------- C:\Documents and Settings\X\Application Data\Identities
2008-08-07 13:55:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\Templates
2008-08-07 13:55:31 0 d-------- C:\Documents and Settings\X\Start Menu
2008-08-07 13:55:31 0 dr-h----- C:\Documents and Settings\X\SendTo
2008-08-07 13:55:31 0 dr-h----- C:\Documents and Settings\X\Recent
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\PrintHood
2008-08-07 13:55:31 4980736 --ah----- C:\Documents and Settings\X\NTUSER.DAT
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\NetHood
2008-08-07 13:55:31 0 dr------- C:\Documents and Settings\X\My Documents
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\Local Settings
2008-08-07 13:55:31 0 dr------- C:\Documents and Settings\X\Favorites
2008-08-07 13:55:31 0 d-------- C:\Documents and Settings\X\Desktop
2008-08-07 13:55:31 0 d--hs---- C:\Documents and Settings\X\Cookies
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\Application Data
2008-08-07 13:54:41 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-08-07 13:54:41 0 d-------- C:\WINDOWS\Prefetch
2008-08-07 13:53:07 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-08-07 13:53:07 0 d--hs---- C:\Documents and Settings\NetworkService\Cookies
2008-08-07 13:53:07 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-08-07 13:53:07 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-08-07 13:53:06 249856 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-08-07 13:50:48 0 d-------- C:\WINDOWS\system32\xircom
2008-08-07 13:50:48 0 d-------- C:\Program Files\microsoft frontpage
2008-08-07 13:50:43 249856 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-08-07 13:50:26 0 d-------- C:\WINDOWS\system32\PreInstall
2008-08-07 13:50:25 0 d--h----- C:\WINDOWS\$hf_mig$
2008-08-07 13:48:44 0 d-------- C:\Documents and Settings\LocalService\Start Menu
2008-08-07 13:48:43 262144 --a------ C:\Documents and Settings\LocalService\ntuser.dat
2008-08-07 13:48:43 0 d-------- C:\Documents and Settings\LocalService\Local Settings
2008-08-07 13:48:43 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
2008-08-07 13:48:43 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-08-07 13:48:43 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-08-07 13:48:35 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-08-07 13:48:35 0 d-------- C:\Program Files\MSBuild
2008-08-07 13:48:33 0 d-------- C:\Program Files\Reference Assemblies
2008-08-07 13:47:09 0 d-------- C:\WINDOWS\system32\URTTemp
2008-08-07 13:46:57 124928 --a------ C:\WINDOWS\system32\prntvpt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-08-07 13:46:15 0 -rahs---- C:\MSDOS.SYS
2008-08-07 13:46:15 0 -rahs---- C:\IO.SYS
2008-08-07 13:46:15 0 --a------ C:\CONFIG.SYS
2008-08-07 13:46:15 0 --a------ C:\AUTOEXEC.BAT
2008-08-07 13:45:33 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-08-07 13:45:06 0 d-------- C:\WINDOWS\system32\DirectX
2008-08-07 13:44:47 0 d---s---- C:\WINDOWS\Tasks
2008-08-07 13:44:46 0 d-------- C:\Program Files\Common Files\MSSoap
2008-08-07 13:44:43 0 d-------- C:\WINDOWS\srchasst
2008-08-07 13:44:42 0 d-------- C:\WINDOWS\system32\Macromed
2008-08-07 13:44:36 0 d-------- C:\Program Files\Movie Maker
2008-08-07 13:44:17 0 d-------- C:\WINDOWS\system32\Restore
2008-08-07 13:43:43 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-08-07 13:43:30 0 d-------- C:\WINDOWS\Registration
2008-08-07 13:43:25 0 d-------- C:\Program Files\Online Services
2008-08-07 13:43:01 0 d-------- C:\Program Files\LClock
2008-08-07 13:42:55 0 d-------- C:\Program Files\Windows Media Connect 2
2008-08-07 13:42:54 413696 --a------ C:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32>
2008-08-07 13:42:54 722192 --a------ C:\WINDOWS\system32\vb40032.dll <Not Verified; Microsoft Corporation; Visual Basic 4.0>
2008-08-07 13:42:54 398416 --a------ C:\WINDOWS\system\vbrun300.dll <Not Verified; Microsoft Corporation; Visual Basic 3.0>
2008-08-07 13:42:54 356992 --a------ C:\WINDOWS\system\vbrun200.dll <Not Verified; Microsoft Corporation; Visual Basic 2.0>
2008-08-07 13:42:54 271264 --a------ C:\WINDOWS\system\vbrun100.dll
2008-08-07 13:42:54 935632 --a------ C:\WINDOWS\system\vb40016.dll <Not Verified; Microsoft Corporation; Visual Basic 4.0>
2008-08-07 13:42:53 32768 --a------ C:\WINDOWS\system\PLUGIN.DLL <Not Verified; Adobe Systems, Inc.; Adobe Photoshop>
2008-08-07 13:42:53 210944 --a------ C:\WINDOWS\system\MSVCRT10.DLL
2008-08-07 13:42:52 94208 --a------ C:\WINDOWS\system32\msstkprp.dll <Not Verified; Microsoft Corporation; msprop32>
2008-08-07 13:42:52 119808 --a------ C:\WINDOWS\system32\msstdfmt.dll <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-08-07 13:42:50 2887680 --a------ C:\WINDOWS\system32\libmmd.dll <Not Verified; Intel Corporation; Intel(r) C Compiler, Intel(r) C++ Compiler, Intel(r) Fortran Compiler>
2008-08-07 13:42:49 59904 --a------ C:\WINDOWS\system32\zlib1.dll <Not Verified; ; zlib>
2008-08-07 13:42:49 101888 --a------ C:\WINDOWS\system32\libintl3.dll <Not Verified; GNU <www.gnu.org>; GetText>
2008-08-07 13:42:49 898048 --a------ C:\WINDOWS\system32\libiconv2.dll <Not Verified; GNU <www.gnu.org>; LibIconv>
2008-08-07 13:42:49 394752 --a------ C:\WINDOWS\system32\cygwinb19.dll
2008-08-07 13:42:48 1872666 --a------ C:\WINDOWS\system32\cygwin1.dll <Not Verified; Red Hat; Cygwin>
2008-08-07 13:42:44 0 d-------- C:\WINDOWS\Offline Web Pages
2008-08-07 13:42:44 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-08-07 13:42:39 0 d-------- C:\Program Files\HashTab Shell Extension
2008-08-07 13:42:38 0 d-------- C:\Program Files\Microsoft PowerToys
2008-08-07 13:42:37 0 d-------- C:\Program Files\Messenger
2008-08-07 13:42:33 0 d-------- C:\Program Files\MSN Gaming Zone
2008-08-07 13:42:19 946448 --a------ C:\WINDOWS\system32\calc.exe <Not Verified; Microsoft Corporation; Microsoft® Calculator Plus>
2008-08-07 13:42:01 0 d-------- C:\Program Files\Windows NT
2008-08-07 13:41:57 0 d-------- C:\WINDOWS\system32\MsDtc
2008-08-07 13:41:55 0 d-------- C:\WINDOWS\system32\Com
2008-08-07 06:38:41 0 d--hs---- C:\WINDOWS\Installer
2008-08-07 06:38:41 0 d-------- C:\Program Files\Common Files\ODBC
2008-08-07 06:38:38 0 d-------- C:\Program Files
2008-08-07 06:38:38 0 d-------- C:\Program Files\Common Files
2008-08-07 06:38:38 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-08-07 06:38:16 0 dr------- C:\Documents and Settings\Default User\Start Menu
2008-08-07 06:38:16 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-08-07 06:38:16 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-08-07 06:38:16 0 d--hs---- C:\Documents and Settings\Default User\Cookies
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-08-07 06:38:16 0 dr------- C:\Documents and Settings\All Users\Documents
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-08-07 06:38:05 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-08-07 06:38:05 0 d-------- C:\WINDOWS\system32\CatRoot
2008-08-07 06:38:00 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-08-07 06:38:00 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-08-07 06:38:00 0 d--h----- C:\Documents and Settings\All Users\Application Data
2008-08-07 06:38:00 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-08-07 06:37:35 0 d--hs---- C:\System Volume Information
2008-08-07 06:37:35 0 d-------- C:\Documents and Settings
2008-08-07 06:34:12 0 d-------- C:\WINDOWS
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\WinSxS
2008-08-07 06:34:12 0 dr------- C:\WINDOWS\Web
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\twain_32
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\wins
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\wbem
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\usmt
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\spool
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\ShellExt
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\Setup
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\scripting
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\ras
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\oobe
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\npp
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\mui
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\inetsrv
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\IME
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\icsxml
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\ias
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\export
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\en
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-08-07 06:34:12 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\dhcp
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\config
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\3076
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\2052
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1054
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1042
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1041
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1037
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1033
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1031
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1028
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1025
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\security
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Resources
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\repair
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Provisioning
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\PeerNet
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\pchealth
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Network Diagnostic
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\mui
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\msapps
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\msagent
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Media
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\L2Schemas
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\java
2008-08-07 06:34:12 0 d--h----- C:\WINDOWS\inf
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\ime
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Help
2008-08-07 06:34:12 0 dr--s---- C:\WINDOWS\Fonts
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\ehome
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Driver Cache
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Debug
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Cursors
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Connection Wizard
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Config
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\AppPatch
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\addins

