XP - New Topic "Windows cannot access the specified..." log

MaineJane · Sep 3, 2009

Here's the Hijackthis.log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:19:00 AM, on 9/3/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\Secure\AV\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\WinUtil\Vista Drv icon\VistaDriveIcon\DrvIcon.exe

O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog

O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs

O4 - HKLM\..\Run: [Nitro PDF Printer Monitor] "C:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe"

O4 - HKLM\..\Run: [IObit Security 360] C:\Program Files\Secure\IObit\IObit Security 360\IS360tray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240275574546

O16 - DPF: {700EF03F-A472-4D26-8ACB-300F4D04FD96} (Recovery ActiveX Control Module) - https://www.lojackforlaptops.com/ctmweb/testoc.cab

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\Secure\a2 Free\a2service.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE

O23 - Service: IS360service - IObit - C:\Program Files\Secure\IObit\IObit Security 360\IS360srv.exe

O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Secure\Online Armor\OAcat.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Secure\Online Armor\oasrv.exe

O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe

O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

--

End of file - 5780 bytes

http://forums.spybot.info/showthread.php?p=333479#post333479

katana · Sep 3, 2009

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Failure to reply within 5 days will result in the topic being closed.
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Some of the logs I request will be quite large, You may need to split them over a couple of replies.

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------

Please download the Win32kDiag.exe tool from the following location and save it to your desktop:

http://download.bleepingcomputer.com/rootrepeal/Win32kDiag.exe

Once downloaded, double-click on the program and let it finish. When it states Finished! Press any key to exit..., you can press any key on your keyboard to close the program. On your desktop should now be a file called Win32kDiag.txt.

Double-click on this file and post the contents as a reply to this topic.

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
( They can also be found in the C:\RSIT folder )

MaineJane · Sep 4, 2009

Thank You Katana, here's win32diag.txt

Log file is located at: C:\Documents and Settings\Administrator\Desktop\Win32kDiag.txt

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Finished!

MaineJane · Sep 4, 2009

...and here is RSI's info.txt

info.txt logfile of random's system information tool 1.06 2009-09-03 19:47:49

======Uninstall list======

-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\SETUP.exe -l0x0009 -removeonly

-->C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\SETUP.exe -l0x0009 -removeonly

-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu

-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}

-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}

-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}

-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

ACDSee 9 Photo Manager-->MsiExec.exe /X{B2D41883-3BFC-4BA0-A2F6-5A2C9836C238}

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Reader 8.1.5-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}

Alky for Applications (Windows XP)-->MsiExec.exe /X{BB05D173-9681-4812-A7FA-BD4042A3DA00}

Anti Trojan Elite 4.4.8-->"C:\Program Files\Secure\Anti Trojan Elite\unins000.exe"

a-squared Free 4.5-->"C:\Program Files\Secure\a2 Free\unins000.exe"

Audio Record Wizard v2.7-->"C:\Program Files\Audio\ARWizard\unins000.exe"

BootSkin-->C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\UNWISE.EXE C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\INSTALL.LOG

Client Security Solution-->MsiExec.exe /I{F055E1B2-8A05-4D87-8039-1BE979BA4193}

Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_HDAUDIO\UIU32a.exe -U -ILvVen5a.inf

CubeDesktop 1.3.1-->C:\Program Files\Desktop\CubeDesktop\uninst.exe

CursorFX Plus-->"C:\Documents and Settings\All Users\Application Data\{86309521-B982-4930-BEE5-E248EAAA84A7}\CursorFX_setup.exe" REMOVE=TRUE MODIFY=FALSE

CursorFX-->C:\Documents and Settings\All Users\Application Data\{86309521-B982-4930-BEE5-E248EAAA84A7}\CursorFX_setup.exe

DesktopX-->C:\PROGRA~1\OBJECT~1\DesktopX\UNWISE.EXE C:\PROGRA~1\OBJECT~1\DesktopX\INSTALL.LOG

DVDFab 6.0.1.0 by CATER / AHCU-->"C:\Program Files\DVD\DVDFab 6\unins000.exe"

FairStars Audio Converter 1.82-->"C:\Program Files\Audio\FairStars Audio Converter\unins000.exe"

FinalBurner PRO v2.7.0.182-->"C:\Program Files\Multimedia\Final Burner\Uninstall.exe" "C:\Program Files\Multimedia\Final Burner\install.log" -u

Gadget Extractor-->MsiExec.exe /X{C8838D06-D7DB-4CB0-BF13-7191D2D84C42}

GIMP 2.6.7-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"

GOM Player-->"C:\Program Files\Multimedia\GomPlayer\Uninstall.exe"

HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045&SUBSYS_17AA20DA\UIU32m.exe -U -ILVVEN5Km.inf

HijackThis 2.0.2-->"E:\1 sbot forum\HijackThis.exe" /uninstall

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"

Intel(R) Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall

Intel(R) PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe

IObit Security 360 RC-->"C:\Program Files\Secure\IObit\IObit Security 360\unins000.exe"

J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}

Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}

jv16 PowerTools 2009-->"C:\Program Files\WinUtil\jv16 PowerTools 2009\unins000.exe"

Kantaris Media Player 0.5.4-->"C:\Program Files\Kantaris\unins000.exe"