-- Find3M Report ---------------------------------------------------------------

2008-08-07 06:38:16 62 --ahs---- C:\Documents and Settings\X\Application Data\desktop.ini
2008-06-26 04:18:32 218624 --a------ C:\WINDOWS\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-06-25 21:18:37 1614848 --a------ C:\WINDOWS\system32\sfcfiles.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-06-25 21:16:15 271872 --a------ C:\WINDOWS\upx.exe <Not Verified; The UPX Team http://upx.sf.net; UPX>
2008-06-25 21:16:14 8636 --a------ C:\WINDOWS\modifyPE.exe
2008-06-25 21:16:12 394240 --a------ C:\WINDOWS\system32\HMTCD.dll <Not Verified; ; HighMAT CD Writing Wizard>
2008-06-25 21:16:12 61440 --a------ C:\WINDOWS\system32\CopyToSendTo.dll
2008-06-25 21:16:12 114688 --a------ C:\WINDOWS\system32\cabarc.exe
2008-05-16 14:01:00 1630208 --a------ C:\WINDOWS\system32\nwiz.exe
2008-05-16 14:01:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-05-16 14:01:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-05-16 14:01:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-05-16 14:01:00 1486848 --a------ C:\WINDOWS\system32\nview.dll
2008-05-16 14:01:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-05-16 14:01:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-05-16 14:01:00 425984 --a------ C:\WINDOWS\system32\keystone.exe

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C59B4682-322F-4F9E-B29D-A67184052F73}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10/27/2006 11:38 PM]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [09/05/2006 07:22 PM]
"NSRKey"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [03/26/2007 03:45 PM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/16/2008 02:01 PM]
"nwiz"="nwiz.exe" [05/16/2008 02:01 PM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/16/2008 02:01 PM]
"RTHDCPL"="RTHDCPL.EXE" [10/16/2007 06:30 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 06:43 PM C:\WINDOWS\Alcmtr.exe]
"Norton Save and Restore"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [03/26/2007 03:45 PM]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [12/22/2006 02:38 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/07/2008 09:42 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 05:42 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"wextract_cleanup0"=rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\X\LOCALS~1\Temp\IXP000.TMP\"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
"ShowDeskFix"=regsvr32 /s /n /i:u shell32

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Norton System Doctor.lnk - C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE [11/3/2005 8:09:04 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMcdEuu]
qoMcdEuu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 08/08/2008 06:49 PM 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeathAdder]
C:\Program Files\Razer\DeathAdder\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT Task]
C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e443864e]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock]
C:\Program Files\LClock\LClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
"C:\Program Files\lg_fwupdate\fwupdate.exe" blrun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lycosa]
"C:\Program Files\Razer\Lycosa\razerhid.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSWosCheck]
C:\Program Files\Norton SystemWorks Premier\osCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
"C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe -H

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVeACrsion\Svchost - NetSvcs
UxTuneUp
napagent
hkmsvc

*Newly Created Service* - ERASERUTILDRV10820

-- End of Deckard's System Scanner: finished at 2008-08-12 00:00:21 ------------

Shaba · Aug 12, 2008

Yes, original link seems to be down.