Lenovo Registration-->C:\Program Files\Lenovo Registration\uninstall.exe

Loaris Trojan Remover 1.1-->"C:\Program Files\Secure\ltr\unins000.exe"

LogonStudio-->C:\PROGRA~1\WINCUS~1\LOGONS~1\UNWISE.EXE C:\PROGRA~1\WINCUS~1\LOGONS~1\INSTALL.LOG

Maintenance Manager-->Rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\AWAYTASK.INF

Malwarebytes' Anti-Malware-->"C:\Program Files\Secure\MWB\unins000.exe"

mCore-->MsiExec.exe /I{E81667C6-2856-46D6-ABEA-6A2F42166779}

mDriver-->MsiExec.exe /I{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}

MediaMonkey 3.1-->"C:\Program Files\Audio\MediaMonkey\unins000.exe"

Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}

Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}

Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"

Microsoft Office XP Small Business-->MsiExec.exe /I{91130409-6000-11D3-8CFE-0050048383C9}

Microsoft Speech SDK 5.1-->MsiExec.exe /I{A403D88E-ED7D-48E3-91FD-B8C8A720EDA1}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}

Mozilla Firefox (3.5.2)-->C:\Program Files\Communications\Mozilla Firefox\uninstall\helper.exe

Mozilla Thunderbird (2.0.0.23)-->C:\Program Files\Communications\Mail\Thunderbird\uninstall\helper.exe

MPEG2 Codec(libmpeg2/mad)-->"C:\Program Files\GNU\MPEG2\Uninstall.exe"

mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}

mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}

MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 6.0 Parser-->MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE}

mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}

Nitro PDF Professional-->MsiExec.exe /I{8EBE1DB0-8687-43A7-8781-6445E62CAFA5}

On Screen Display-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall.XP 132 C:\Program Files\Lenovo\HOTKEY\tphk_tp.inf

Online Armor 3.5-->"C:\Program Files\Secure\Online Armor\unins000.exe"

OpenOffice.org 3.0-->MsiExec.exe /I{F44DA61E-720D-4E79-871F-F6E628B33242}

PC Pitstop Exterminate2 2.0-->"C:\Program Files\PCPitstop\Exterminate2\unins000.exe"

PC-Doctor 5 for Windows-->C:\Program Files\PCDR5\uninst.exe

PopTray 3.20-->C:\Program Files\Communications\Mail\\PopTray\Uninstall.exe

PopTray Microsoft Speech Plugin 1.0-->C:\Program Files\Communications\Mail\\PopTray\Plugins\UninstallMicrosoftSpeech.exe

PowerISO-->"C:\Program Files\DVD\PowerISO\uninstall.exe"

QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}

RecordNow Audio-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}

RecordNow Copy-->MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}

RecordNow Data-->MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}

Remove Multimedia Center-->C:\swtools\apps\MMCfTO\customiz\sequencer.exe -fc:\swtools\apps\MMCfTO\customiz\uninst.seq

Rescue and Recovery-->MsiExec.exe /I{F151F2B3-0C32-44D3-90E2-E639B8024622}

RocketDock 1.3.5-->"C:\Program Files\Desktop\RocketDock\unins000.exe"

Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"

Security Update for Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

Smarty Uninstaller Pro-->"C:\Program Files\WinUtil\Smarty Uninstaller Pro\unins000.exe"

Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}

Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}

Sonic Icons for Lenovo-->MsiExec.exe /I{B334D9AE-1393-423E-97C0-3BDC3360E692}

Sonic Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}

Startup Delayer v2.5 (build 138)-->C:\Program Files\Winutil\Startup Delayer\Uninstall.exe

Tag&Rename 3.5.2-->"C:\Program Files\Audio\TagRename\unins000.exe"

TeamViewer 4-->C:\Program Files\Communications\TeamViewer\Version4\uninstall.exe

ThinkPad EasyEject Utility -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1297C681-92D7-40EF-93BF-03F66EC5105C}\SETUP.EXE" -l0x9 -AddRemove

ThinkPad FullScreen Magnifier-->RunDll32 setupapi.dll,InstallHinfSection DefaultUninstall.NT 132 C:\Program Files\Lenovo\Zoom\TpScrex.inf

ThinkPad PC Card Power Policy-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUnInstall 132 C:\SWTOOLS\OSFIXES\PCMCIAPW\pcmciapw.inf

ThinkPad Power Management Driver-->RunDll32.exe tpinspm.dll,Uninstall

ThinkPad Power Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A0E64EBA-8BF0-49FB-90C0-BB3D781A2016}\SETUP.EXE" -l0x9 -AddRemove

ThinkPad TrackPoint Driver-->C:\WINDOWS\system32\tp4unins.exe

ThinkVantage Technologies Welcome Message-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1007F41F-7D69-468E-8017-3849A5A973C2}\Setup.exe" -l0x9 anything

TrueCrypt-->"C:\Program Files\WinUtil\TrueCrypt\TrueCrypt Setup.exe" /u

Tweak UI-->"C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"

UltraCompare v6.40-->MsiExec.exe /I{E962A4F0-295A-4760-805E-162AED3EE8DE}

UltraEdit 15.10-->MsiExec.exe /I{DDF17E28-E4C4-41CF-9DB9-8FA5F19B918C}

Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"