As no extra.txt, let's do this instead.

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:

5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

pippen · Aug 12, 2008

Here ya go Shaba -

Adobe AIR
Adobe AIR
Adobe Flash Player ActiveX
Adobe Reader 8.1.0
AppCore
Apple Mobile Device Support
Apple Software Update
ArcSoft Camera Suite
Ashampoo Magical Defrag 2
AV
Bonjour
ccCommon
CCleaner (remove only)
Component Framework
Connection Keep Alive
Day of Defeat: Source
DeathAdder(TM) Mouse
Dell Inkjet Printer J740
DVD Suite
Easy GIF Animator 4.6 Pro
EzTune
FinePixViewer Ver.4.2
FUJIFILM USB Driver
HijackThis 2.0.2
ImageMixer VCD2 for FinePix
Internet Worm Protection
iPod for Windows 2006-03-23
iTunes
LClock
LG ODD Auto Firmware Update
LiveUpdate 3.1 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
MicroStaff WINASPI
MSRedist
Norton AntiVirus
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Cleanup
Norton Protection Center
Norton Save and Restore
Norton SystemWorks
Norton SystemWorks (Symantec Corporation)
Norton SystemWorks Premier
Norton Utilities
NVIDIA Drivers
Pivot Software
PowerDVD
PowerProducer
QuickTime
RAW FILE CONVERTER LE
Razer Lycosa
Realtek High Definition Audio Driver
SPBBC 32bit
Spybot - Search & Destroy
Steam
Symantec
SymNet
TuneUp Utilities 2008
Windows Driver Package - Razer (HidUsb) HIDClass (01/11/2007 1.0)
WinRAR
WinXP Manager

Shaba · Aug 12, 2008

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

uTorrent

I'd like you to read the this thread.

Delete these folders:

C:\Program Files\uTorrent
C:\Documents and Settings\X\Application Data\uTorrent

Empty Recycle Bin

Please run a new DSS scan when finished and post the log back here.

pippen · Aug 12, 2008

Shaba said:
IMPORTANT
Delete these folders:

C:\Program Files\uTorrent
C:\Documents and Settings\X\Application Data\uTorrent

That hurt Shaba :sad: but you're right & I understand.

Here are the new logs -

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C59B4682-322F-4F9E-B29D-A67184052F73}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10/27/2006 11:38 PM]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [09/05/2006 07:22 PM]
"NSRKey"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [03/26/2007 03:45 PM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/16/2008 02:01 PM]
"nwiz"="nwiz.exe" [05/16/2008 02:01 PM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/16/2008 02:01 PM]
"RTHDCPL"="RTHDCPL.EXE" [10/16/2007 06:30 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 06:43 PM C:\WINDOWS\Alcmtr.exe]
"Norton Save and Restore"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [03/26/2007 03:45 PM]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [12/22/2006 02:38 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/07/2008 09:42 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 05:42 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"wextract_cleanup0"=rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\X\LOCALS~1\Temp\IXP000.TMP\"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
"ShowDeskFix"=regsvr32 /s /n /i:u shell32

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Norton System Doctor.lnk - C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE [11/3/2005 8:09:04 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMcdEuu]
qoMcdEuu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 08/08/2008 06:49 PM 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeathAdder]
C:\Program Files\Razer\DeathAdder\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT Task]
C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e443864e]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock]
C:\Program Files\LClock\LClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
"C:\Program Files\lg_fwupdate\fwupdate.exe" blrun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lycosa]
"C:\Program Files\Razer\Lycosa\razerhid.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSWosCheck]
C:\Program Files\Norton SystemWorks Premier\osCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
"C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe -H

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
napagent
hkmsvc

-- End of Deckard's System Scanner: finished at 2008-08-12 02:01:02 ------------

Adobe AIR
Adobe AIR
Adobe Flash Player ActiveX
Adobe Reader 8.1.0
AppCore
Apple Mobile Device Support
Apple Software Update
ArcSoft Camera Suite
Ashampoo Magical Defrag 2
AV
Bonjour
ccCommon
CCleaner (remove only)
Component Framework
Connection Keep Alive
Day of Defeat: Source
DeathAdder(TM) Mouse
Dell Inkjet Printer J740
DVD Suite
Easy GIF Animator 4.6 Pro
EzTune
FinePixViewer Ver.4.2
FUJIFILM USB Driver
HijackThis 2.0.2
ImageMixer VCD2 for FinePix
Internet Worm Protection
iPod for Windows 2006-03-23
iTunes
LClock
LG ODD Auto Firmware Update
LiveUpdate 3.1 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
MicroStaff WINASPI
MSRedist
Norton AntiVirus
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Cleanup
Norton Protection Center
Norton Save and Restore
Norton SystemWorks
Norton SystemWorks (Symantec Corporation)
Norton SystemWorks Premier
Norton Utilities
NVIDIA Drivers
Pivot Software
PowerDVD
PowerProducer
QuickTime
RAW FILE CONVERTER LE
Razer Lycosa
Realtek High Definition Audio Driver
SPBBC 32bit
Spybot - Search & Destroy
Steam
Symantec
SymNet
TuneUp Utilities 2008
Windows Driver Package - Razer (HidUsb) HIDClass (01/11/2007 1.0)
WinRAR
WinXP Manager

Shaba · Aug 12, 2008

DSS log is incomplete.

Please re-send it

pippen · Aug 12, 2008

Shaba said:
DSS log is incomplete.

Please re-send it

Sorry, my bad Shaba......

Deckard's System Scanner v20071014.68
Run by X on 2008-08-12 09:35:24
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as X.exe) ---------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:35:30 AM, on 8/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Gateway\EzTune\DTSRVC.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\X\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\pippen\X.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {C59B4682-322F-4F9E-B29D-A67184052F73} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Norton Save and Restore] "C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe"
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\X\LOCALS~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: qoMcdEuu - qoMcdEuu.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Gateway\EzTune\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 9579 bytes

-- Files created between 2008-07-12 and 2008-08-12 -----------------------------

2008-08-09 22:50:54 0 d-------- C:\Documents and Settings\X\Application Data\WinRAR
2008-08-09 22:43:13 0 d-------- C:\Program Files\Easy GIF Animator
2008-08-08 20:24:46 0 d-------- C:\WINDOWS\WinRAR
2008-08-08 19:49:32 0 d-------- C:\Documents and Settings\X\Application Data\TuneUp Software
2008-08-08 19:49:26 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-08-08 19:49:23 0 d-------- C:\Program Files\TuneUp Utilities 2008
2008-08-08 19:48:56 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-08 19:16:09 0 d-------- C:\Program Files\Ashampoo
2008-08-08 19:05:28 0 d-------- C:\Program Files\Yamicsoft
2008-08-08 19:01:22 0 d-------- C:\Documents and Settings\X\Application Data\Thinstall
2008-08-08 18:48:07 0 d-------- C:\Program Files\Stardock
2008-08-08 05:36:15 0 d-------- C:\Program Files\Apple Software Update
2008-08-08 05:32:11 0 d-------- C:\Program Files\iTunes
2008-08-08 05:29:24 0 d-------- C:\Program Files\Bonjour
2008-08-08 05:28:07 0 d-------- C:\Program Files\Common Files\Apple
2008-08-08 05:28:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-08-07 22:25:00 0 d-------- C:\Program Files\CCleaner
2008-08-07 21:31:55 0 d-------- C:\Program Files\Trend Micro
2008-08-07 20:33:57 215144 --a------ C:\WINDOWS\patchw32.dll
2008-08-07 20:33:20 215144 --a------ C:\WINDOWS\pw32a.dll
2008-08-07 20:22:25 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-07 20:03:39 0 d-------- C:\WINDOWS\pss
2008-08-07 19:32:34 0 d-------- C:\Documents and Settings\All Users\Application Data\Ashampoo
2008-08-07 19:16:32 0 d-------- C:\Program Files\Steam
2008-08-07 18:59:56 0 d-------- C:\Documents and Settings\X\Application Data\URSoft
2008-08-07 18:59:56 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-07 18:56:41 540923 --ahs---- C:\WINDOWS\system32\vyGiRXbc.ini2
2008-08-07 18:47:44 339968 --a------ C:\WINDOWS\wnlmdakqonf.dll
2008-08-07 18:23:59 0 d-------- C:\Program Files\uTorrent
2008-08-07 18:23:53 0 d-------- C:\Documents and Settings\X\Application Data\uTorrent
2008-08-07 18:08:42 0 d-------- C:\Documents and Settings\X\Application Data\Symantec
2008-08-07 16:09:04 0 d-------- C:\Documents and Settings\X\Application Data\Google
2008-08-07 16:02:16 0 d-------- C:\Program Files\Common Files\Adobe AIR
2008-08-07 15:59:55 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
2008-08-07 15:44:23 0 d-------- C:\Documents and Settings\X\Application Data\DisplayTune
2008-08-07 15:39:54 30208 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-08-07 15:39:54 8096 -----n--- C:\WINDOWS\system32\drivers\MASPINT.SYS <Not Verified; MicroStaff Co.,Ltd.; Aspi32 Driver for WinNT>
2008-08-07 15:39:54 4030 -----n--- C:\WINDOWS\system\WINASPI.DLL
2008-08-07 15:39:54 2486 -----n--- C:\WINDOWS\system\AS16POST.BIN
2008-08-07 15:39:54 0 d-------- C:\MWASPI
2008-08-07 15:38:22 0 d-------- C:\Program Files\PIXELA
2008-08-07 15:37:48 380928 --a------ C:\WINDOWS\system32\FE05F3D7.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:48 401408 --a------ C:\WINDOWS\system32\FE05F3D6.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:48 401408 --a------ C:\WINDOWS\system32\FE05EFED.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:47 106496 --a------ C:\WINDOWS\system32\FPXS2Pro.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FPXS2Pro.dll>
2008-08-07 15:37:47 299008 --a------ C:\WINDOWS\system32\FE05F3D5.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:47 299008 --a------ C:\WINDOWS\system32\FE05F051.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:47 299008 --a------ C:\WINDOWS\system32\FE05DA0D.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:21 274432 --a------ C:\WINDOWS\system32\FFTIFF16.dll <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM TIFF Image Library>
2008-08-07 15:37:21 159744 --a------ C:\WINDOWS\system32\FFRAFLIB.DLL <Not Verified; FUJI PHOTO FILM CO., LTD.; FUJIFILM CCD-RAW LIBRARY>
2008-08-07 15:37:16 0 d-------- C:\Program Files\FinePixViewer
2008-08-07 15:35:15 0 d-------- C:\Documents and Settings\X\Application Data\Macromedia
2008-08-07 15:34:34 45056 --a------ C:\WINDOWS\system32\FINFCOPY.dll <Not Verified; FUJIFILM; FUJIFILM FINFCOPY>
2008-08-07 15:34:34 65536 --a------ C:\WINDOWS\system32\FINFCHECK.dll <Not Verified; FUJIFILM; FUJIFILM FINFCHECK>
2008-08-07 15:34:34 0 d-------- C:\Program Files\REGSHAVE
2008-08-07 15:34:33 69632 --a------ C:\WINDOWS\system32\FREGSHEX.DLL <Not Verified; FUJIFILM; FUJIFILM Fregshave>
2008-08-07 15:34:33 45056 --a------ C:\WINDOWS\system32\FCLKBTN.DLL <Not Verified; FUJIFILM; FUJIFILM FCLKBTN>
2008-08-07 15:31:24 0 d-------- C:\Program Files\Dell J740
2008-08-07 15:28:12 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-08-07 15:28:03 0 d-------- C:\Documents and Settings\X\WINDOWS
2008-08-07 15:12:56 0 d-------- C:\Documents and Settings\X\Application Data\Apple Computer
2008-08-07 15:12:28 0 d-------- C:\Program Files\QuickTime
2008-08-07 15:11:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-07 15:11:20 38229 -----n--- C:\WINDOWS\system32\drivers\StMp3Rec.sys <Not Verified; Generic; Generic MP3 Player>
2008-08-07 15:11:17 0 d-------- C:\Program Files\iPod
2008-08-07 15:07:39 0 d-------- C:\WINDOWS\Downloaded Installations
2008-08-07 15:04:17 0 d-------- C:\Program Files\Microsoft Works
2008-08-07 15:03:41 0 d-------- C:\Program Files\Microsoft.NET
2008-08-07 15:01:41 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2008-08-07 15:01:15 0 d-------- C:\WINDOWS\SHELLNEW
2008-08-07 15:01:02 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-07 15:00:44 0 dr-h----- C:\MSOCache
2008-08-07 14:59:04 62009 --a------ C:\WINDOWS\system32\WPFB.DLL <Not Verified; Portrait Displays, Inc.; Pivot Sofware>
2008-08-07 14:59:04 2304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-08-07 14:59:04 11323 --a------ C:\WINDOWS\system32\drivers\pivotmou.sys <Not Verified; Portrait Displays, Inc.; Pivot (R) Software (R)>
2008-08-07 14:59:04 17465 --a------ C:\WINDOWS\system32\drivers\pivot.sys <Not Verified; Portrait Displays, Inc.; Windows (R) 2000 DDK driver>
2008-08-07 14:59:04 0 d-------- C:\Program Files\Portrait Displays
2008-08-07 14:58:53 11776 --a------ C:\WINDOWS\system32\drivers\pdiddcci.sys <Not Verified; Portrait Displays, Inc.; Portrait Displays DDC/CI Monitor Device Driver>
2008-08-07 14:58:52 8960 --a------ C:\WINDOWS\system32\drivers\PdiPorts.sys <Not Verified; Portrait Displays, Inc.; PDI Kernel Ports Driver>
2008-08-07 14:58:45 0 d-------- C:\Program Files\Gateway