Wallpapers-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}\Setup.exe" -l0x9 UNINSTALL

WindowBlinds-->C:\PROGRA~1\Desktop\Stardock\OBJECT~1\WINDOW~1\UNWISE.EXE C:\PROGRA~1\Desktop\Stardock\OBJECT~1\WINDOW~1\INSTALL.LOG

Windows Driver Package - Ricoh Company (rimsptsk) hdc (11/14/2006 6.00.01.04)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /us C:\PROGRA~1\DIFX\UninstallScripts\F13EE0B22AD5D087DFA50E3D4D6F13FC1AAAFB32

Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll

Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall

Windows Sidebar-->C:\Program Files\Windows Sidebar\uninst.exe

WinRAR archiver-->C:\Program Files\WinUtil\Archivers\WinRAR\uninstall.exe

WinSnap-->C:\Program Files\Graphics\WinSnap\uninst.exe

WinXP Manager-->MsiExec.exe /I{1043E281-B080-4947-9BD7-3F1D233BF6D2}

WirelessMon V3.1-->"C:\Program Files\WirelessMon\unins000.exe"

XnView 1.96-->"C:\Program Files\Graphics\XnView\unins000.exe"

XP Themes-->MsiExec.exe /I{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}

======Security center information======

FW: Online Armor Firewall (disabled)

======System event log======

Computer Name: LAPTOP-048AB0BF

Event Code: 7000

Message: The Remote Procedure Call (RPC) Net service failed to start due to the following error:

Access is denied.

Record Number: 2782

Source Name: Service Control Manager

Time Written: 20090730070437.000000-240

Event Type: error

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 7000

Message: The pmem service failed to start due to the following error:

Access is denied.

Record Number: 2781

Source Name: Service Control Manager

Time Written: 20090730070437.000000-240

Event Type: error

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 7023

Message: The HID Input Service service terminated with the following error:

The system cannot find the file specified.

Record Number: 2780

Source Name: Service Control Manager

Time Written: 20090730070437.000000-240

Event Type: error

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 4

Message: Broadcom NetLink (TM) Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.

Record Number: 2775

Source Name: b57w2k

Time Written: 20090730070333.000000-240

Event Type: warning

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 1003

Message: Your computer was not able to renew its address from the network (from the

DHCP Server) for the Network Card with network address 001CBF8AFCF9. The following

error occurred:

The operation was canceled by the user.

.

Your computer will continue to try and obtain an address on its own from

the network address (DHCP) server.

Record Number: 2772

Source Name: Dhcp

Time Written: 20090730070325.000000-240

Event Type: warning

User:

=====Application event log=====

Computer Name: LAPTOP-048AB0BF

Event Code: 1000

Message: Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

Record Number: 286

Source Name: Application Error

Time Written: 20090421080111.000000-240

Event Type: error

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 1001

Message: Fault bucket 1239580114.

Record Number: 285

Source Name: Application Error

Time Written: 20090421080054.000000-240

Event Type: error

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 1000

Message: Faulting application explorer.exe, version 6.0.2900.5512, faulting module dlacresw.dll, version 5.20.19.0, fault address 0x00021e7e.

Record Number: 284

Source Name: Application Error

Time Written: 20090421080021.000000-240

Event Type: error

User:

Computer Name: LAPTOP-048AB0BF

Event Code: 1517

Message: Windows saved user LAPTOP-048AB0BF\Bill registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Record Number: 278

Source Name: Userenv

Time Written: 20090421074827.000000-240

Event Type: warning

User: NT AUTHORITY\SYSTEM

Computer Name: LAPTOP-048AB0BF

Event Code: 1000

Message: Faulting application sidebar.exe, version 6.0.6001.16510, faulting module vcomctl32.dll, version 0.0.0.0, fault address 0x00001213.

Record Number: 275

Source Name: Application Error

Time Written: 20090421062222.000000-240

Event Type: error

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\Intel\Wireless\Bin;C:\Program Files\Common Files\Lenovo;C:\Program Files\Lenovo\Client Security Solution;C:\Program Files\Desktop\Alky for Applications\Libraries;C:\Program Files\QuickTime\QTSystem

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel

"PROCESSOR_REVISION"=0f0d

"NUMBER_OF_PROCESSORS"=2

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"SonicCentral"=C:\Program Files\Common Files\Sonic Shared\Sonic Central\

"TVT"=C:\Program Files\Lenovo

"TVTCOMMON"=C:\Program Files\Common Files\Lenovo

"SWSHARE"=C:\SWSHARE

"RR"=C:\Program Files\Lenovo\Rescue and Recovery

"TVTPYDIR"=C:\Program Files\Common Files\Lenovo\Python24

"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

"QTJAVA"=C:\Program Files\Java\jre1.6.0_07\lib\ext\QTJava.zip

"SAFEBOOT_OPTION"=NETWORK

-----------------EOF-----------------

MaineJane · Sep 4, 2009

....and here is RSIT's log.txt

Logfile of random's system information tool 1.06 (written by random/random)

Run by Administrator at 2009-09-03 19:47:43

Microsoft Windows XP Professional Service Pack 3

System drive C: has 26 GB (54%) free of 48 GB

Total RAM: 2038 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:47:47 PM, on 9/3/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Communications\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Administrator\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\Secure\AV\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: ThinkVantage Password Manager - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O4 - HKLM\..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [DrvIcon] C:\Program Files\WinUtil\Vista Drv icon\VistaDriveIcon\DrvIcon.exe

O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog

O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs

O4 - HKLM\..\Run: [Nitro PDF Printer Monitor] "C:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe"

O4 - HKLM\..\Run: [IObit Security 360] C:\Program Files\Secure\IObit\IObit Security 360\IS360tray.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O9 - Extra button: (no name) - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra 'Tools' menuitem: ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240275574546

O16 - DPF: {700EF03F-A472-4D26-8ACB-300F4D04FD96} (Recovery ActiveX Control Module) - https://www.lojackforlaptops.com/ctmweb/testoc.cab

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\Secure\a2 Free\a2service.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: IPS Core Service (IPSSVC) - Lenovo Group Limited - C:\WINDOWS\system32\IPSSVC.EXE

O23 - Service: IS360service - IObit - C:\Program Files\Secure\IObit\IObit Security 360\IS360srv.exe

O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - C:\Program Files\Secure\Online Armor\OAcat.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe

O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - C:\Program Files\Secure\Online Armor\oasrv.exe

O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe

O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

--

End of file - 5989 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\PMTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]

AVG Safe Search - C:\Program Files\Secure\AV\AVG\AVG8\avgssie.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]

DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2006-02-02 110652]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F040E541-A427-4CF7-85D8-75E3E0F476C5}]

CPwmIEBrowserHelper Object - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll [2007-01-30 796224]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"TPHOTKEY"=C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [2007-03-09 66176]

"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-02-25 131072]

"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-02-25 155648]

"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-02-25 131072]

"DrvIcon"=C:\Program Files\WinUtil\Vista Drv icon\VistaDriveIcon\DrvIcon.exe [2007-07-04 45056]

"BLOG"=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog []

"BootSkin Startup Jobs"=C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe [2004-04-26 270336]

"Nitro PDF Printer Monitor"=C:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe [2009-03-04 209216]

"IObit Security 360"=C:\Program Files\Secure\IObit\IObit Security 360\IS360tray.exe [2009-08-20 943888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\@OnlineArmor GUI]

C:\Program Files\Secure\Online Armor\oaui.exe [2009-04-16 2044104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]

C:\Program Files\Winutil\TrueImageHome\TimounterMonitor.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti Trojan Elite]

C:\Program Files\Secure\Anti Trojan Elite\TJEnder.exe :NO []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detector]

DevDetect.exe -autorun []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2006-02-02 122940]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-07-27 221184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2004-07-27 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogonStudio]

C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe [2005-09-06 987187]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]

C:\Program Files\Winutil\TrueImageHome\TrueImageMonitor.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^ImpulseNow.lnk]

[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"TVT Scheduler"=2

"TVT Backup Service"=2

"TVT Backup Protection Service"=2

"tvtnetwk"=2

"SvcOnlineArmor"=2

"AcrSch2Svc"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]

C:\WINDOWS\system32\igfxdev.dll [2007-02-25 204800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCPClient]

C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll [2005-01-31 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpfnf2]

C:\Program Files\Lenovo\HOTKEY\notifyf2.dll [2006-09-06 34344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey]

C:\Program Files\Lenovo\HOTKEY\tphklock.dll [2006-12-13 28672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]

C:\Program Files\Desktop\Stardock\Object Desktop\WindowBlinds\wbsrv.dll [2008-07-22 210168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]

C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - C:\PROGRA~1\COMMON~1\Stardock\MCPCore.dll [2005-05-10 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{4F07DA45-8170-4859-9B5F-037EF2970034}"=C:\PROGRA~1\Secure\ONLINE~1\oaevent.dll [2009-04-16 335048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=323

"NoDriveAutoRun"=67108863

"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=

"NoDriveAutoRun"=

"NoDriveTypeAutoRun"=

"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"

"C:\Program Files\Communications\TeamViewer\Version4\TeamViewer.exe"="C:\Program Files\Communications\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

"C:\WINDOWS\system32\ctmweb.exe"="C:\WINDOWS\system32\ctmweb.exe:*:Enabled:ctmweb.exe"

"C:\Program Files\Communications\Mail\Thunderbird\thunderbird.exe"="C:\Program Files\Communications\Mail\Thunderbird\thunderbird.exe:*:Enabled:Mozilla Thunderbird"

"C:\Program Files\Audio\LimeWire\LimeWire.exe"="C:\Program Files\Audio\LimeWire\LimeWire.exe:*:Enabled:LimeWire"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled

xpsp2res.dll,-22019"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled

xpsp3res.dll,-20000"

"C:\WINDOWS\SYSTEM32\ctmweb.exe"="C:\WINDOWS\SYSTEM32\ctmweb.exe:*:Enabled:ctmweb Computrace Installation/Management Application"

======List of files/folders created in the last 1 months======

2009-09-03 19:47:43 ----D---- C:\rsit

2009-09-03 19:46:26 ----D---- C:\Documents and Settings\Administrator\Application Data\Sun