2008-08-07 14:57:01 0 d-------- C:\Temp
2008-08-07 14:56:08 102912 --a------ C:\WINDOWS\system32\Vb6stkit.dll <Not Verified; Microsoft Corporation; Microsoft(R) Visual Basic for Windows>
2008-08-07 14:56:08 102160 --a------ C:\WINDOWS\system32\VB6KO.DLL <Not Verified; Microsoft Corporation; Visual Basic Environment>
2008-08-07 14:56:08 16384 --a------ C:\WINDOWS\system32\lgfwunis.exe <Not Verified; CST; LG Firmware Autoupdate>
2008-08-07 14:56:08 0 d-------- C:\Program Files\lg_fwupdate
2008-08-07 14:54:52 0 d-------- C:\Documents and Settings\X\Application Data\Adobe
2008-08-07 14:54:48 0 d-------- C:\MyWorks
2008-08-07 14:54:02 0 d-------- C:\Program Files\CyberLink
2008-08-07 14:52:18 0 d-------- C:\Documents and Settings\X\Application Data\ArcSoft
2008-08-07 14:51:14 163840 --a------ C:\WINDOWS\system32\PhotoImpression Screen Saver.scr <Not Verified; ArcSoft Inc.; Saver>
2008-08-07 14:50:52 212480 --a------ C:\WINDOWS\pcdlib32.dll <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit>
2008-08-07 14:50:52 0 d-------- C:\Program Files\ArcSoft
2008-08-07 14:48:23 162900 -----n--- C:\WINDOWS\system32\drivers\USBICP.sys <Not Verified; Motorola; >
2008-08-07 14:48:16 22144 --a------ C:\WINDOWS\system32\drivers\dadder.sys <Not Verified; Razer (Asia-Pacific) Pte Ltd; Razer Habu USB Optical Mouse>
2008-08-07 14:46:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Razer
2008-08-07 14:46:00 0 d-------- C:\Program Files\DIFX
2008-08-07 14:45:55 0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-08-07 14:45:54 0 d-------- C:\Program Files\Razer
2008-08-07 14:44:42 0 d-------- C:\WINDOWS\NV9362684.TMP
2008-08-07 14:44:26 0 d-------- C:\NVIDIA
2008-08-07 14:37:54 0 d-------- C:\WINDOWS\nview
2008-08-07 14:29:38 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2008-08-07 14:17:15 0 d-------- C:\WINDOWS\system32\Lang
2008-08-07 14:10:59 0 d-------- C:\Program Files\Norton AntiVirus
2008-08-07 14:08:04 0 d-------- C:\Program Files\Norton SystemWorks Premier
2008-08-07 14:06:49 0 d-------- C:\Program Files\Symantec
2008-08-07 14:06:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-07 14:06:14 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-07 14:03:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-08-07 14:02:57 0 d-------- C:\Program Files\Common Files\Adobe
2008-08-07 14:02:13 49152 --a------ C:\WINDOWS\system32\ChCfg.exe
2008-08-07 14:02:01 0 d-------- C:\WINDOWS\system32\RTCOM
2008-08-07 14:01:56 0 d-------- C:\Program Files\Realtek
2008-08-07 14:01:51 520192 --a------ C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
2008-08-07 14:01:51 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-08-07 14:01:48 0 d-------- C:\Program Files\Common Files\InstallShield
2008-08-07 14:00:59 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-08-07 13:59:27 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2008-08-07 13:58:51 3276 -ra------ C:\WINDOWS\system32\drivers\nvphy.bin
2008-08-07 13:58:08 0 d-------- C:\Documents and Settings\X\Application Data\InstallShield
2008-08-07 13:55:40 0 d-------- C:\Documents and Settings\X\Application Data\Identities
2008-08-07 13:55:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\Templates
2008-08-07 13:55:31 0 d-------- C:\Documents and Settings\X\Start Menu
2008-08-07 13:55:31 0 dr-h----- C:\Documents and Settings\X\SendTo
2008-08-07 13:55:31 0 dr-h----- C:\Documents and Settings\X\Recent
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\PrintHood
2008-08-07 13:55:31 4980736 --ah----- C:\Documents and Settings\X\NTUSER.DAT
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\NetHood
2008-08-07 13:55:31 0 dr------- C:\Documents and Settings\X\My Documents
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\Local Settings
2008-08-07 13:55:31 0 dr------- C:\Documents and Settings\X\Favorites
2008-08-07 13:55:31 0 d-------- C:\Documents and Settings\X\Desktop
2008-08-07 13:55:31 0 d--hs---- C:\Documents and Settings\X\Cookies
2008-08-07 13:55:31 0 d--h----- C:\Documents and Settings\X\Application Data
2008-08-07 13:54:41 0 d---s---- C:\WINDOWS\system32\Microsoft
2008-08-07 13:54:41 0 d-------- C:\WINDOWS\Prefetch
2008-08-07 13:53:07 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2008-08-07 13:53:07 0 d--hs---- C:\Documents and Settings\NetworkService\Cookies
2008-08-07 13:53:07 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2008-08-07 13:53:07 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2008-08-07 13:53:06 249856 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2008-08-07 13:50:48 0 d-------- C:\WINDOWS\system32\xircom
2008-08-07 13:50:48 0 d-------- C:\Program Files\microsoft frontpage
2008-08-07 13:50:43 249856 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2008-08-07 13:50:26 0 d-------- C:\WINDOWS\system32\PreInstall
2008-08-07 13:50:25 0 d--h----- C:\WINDOWS\$hf_mig$
2008-08-07 13:48:44 0 d-------- C:\Documents and Settings\LocalService\Start Menu
2008-08-07 13:48:43 262144 --a------ C:\Documents and Settings\LocalService\ntuser.dat
2008-08-07 13:48:43 0 d-------- C:\Documents and Settings\LocalService\Local Settings
2008-08-07 13:48:43 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
2008-08-07 13:48:43 0 d-------- C:\Documents and Settings\LocalService\Application Data
2008-08-07 13:48:43 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2008-08-07 13:48:35 0 d-------- C:\WINDOWS\system32\XPSViewer
2008-08-07 13:48:35 0 d-------- C:\Program Files\MSBuild
2008-08-07 13:48:33 0 d-------- C:\Program Files\Reference Assemblies
2008-08-07 13:47:09 0 d-------- C:\WINDOWS\system32\URTTemp
2008-08-07 13:46:57 124928 --a------ C:\WINDOWS\system32\prntvpt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-08-07 13:46:15 0 -rahs---- C:\MSDOS.SYS
2008-08-07 13:46:15 0 -rahs---- C:\IO.SYS
2008-08-07 13:46:15 0 --a------ C:\CONFIG.SYS
2008-08-07 13:46:15 0 --a------ C:\AUTOEXEC.BAT
2008-08-07 13:45:33 0 d--hs---- C:\Documents and Settings\All Users\DRM
2008-08-07 13:45:06 0 d-------- C:\WINDOWS\system32\DirectX
2008-08-07 13:44:47 0 d---s---- C:\WINDOWS\Tasks
2008-08-07 13:44:46 0 d-------- C:\Program Files\Common Files\MSSoap
2008-08-07 13:44:43 0 d-------- C:\WINDOWS\srchasst
2008-08-07 13:44:42 0 d-------- C:\WINDOWS\system32\Macromed
2008-08-07 13:44:36 0 d-------- C:\Program Files\Movie Maker
2008-08-07 13:44:17 0 d-------- C:\WINDOWS\system32\Restore
2008-08-07 13:43:43 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2008-08-07 13:43:30 0 d-------- C:\WINDOWS\Registration
2008-08-07 13:43:25 0 d-------- C:\Program Files\Online Services
2008-08-07 13:43:01 0 d-------- C:\Program Files\LClock
2008-08-07 13:42:55 0 d-------- C:\Program Files\Windows Media Connect 2
2008-08-07 13:42:54 413696 --a------ C:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32>
2008-08-07 13:42:54 722192 --a------ C:\WINDOWS\system32\vb40032.dll <Not Verified; Microsoft Corporation; Visual Basic 4.0>
2008-08-07 13:42:54 398416 --a------ C:\WINDOWS\system\vbrun300.dll <Not Verified; Microsoft Corporation; Visual Basic 3.0>
2008-08-07 13:42:54 356992 --a------ C:\WINDOWS\system\vbrun200.dll <Not Verified; Microsoft Corporation; Visual Basic 2.0>
2008-08-07 13:42:54 271264 --a------ C:\WINDOWS\system\vbrun100.dll
2008-08-07 13:42:54 935632 --a------ C:\WINDOWS\system\vb40016.dll <Not Verified; Microsoft Corporation; Visual Basic 4.0>
2008-08-07 13:42:53 32768 --a------ C:\WINDOWS\system\PLUGIN.DLL <Not Verified; Adobe Systems, Inc.; Adobe Photoshop>
2008-08-07 13:42:53 210944 --a------ C:\WINDOWS\system\MSVCRT10.DLL
2008-08-07 13:42:52 94208 --a------ C:\WINDOWS\system32\msstkprp.dll <Not Verified; Microsoft Corporation; msprop32>
2008-08-07 13:42:52 119808 --a------ C:\WINDOWS\system32\msstdfmt.dll <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-08-07 13:42:50 2887680 --a------ C:\WINDOWS\system32\libmmd.dll <Not Verified; Intel Corporation; Intel(r) C Compiler, Intel(r) C++ Compiler, Intel(r) Fortran Compiler>
2008-08-07 13:42:49 59904 --a------ C:\WINDOWS\system32\zlib1.dll <Not Verified; ; zlib>
2008-08-07 13:42:49 101888 --a------ C:\WINDOWS\system32\libintl3.dll <Not Verified; GNU <www.gnu.org>; GetText>
2008-08-07 13:42:49 898048 --a------ C:\WINDOWS\system32\libiconv2.dll <Not Verified; GNU <www.gnu.org>; LibIconv>
2008-08-07 13:42:49 394752 --a------ C:\WINDOWS\system32\cygwinb19.dll
2008-08-07 13:42:48 1872666 --a------ C:\WINDOWS\system32\cygwin1.dll <Not Verified; Red Hat; Cygwin>
2008-08-07 13:42:44 0 d-------- C:\WINDOWS\Offline Web Pages
2008-08-07 13:42:44 0 d---s---- C:\WINDOWS\Downloaded Program Files
2008-08-07 13:42:39 0 d-------- C:\Program Files\HashTab Shell Extension
2008-08-07 13:42:38 0 d-------- C:\Program Files\Microsoft PowerToys
2008-08-07 13:42:37 0 d-------- C:\Program Files\Messenger
2008-08-07 13:42:33 0 d-------- C:\Program Files\MSN Gaming Zone
2008-08-07 13:42:19 946448 --a------ C:\WINDOWS\system32\calc.exe <Not Verified; Microsoft Corporation; Microsoft® Calculator Plus>
2008-08-07 13:42:01 0 d-------- C:\Program Files\Windows NT
2008-08-07 13:41:57 0 d-------- C:\WINDOWS\system32\MsDtc
2008-08-07 13:41:55 0 d-------- C:\WINDOWS\system32\Com
2008-08-07 06:38:41 0 d--hs---- C:\WINDOWS\Installer
2008-08-07 06:38:41 0 d-------- C:\Program Files\Common Files\ODBC
2008-08-07 06:38:38 0 d-------- C:\Program Files
2008-08-07 06:38:38 0 d-------- C:\Program Files\Common Files
2008-08-07 06:38:38 0 d-------- C:\Program Files\Common Files\SpeechEngines
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\Templates
2008-08-07 06:38:16 0 dr------- C:\Documents and Settings\Default User\Start Menu
2008-08-07 06:38:16 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\Recent
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\PrintHood
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\Default User\NetHood
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\Default User\My Documents
2008-08-07 06:38:16 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\Default User\Favorites
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\Default User\Desktop
2008-08-07 06:38:16 0 d--hs---- C:\Documents and Settings\Default User\Cookies
2008-08-07 06:38:16 0 d--h----- C:\Documents and Settings\All Users\Templates
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\All Users\Start Menu
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\All Users\Favorites
2008-08-07 06:38:16 0 dr------- C:\Documents and Settings\All Users\Documents
2008-08-07 06:38:16 0 d-------- C:\Documents and Settings\All Users\Desktop
2008-08-07 06:38:05 0 d-------- C:\WINDOWS\system32\CatRoot2
2008-08-07 06:38:05 0 d-------- C:\WINDOWS\system32\CatRoot
2008-08-07 06:38:00 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2008-08-07 06:38:00 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2008-08-07 06:38:00 0 d--h----- C:\Documents and Settings\All Users\Application Data
2008-08-07 06:38:00 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-08-07 06:37:35 0 d--hs---- C:\System Volume Information
2008-08-07 06:37:35 0 d-------- C:\Documents and Settings
2008-08-07 06:34:12 0 d-------- C:\WINDOWS
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\WinSxS
2008-08-07 06:34:12 0 dr------- C:\WINDOWS\Web
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\twain_32
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\wins
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\wbem
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\usmt
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\spool
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\ShellExt
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\Setup
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\scripting
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\ras
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\oobe
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\npp
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\mui
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\inetsrv
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\IME
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\icsxml
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\ias
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\export
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\en
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers\etc
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\drivers\disdn
2008-08-07 06:34:12 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\dhcp
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\config
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\3com_dmi
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\3076
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\2052
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1054
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1042
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1041
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1037
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1033
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1031
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1028
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system32\1025
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\system
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\SoftwareDistribution
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\security
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Resources
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\repair
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Provisioning
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\PeerNet
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\pchealth
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Network Diagnostic
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\mui
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\msapps
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\msagent
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Media
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\L2Schemas
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\java
2008-08-07 06:34:12 0 d--h----- C:\WINDOWS\inf
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\ime
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Help
2008-08-07 06:34:12 0 dr--s---- C:\WINDOWS\Fonts
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\ehome
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Driver Cache
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Debug
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Cursors
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Connection Wizard
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\Config
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\AppPatch
2008-08-07 06:34:12 0 d-------- C:\WINDOWS\addins