2009-09-03 19:14:19 ----D---- C:\WINDOWS\Sun

2009-09-03 19:12:07 ----D---- C:\WINDOWS\LastGood

2009-09-03 10:18:43 ----D---- C:\Program Files\Trend Micro

2009-09-03 08:07:46 ----SHD---- C:\Config.Msi

2009-09-02 16:46:32 ----A---- C:\WINDOWS\system32\rpcnetp.exe

2009-09-02 14:27:58 ----D---- C:\!KillBox

2009-09-02 14:17:48 ----A---- C:\WINDOWS\system32\locate.com

2009-09-02 14:15:35 ----D---- C:\ISeeYouXP

2009-09-02 12:55:02 ----D---- C:\Program Files\PCPitstop

2009-09-01 23:00:01 ----D---- C:\Program Files\WirelessMon

2009-09-01 22:29:42 ----D---- C:\Documents and Settings\All Users\Application Data\IObit

2009-09-01 22:28:43 ----SHD---- C:\RECYCLER

2009-09-01 22:24:11 ----D---- C:\WINDOWS\temp

2009-09-01 22:24:10 ----A---- C:\ComboFix.txt

2009-09-01 22:16:46 ----A---- C:\WINDOWS\PEV.exe

2009-09-01 19:17:24 ----HD---- C:\WINDOWS\system32\GroupPolicy

2009-09-01 19:12:31 ----D---- C:\Documents and Settings\Administrator\Application Data\Macromedia

2009-09-01 19:12:31 ----D---- C:\Documents and Settings\Administrator\Application Data\Adobe

2009-09-01 19:11:33 ----D---- C:\Documents and Settings\Administrator\Application Data\Mozilla

2009-09-01 15:56:11 ----A---- C:\WINDOWS\resetlog.txt

2009-09-01 15:55:54 ----D---- C:\ERDNT

2009-09-01 14:10:09 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

2009-09-01 11:19:23 ----D---- C:\VundoFix Backups

2009-09-01 11:19:23 ----A---- C:\VundoFix.txt

2009-09-01 10:36:12 ----A---- C:\avenger.txt

2009-09-01 10:12:11 ----D---- C:\Documents and Settings\Administrator\Application Data\Malwarebytes

2009-09-01 10:12:06 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2009-09-01 07:31:00 ----A---- C:\WINDOWS\zip.exe

2009-09-01 07:31:00 ----A---- C:\WINDOWS\SWXCACLS.exe

2009-09-01 07:31:00 ----A---- C:\WINDOWS\SWSC.exe

2009-09-01 07:31:00 ----A---- C:\WINDOWS\SWREG.exe

2009-09-01 07:31:00 ----A---- C:\WINDOWS\sed.exe

2009-09-01 07:31:00 ----A---- C:\WINDOWS\NIRCMD.exe

2009-09-01 07:31:00 ----A---- C:\WINDOWS\grep.exe

2009-09-01 07:30:58 ----D---- C:\WINDOWS\ERDNT

2009-09-01 07:30:57 ----SD---- C:\ComboFix

2009-09-01 07:27:56 ----D---- C:\Qoobox

2009-09-01 07:27:08 ----D---- C:\Documents and Settings\Administrator\Application Data\WinRAR

2009-09-01 07:24:48 ----SHD---- C:\WINDOWS\CSC

2009-08-28 08:18:17 ----D---- C:\Program Files\Editors

2009-08-27 13:34:00 ----D---- C:\Program Files\GIMP-2.0

2009-08-27 08:56:30 ----D---- C:\Documents and Settings\All Users\Application Data\SuperMP3Download