-- Find3M Report ---------------------------------------------------------------

2008-08-07 06:38:16 62 --ahs---- C:\Documents and Settings\X\Application Data\desktop.ini
2008-06-26 04:18:32 218624 --a------ C:\WINDOWS\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-06-25 21:18:37 1614848 --a------ C:\WINDOWS\system32\sfcfiles.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2008-06-25 21:16:15 271872 --a------ C:\WINDOWS\upx.exe <Not Verified; The UPX Team http://upx.sf.net; UPX>
2008-06-25 21:16:14 8636 --a------ C:\WINDOWS\modifyPE.exe
2008-06-25 21:16:12 394240 --a------ C:\WINDOWS\system32\HMTCD.dll <Not Verified; ; HighMAT CD Writing Wizard>
2008-06-25 21:16:12 61440 --a------ C:\WINDOWS\system32\CopyToSendTo.dll
2008-06-25 21:16:12 114688 --a------ C:\WINDOWS\system32\cabarc.exe
2008-05-16 14:01:00 1630208 --a------ C:\WINDOWS\system32\nwiz.exe
2008-05-16 14:01:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-05-16 14:01:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-05-16 14:01:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-05-16 14:01:00 1486848 --a------ C:\WINDOWS\system32\nview.dll
2008-05-16 14:01:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-05-16 14:01:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-05-16 14:01:00 425984 --a------ C:\WINDOWS\system32\keystone.exe

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C59B4682-322F-4F9E-B29D-A67184052F73}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10/27/2006 11:38 PM]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [09/05/2006 07:22 PM]
"NSRKey"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [03/26/2007 03:45 PM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [01/29/2008 05:38 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [05/16/2008 02:01 PM]
"nwiz"="nwiz.exe" [05/16/2008 02:01 PM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [05/16/2008 02:01 PM]
"RTHDCPL"="RTHDCPL.EXE" [10/16/2007 06:30 PM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 06:43 PM C:\WINDOWS\Alcmtr.exe]
"Norton Save and Restore"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [03/26/2007 03:45 PM]
"DefragTaskBar"="C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe" [12/22/2006 02:38 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [05/27/2008 10:50 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07/07/2008 09:42 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 05:42 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"wextract_cleanup0"=rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\X\LOCALS~1\Temp\IXP000.TMP\"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nltide_3"=rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
"ShowDeskFix"=regsvr32 /s /n /i:u shell32

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Norton System Doctor.lnk - C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE [11/3/2005 8:09:04 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInternetIcon"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMcdEuu]
qoMcdEuu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 08/08/2008 06:49 PM 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeathAdder]
C:\Program Files\Razer\DeathAdder\razerhid.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT Task]
C:\Program Files\Gateway\EzTune\DTHtml.exe -startup_folder

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e443864e]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock]
C:\Program Files\LClock\LClock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
"C:\Program Files\lg_fwupdate\fwupdate.exe" blrun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lycosa]
"C:\Program Files\Razer\Lycosa\razerhid.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSWosCheck]
C:\Program Files\Norton SystemWorks Premier\osCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware]
"C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"C:\Program Files\Steam\Steam.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe -H

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
napagent
hkmsvc

-- End of Deckard's System Scanner: finished at 2008-08-12 09:36:17 ------------

Adobe AIR
Adobe AIR
Adobe Flash Player ActiveX
Adobe Reader 8.1.0
AppCore
Apple Mobile Device Support
Apple Software Update
ArcSoft Camera Suite
Ashampoo Magical Defrag 2
AV
Bonjour
ccCommon
CCleaner (remove only)
Component Framework
Connection Keep Alive
Day of Defeat: Source
DeathAdder(TM) Mouse
Dell Inkjet Printer J740
DVD Suite
Easy GIF Animator 4.6 Pro
EzTune
FinePixViewer Ver.4.2
FUJIFILM USB Driver
HijackThis 2.0.2
ImageMixer VCD2 for FinePix
Internet Worm Protection
iPod for Windows 2006-03-23
iTunes
LClock
LG ODD Auto Firmware Update
LiveUpdate 3.1 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
MicroStaff WINASPI
MSRedist
Norton AntiVirus
Norton AntiVirus (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Cleanup
Norton Protection Center
Norton Save and Restore
Norton SystemWorks
Norton SystemWorks (Symantec Corporation)
Norton SystemWorks Premier
Norton Utilities
NVIDIA Drivers
Pivot Software
PowerDVD
PowerProducer
QuickTime
RAW FILE CONVERTER LE
Razer Lycosa
Realtek High Definition Audio Driver
SPBBC 32bit
Spybot - Search & Destroy
Steam
Symantec
SymNet
TuneUp Utilities 2008
Windows Driver Package - Razer (HidUsb) HIDClass (01/11/2007 1.0)
WinRAR
WinXP Manager

Shaba · Aug 12, 2008

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
Code:
```
C:\WINDOWS\system32\vyGiRXbc.ini2
C:\WINDOWS\wnlmdakqonf.dll
```
Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

pippen · Aug 12, 2008

Hi Shaba,

C:\WINDOWS\system32\vyGiRXbc.ini2 moved successfully.
C:\WINDOWS\wnlmdakqonf.dll unregistered successfully.
C:\WINDOWS\wnlmdakqonf.dll moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08122008_123928

Shaba · Aug 13, 2008

We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

Open HijackThis, click do a system scan only and checkmark these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {C59B4682-322F-4F9E-B29D-A67184052F73} - (no file)
O20 - Winlogon Notify: qoMcdEuu - qoMcdEuu.dll (file missing)

Close all windows including browser and press fix checked.

Reboot.

Please make sure that all programs are closed when installing Java.

Click here to visit Java's website.
Scroll down to Java Runtime Environment (JRE) 6 Update 7. Click on Download.
Select Windows from the drop-down list for Platform.
Select Multi-language from the drop-down list for Language.
Check (tick) I agree to the Java SE Runtime Environment 6 License Agreement box and click on Continue.
Click on jre-6u7-windows-i586-p.exe link to download it and save this to a convenient location.
Double click on jre-6u7-windows-i586-p.exe to install Java.
After the Java installation has finished, please go to Kaspersky website and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

pippen · Aug 13, 2008

Here ya go Shaba.....

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, August 13, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, August 13, 2008 17:11:18
Records in database: 1089740
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 74387
Threat name: 2
Infected objects: 3
Suspicious objects: 0
Duration of the scan: 00:37:51

File name / Threat name / Threats count
C:\Documents and Settings\X\My Documents\Computer customizers\Vista Transformation Pack 4\Vista Transformation Pack 4.0.exe Infected: not-a-virus:RiskTool.Win32.CloseApp.a 2
C:\_OTMoveIt\MovedFiles\08122008_123928\WINDOWS\wnlmdakqonf.dll Infected: Trojan.Win32.Vapsup.jzx 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:51 AM, on 8/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragActivityMonitor.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Gateway\EzTune\DTSRVC.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\pippen\pippen.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Norton Save and Restore] "C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe"
O4 - HKLM\..\Run: [DefragTaskBar] "C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\defragTaskBar.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks Premier\Norton Utilities\SYSDOC32.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag 2\bin\aDefragService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Gateway\EzTune\DTSRVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 9526 bytes

Shaba · Aug 15, 2008

Sorry, I seem to have missed your reply.

Empty this folder:

C:\_OTMoveIt\MovedFiles

Empty Recycle Bin.

Still problems?

pippen · Aug 15, 2008

Shaba said:
Sorry, I seem to have missed your reply.

No problem bro. I appreciate the help.

Shaba said:
Still problems?

No, everything seems to be cool.

If that's it - Thank you Shaba. I appreciate you taking the time to help me.

Shaba · Aug 15, 2008

Then you're clean!

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Next we remove all used tools.

Please download OTCleanIt and save it to desktop.

Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:

Malwarebytes' Anti-Malware Setup Guide

Malwarebytes' Anti-Malware Scanning Guide
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean! :bigthumb:

Shaba · Aug 17, 2008

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.

Virtumonde

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

pippen

New member

Shaba

Security Expert: Emeritus

Shaba

Security Expert: Emeritus