2009-08-26 17:15:10 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$

2009-08-26 04:19:22 ----D---- C:\Program Files\QuickTime

2009-08-26 04:19:20 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer

2009-08-24 04:04:00 ----D---- C:\Program Files\ffdshow

2009-08-12 17:05:01 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$

2009-08-12 17:04:57 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$

2009-08-12 17:04:52 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$

2009-08-12 17:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$

2009-08-12 17:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$

2009-08-12 17:04:34 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$

2009-08-12 17:04:28 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$

2009-08-12 17:04:20 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$

2009-08-12 17:01:36 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$

======List of files/folders modified in the last 1 months======

2009-09-03 19:44:17 ----A---- C:\WINDOWS\ntbtlog.txt

2009-09-03 19:43:20 ----A---- C:\TPHKLOCK.TXT

2009-09-03 19:43:19 ----AD---- C:\WINDOWS\system32

2009-09-03 19:41:48 ----A---- C:\WINDOWS\SchedLgU.Txt

2009-09-03 19:27:49 ----D---- C:\WINDOWS\Prefetch

2009-09-03 19:14:19 ----AD---- C:\WINDOWS

2009-09-03 19:12:08 ----HD---- C:\WINDOWS\inf

2009-09-03 19:12:07 ----D---- C:\WINDOWS\system32\CatRoot2

2009-09-03 19:06:57 ----A---- C:\WINDOWS\system32\rpcnet.dll

2009-09-03 10:18:43 ----RD---- C:\Program Files

2009-09-03 08:15:00 ----D---- C:\WINDOWS\system32\drivers

2009-09-03 08:08:37 ----SHD---- C:\WINDOWS\Installer

2009-09-03 08:08:17 ----D---- C:\WINDOWS\WinSxS

2009-09-03 08:07:53 ----D---- C:\Program Files\Common Files\Acronis

2009-09-03 08:07:50 ----D---- C:\Program Files\WinUtil

2009-09-02 14:09:54 ----D---- C:\Program Files\Windows Sidebar

2009-09-02 13:02:32 ----D---- C:\Program Files\Secure

2009-09-01 22:23:25 ----SD---- C:\WINDOWS\Tasks

2009-09-01 22:22:08 ----A---- C:\WINDOWS\system.ini

2009-09-01 22:21:08 ----D---- C:\WINDOWS\AppPatch

2009-09-01 22:20:57 ----D---- C:\Program Files\Common Files

2009-09-01 22:14:38 ----D---- C:\Program Files\Audio

2009-09-01 20:50:13 ----D---- C:\WINDOWS\Minidump

2009-09-01 20:44:50 ----SD---- C:\Documents and Settings\Administrator\Application Data\Microsoft

2009-09-01 19:36:52 ----D---- C:\WINDOWS\security

2009-09-01 15:38:00 ----D---- C:\WINDOWS\system32\config

2009-09-01 09:49:43 ----A---- C:\WINDOWS\system32\PerfStringBackupbad.INI

2009-09-01 07:45:12 ----RASH---- C:\boot.ini

2009-09-01 07:45:12 ----A---- C:\WINDOWS\win.ini

2009-08-31 11:09:58 ----HD---- C:\WINDOWS\$hf_mig$

2009-08-27 13:13:28 ----D---- C:\Program Files\Graphics

2009-08-23 22:20:16 ----ASHD---- C:\WINDOWS\system32\dllcache

2009-08-21 09:00:51 ----D---- C:\Program Files\DVD

2009-08-12 17:05:05 ----A---- C:\WINDOWS\imsins.BAK

2009-08-12 17:04:30 ----D---- C:\Program Files\Outlook Express

2009-08-08 08:11:11 ----A---- C:\WINDOWS\system32\PROCDB.INI

2009-08-08 08:10:50 ----A---- C:\WINDOWS\system32\IPSCtrl.INI

2009-08-05 05:01:48 ----A---- C:\WINDOWS\system32\mswebdvd.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-11-18 5660]

R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-11-18 22684]

R1 OAmon;OAmon; \??\C:\WINDOWS\system32\drivers\OAmon.sys []

R1 OAnet;OAnet; \??\C:\WINDOWS\system32\drivers\OAnet.sys []

R1 Tcpip6;Microsoft IPv6 Protocol Driver; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2008-06-20 225856]

R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2007-05-01 161792]

R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]

R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]

R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2007-02-27 21040]

R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]

R3 NETw4x32;Intel(R) Wireless WiFi Link Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-03-28 2204672]

R3 Tp4Track;PS/2 TrackPoint Driver; C:\WINDOWS\system32\DRIVERS\tp4track.sys [2005-07-12 13840]

R3 tunmp;Microsoft Tun Miniport Adapter Driver; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-13 12288]

R3 TVTPktFilter;TVT Packet Filter Service; C:\WINDOWS\system32\DRIVERS\tvtpktfilter.sys [2007-02-08 17664]

R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]

R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]

R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]

S1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]

S1 OADevice;OADriver; \??\C:\WINDOWS\system32\drivers\OADriver.sys []

S1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2009-03-15 56268]

S1 TPHKDRV;TPHKDRV; C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys [2006-10-22 17778]

S1 TPPWRIF;TPPWRIF; C:\WINDOWS\System32\drivers\Tppwrif.sys [2006-12-19 4442]

S1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2009-04-21 215872]

S2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.6.0.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2009-04-20 21425]

S2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2006-02-02 25628]

S2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2006-02-02 2496]

S2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2006-02-02 86652]

S2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2006-02-02 14684]

S2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2006-02-02 6364]

S2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2006-02-02 87036]

S2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2006-02-02 94332]

S2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-11-18 40544]

S2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]

S2 NwlnkIpx;NWLink IPX/SPX/NetBIOS Compatible Transport Protocol; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]

S2 NwlnkNb;NWLink NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-04 63232]

S2 NwlnkSpx;NWLink SPX/SPXII Protocol; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-04 55936]

S2 pmem;pmem; \??\C:\WINDOWS\System32\drivers\pmemnt.sys []

S2 PROCDD;IPS Helper Driver; C:\WINDOWS\system32\DRIVERS\PROCDD.SYS [2006-11-06 12080]

S2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2007-02-21 12416]

S2 tvtfilter;tvtfilter; C:\WINDOWS\system32\DRIVERS\tvtfilter.sys [2009-04-20 33536]

S3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]

S3 ATE_PROCMON;ATE_PROCMON; \??\C:\Program Files\Secure\Anti Trojan Elite\ATEPMon.sys []

S3 catchme;catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys []

S3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]

S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]

S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAudN.sys [2007-04-27 666112]

S3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2007-03-25 988032]

S3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2007-03-25 210688]

S3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-02-25 5700096]

S3 NuidFltr;NUID filter driver; C:\WINDOWS\system32\DRIVERS\NuidFltr.sys [2009-05-09 14736]

S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]

S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-04-21 47360]

S3 psadd;Lenovo Parties Service Access Device Driver; C:\WINDOWS\system32\DRIVERS\psadd.sys [2006-09-13 28224]

S3 TVTI2C;Lenovo SM bus driver; C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2006-09-13 35264]

S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\DRIVERS\UIUSYS.SYS []

S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]

S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]

S3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2007-03-25 731136]

S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944]

S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]

S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]

S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]

S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]

S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]

S4 iaStor;Intel AHCI Controller; C:\WINDOWS\system32\DRIVERS\iaStor.sys [2007-02-12 277784]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]

S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]

S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 a2free;a-squared Free Service; C:\Program Files\Secure\a2 Free\a2service.exe [2009-07-26 1864824]

S2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-03-06 643072]

S2 IBMPMSVC;ThinkPad PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2007-02-27 36400]

S2 IPSSVC;IPS Core Service; C:\WINDOWS\system32\IPSSVC.EXE [2007-01-29 108080]

S2 IS360service;IS360service; C:\Program Files\Secure\IObit\IObit Security 360\IS360srv.exe [2009-08-20 305936]

S2 OAcat;Online Armor Helper Service; C:\Program Files\Secure\Online Armor\OAcat.exe [2009-04-16 361160]

S2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-03-06 327680]

S2 rpcnet;Remote Procedure Call (RPC) Net; C:\WINDOWS\system32\rpcnet.exe [2009-08-03 51200]

S2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-03-06 983040]

S2 SvcOnlineArmor;Online Armor; C:\Program Files\Secure\Online Armor\oasrv.exe [2009-04-16 3049160]

S2 ThinkVantage Registry Monitor Service;ThinkVantage Registry Monitor Service; C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe [2007-01-30 644672]

S2 TVT Backup Protection Service;TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-02-08 569344]

S2 TVT Backup Service;TVT Backup Service; C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe [2007-02-08 950272]

S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]

S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

S4 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe []

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

S4 TVT Scheduler;TVT Scheduler; c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [2007-02-08 1118208]

S4 tvtnetwk;tvtnetwk; C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe [2007-02-08 45056]

-----------------EOF-----------------

katana · Sep 4, 2009

----------------------------------------------------------------------------------------
Step 1

OTMoveIt
Please download OTM by OldTimer and save it to your desktop

Double-click OTM.exe to run it.
Copy the lines in the codebox below. ( Make sure you include rocesses )

Code:

:Processes
:Reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detector]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^ImpulseNow.lnk]
:Commands
[Purity]
[EmptyTemp]

Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

- Close ALL open windows (especially Internet Explorer!)-
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply.
Close OTM

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

----------------------------------------------------------------------------------------
Step 2

We need to scan the system with this special tool.

Please download Junction.zip and save it.
Unzip it and put junction.exe in the main directory ( usually C: )

Create A Batch File
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad.
Save it as "All Files" and name it look.bat Please save it on your desktop.

@Echo Off
If exist "%Temp%\Klog.txt" del /q "%Temp%\Klog.txt"
If exist "%SYSTEMDRIVE%\junction.exe" goto Cont
If exist "%UserProfile%\Desktop\junction.exe" (copy "%UserProfile%\Desktop\junction.exe" "%SYSTEMDRIVE%\junction.exe"&& Goto Cont )
Echo Junction Not Found !! >>"%Temp%\Klog.txt"
Goto End
:Cont
%SYSTEMDRIVE%\junction.exe -s c:\ >"%Temp%\Klog.txt"
:End
"%Temp%\Klog.txt"
del /q "%Temp%\Klog.txt"
del /q %0

Double click on look.bat
Please be patient, as this will search the entire disc

Notepad will open, please copy/paste the results here.

----------------------------------------------------------------------------------------
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Some of the logs I request will be quite large, You may need to split them over a couple of replies.

OTMoveIt Log
Klog.txt

MaineJane · Sep 4, 2009

OTMoveIt

I couldn't highlight what was under the green bar to cut & paste because a little window asking me to reboot popped up, it wouldn't allow me to click anywhere else. I tried to just close the window, instead of clicking "OK" but the machine rebooted anyway. FWIW, I didn't see any warnings or error messages.

It did not create a file called "OTMoveIt.log" either in the OTM file folder or the Desktop, instead it created 09042009_062737.log, it's contents are as follows:

All processes killed

========== PROCESSES ==========

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detector\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bill^Start Menu^Programs^Startup^ImpulseNow.lnk\ deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 55250 bytes

->Temporary Internet Files folder emptied: 32902 bytes

->Java cache emptied: 5045 bytes

->FireFox cache emptied: 24788068 bytes

User: All Users

User: Ann

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->FireFox cache emptied: 14798995 bytes

User: Bill

->Temp folder emptied: 79856699 bytes

->Temporary Internet Files folder emptied: 111548 bytes

->Java cache emptied: 261369 bytes

->FireFox cache emptied: 39812301 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

Windows Temp folder emptied: 483 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 152.39 mb

OTM by OldTimer - Version 3.0.0.6 log created on 09042009_062737

Files moved on Reboot...

Registry entries deleted on Reboot...

MaineJane · Sep 4, 2009

contents of Klog.txt

Junction v1.05 - Windows junction creator and reparse point viewer

Copyright (C) 2000-2007 Mark Russinovich

Systems Internals - http://www.sysinternals.com

Failed to open \\?\c:\\pagefile.sys: The process cannot access the file because it is being used by another process.

Failed to open \\?\c:\\System Volume Information: Access is denied.

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

...

.\\?\c:\\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a: JUNCTION

Print Name : C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790

Substitute Name: C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790

.\\?\c:\\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a: JUNCTION

Print Name : C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e

Substitute Name: C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e

.

...

...

...

...

...

...

...

katana · Sep 4, 2009

There is no sign of any infection, please can you describe your problem in a bit more detail.

MaineJane · Sep 4, 2009

infection

I ran those utilities in Safe Mode, because what has been happening in Normal Mode is that just about any program that I try to launch gives me a pop up window that says "Windows cannot access the specified device, path, or file. You may not have appropriate permissions to access this item."

If I right-click on the executable, and pick "Run As..." and choose Administrator and enter the pw, I get the same thing.

There doesn't seem to be any rhyme or reason to it, some programs will run, something as innocuous as a PDF Editor will instead return that error.

Programs that use the Windows Installer always fail in Normal Mode, I get a message that says "System Administrator has set policies to prevent this installation."

My ability to connect to the Internet via the wireless router is worse than sporadic, 9 out of 10 attempts fail.

This is a dual boot machine, I'm on Linux now, and I connect to the wireless router easily. I have full access to the other partition from Linux, if that's worth anything.

I'll reboot now, into Normal Mode, and see if anything has changed, and if I can connect, I post to you from there.

MaineJane · Sep 4, 2009

No Such Luck

I couldn't connect, I open the network connections window, see available wireless connections, choose mine, and get the "Wireless Network Connection" window, which spends about 30 seconds telling me "Waiting for Network to be ready...", and then it times out, no error message, it just closes the window and I am not connected.

I can run Notepad, but if try to run the Calculator, I get "Windows cannot access the specified device, path, or file..." etc.

Pretty Darn Freaky.

katana · Sep 4, 2009

Please try running this in normal mode.

Dial-A-Fix

We need to repair some of windows' internal registration settings

Please download Dial-A-Fix from one of the following mirrors:
- Primary Mirror
- Secondary Mirror
Extract the zip file to your desktop.
Double click Dial-a-Fix.exe to start the program.
Press the green double checkmark box (Looks like this:

)
UNcheck Empty Temp Folders, as well as Adjust Time/Date in the prep section. The prep section should then look like this:
When the window looks like this, press the GO button in the bottom of the window.
Exit/Close Dial-A-Fix

If that doesn't solve the problem, please try the following.

Please download FixPolicies.exe by Bill Castner and save it to your desktop.
Double click on FixPolicies.exe to run it.
Click on Install. It will create a folder named FixPolicies on your desktop.
Open the FixPolicies folder.
Double click on Fix_policies.cmd to run it. Command Prompt will open and close quickly; this is normal.

MaineJane · Sep 4, 2009

no luck in Normal Mode

During that last boot into Normal Mode, I got the WinXP splash screen, and then the system just hung for two minutes with no disk activity. I shut the computer off with the power button.

Upon powering up, I was presented with my boot menu (Linux or Windows), chose Windows, and then I got the message that Windows was shut down improperly, and chose the option to boot from the last known good configuration.

It, by all appearances, booted normally, I logged into my account. Still no connecting to wireless router.

Neither of those two programs you referred me to would run. I get the "Windows cannot access the specified device, path, or file. You may not have appropriate permissions to access this item." message.

Would it be worth trying these in Safe Mode, or would that not be applicable?

MaineJane · Sep 4, 2009

Safe Mode?

I have to step out for a couple of hours.

I'm suspecting that just about any new program that I try to run in Normal Mode is going to run into that error, while there have been occasions where I have been able to run newly downloaded programs in Safe Mode instead.

I'll check in when I get back.

MaineJane · Sep 4, 2009

unsolvable?

So that's the end of it? Throw me a bone here.

Are you gone for the Holiday Weekend? I can dig that.

katana · Sep 4, 2009

MaineJane said:
So that's the end of it? Throw me a bone here.

No, but I do have my own life to live as well.

MaineJane said:
Neither of those two programs you referred me to would run. I get the "Windows cannot access the specified device, path, or file. You may not have appropriate permissions to access this item." message.

Right click on the files and select Properties
Is there an UnBlock button near the bottom ?

MaineJane · Sep 5, 2009

>No, but I do have my own life to live as well.

I appreciate that.

I don't mean to sound like an ingrate.

there is no "unblock" option..

Thanks

katana · Sep 5, 2009

I notice in the Combofix log you posted

c:\windows\system32\GroupPolicy

Did you try to alter the group policies, or is this something the infection did ?

MaineJane · Sep 5, 2009

Yes, I attempted to change the group policies...per a suggestion to another user with a near identical problem (in a thread in a Major Geeks forum), before I joined this forum.

I didn't see anything in the editor that was worth changing.

MaineJane · Sep 5, 2009

Shall I?

Attempt to run those programs in Safe Mode?

XP - New Topic "Windows cannot access the specified..." log

New member

Security Expert-Emeritus

New member

New member

New member

Security Expert-Emeritus

New member

New member

Security Expert-Emeritus

New member

New member

Security Expert-Emeritus

New member

New member

New member

Security Expert-Emeritus

New member

Security Expert-Emeritus

New member

New member