Command Prompt Error

garfield619garfield619 Philippines New
edited May 2008 in Spyware & Virus Removal
Hello! someone instructed me to go to this forum topic, from the HARDWARE threads. When i use start>run>cmd = CMD would open. But in my case, when opening cmd a PC shutdown error that countdowns to 1 second pops with command prompt. it automaticaly shut downs my PC.

and a side question- my USB wont open. in repair centers is there any way they could retrieve my files, they are office files of my mom so its kinda important. As usual, I would be expecting replies!! (my PC has tons of problems T__T) THANKIES!

Comments

  • garfield619garfield619 Philippines New
    edited April 2008
    Sorry for the double post, forgot the Hijack this log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:32:45 AM, on 4/29/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\password_viewer.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\VIA\RAID\raid_tool.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\VM303_STI.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    E:\password_viewer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    F2 - REG:system.ini: UserInit=userinit.exe,password_viewer.exe
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Encarta Web Companion Helper Object - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O3 - Toolbar: Encarta Web Companion - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
    O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Download all with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Download selected with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Download video with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dlfvideo.htm
    O8 - Extra context menu item: Download with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dllink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
    O16 - DPF: {4C68DACE-E6BC-4650-9C7E-D036720CA729} (Nps Control) - http://kr.gameguard.nprotect.com/inca/onscan//tyscan/nps.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202230686937
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    --
    End of file - 9523 bytes
  • ThomasThomas
    edited May 2008
    Hello garfield619,

    I got curious why you had received a reply but no further activity (the thread shows a reply posted) so checked in here, and now see it was your own second posting instead. The system has a type of autorun infection showing here. If you have not yet resolved the issues do the following scan now.

    A mention - you have that Megaupload Toolbar installed. See here for more info on why it is not considered a keeper. Uninstalls through Add/Remove Programs if you choose to do that.


    To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs.


    Download Deckard's System Scanner (dss.exe) to your Desktop. Note: You must be logged onto an account with administrator privileges.

    Making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button (if the "Uncheck All" button shows, click that, then click "Check All"). Next, Under Main Log, uncheck the following:

    System Restore
    Temp Cleanup
    Process Modules

    Then under Options, place a check next to the following:

    Backup Registry Hives

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here (main.txt). Also a second text file, extra.txt, will show as minimized in your Task Bar. Maximize/Open this, and copy/paste those contents back here along with the main.txt please. (The logs can also be found in the C:\Deckard\System Scanner folder)

    You can use extra posts here if needed for that.
  • garfield619garfield619 Philippines New
    edited May 2008
    sorry about that, but too late, i already reformated my PC cause it is getting errors, lots of random errors. But i have learned a lesson about double posting XD. i forgot about the "edit" link. sorry!
  • ThomasThomas
    edited May 2008
    Appreciate you posting back the update. If you used any external drives (ie. flash/thumb) to save data prior to the reformat, and then transferred info back after the new install, slim chance re-infection could occur. Feel free to do the Deckards steps still if you did use those that way.
  • garfield619garfield619 Philippines New
    edited May 2008
    Thomas, yup the virus is back. i would be doing the deckard's right now. i would be posting the logs. So here they Are: 1.) HijackThis 2.)Extra

    HijackThis (main.txt): -- HijackThis Clone

    Emulating logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2008-05-21 13:16:51
    Platform: Windows XP Service Pack 3 (5.01.2600)
    MSIE: Internet Explorer (7.00.6000.16640)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\system32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\ESET\nod32krn.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\password_viewer.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\WINDOWS\soundman.exe
    C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\My Computer\Desktop\dss.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.icrontic.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    F2 - REG:system.ini: UserInit=userinit.exe,password_viewer.exe
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickFix] D:\\QuickFix.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Download all with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Download selected with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Download video with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dlfvideo.htm
    O8 - Extra context menu item: Download with Free Download Manager - [URL]file://C:\Program[/URL] Files\Free Download Manager\dllink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_05) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?AuthParam=1209994629_2857e0e3fefb5557215fed4fdef1aaec&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\ESET\nod32krn.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 8155 bytes
    -- File Associations
    .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*

    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R0 giveio - c:\windows\system32\giveio.sys
    R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe

    -- Device Manager: Disabled
    No disabled devices found.

    -- Files created between 2008-04-21 and 2008-05-21
    2008-05-21 07:15:02 0 d--h
    C:\Documents and Settings\My Computer\Application Data\ijjigame
    2008-05-21 07:14:12 704512 --a
    C:\WINDOWS\system32\ijjiSetup.exe <Not Verified; NHN USA; ijjiSetup Application>
    2008-05-21 07:14:12 0 d
    C:\Program Files\NHN USA
    2008-05-21 07:11:21 0 d
    C:\Documents and Settings\My Computer\Application Data\Xfire
    2008-05-21 07:11:18 0 d---s---- C:\Program Files\Xfire
    2008-05-21 07:07:09 0 d
    C:\ijji
    2008-05-17 00:45:16 0 dr-h
    C:\Documents and Settings\My Computer\Recent
    2008-05-15 00:56:42 0 d
    C:\WINDOWS\Prefetch
    2008-05-15 00:50:37 0 d
    C:\WINDOWS\system32\scripting
    2008-05-15 00:50:36 0 d
    C:\WINDOWS\system32\en
    2008-05-15 00:50:36 0 d
    C:\WINDOWS\l2schemas
    2008-05-15 00:50:35 0 d
    C:\WINDOWS\system32\bits
    2008-05-15 00:47:39 0 d
    C:\WINDOWS\ServicePackFiles
    2008-05-15 00:45:09 0 d
    C:\WINDOWS\network diagnostic
    2008-05-15 00:42:37 0 d
    C:\WINDOWS\system32\ReinstallBackups
    2008-05-14 23:25:38 0 d
    C:\Program Files\SystemRequirementsLab
    2008-05-14 21:54:35 0 d
    C:\Program Files\Warcraft
    2008-05-14 19:19:34 0 d
    C:\Program Files\NetGames
    2008-05-14 02:19:17 30 -rahs---- C:\WINDOWS\pc-off.bat
    2008-05-14 02:19:16 232105 -rahs---- C:\WINDOWS\password_viewer.exe
    2008-05-13 03:00:58 0 d
    C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-05-13 02:02:59 0 d
    C:\Program Files\Hewlett-Packard
    2008-05-12 22:43:42 0 d
    C:\Program Files\Lavalys
    2008-05-12 21:20:02 0 d
    C:\Documents and Settings\My Computer\Application Data\Adobe
    2008-05-12 21:19:07 0 d
    C:\Documents and Settings\All Users\Application Data\Adobe
    2008-05-12 21:19:00 0 d
    C:\Program Files\Common Files\Adobe
    2008-05-12 02:16:34 0 d
    C:\WINDOWS\system32\XPSViewer
    2008-05-12 02:16:29 0 d
    C:\Program Files\Reference Assemblies
    2008-05-12 02:13:20 0 d
    C:\Program Files\MSXML 6.0
    2008-05-10 22:26:09 3145728 --a
    C:\Documents and Settings\My Computer\ntuser.dat
    2008-05-10 22:26:09 229376 --a
    C:\Documents and Settings\LocalService\ntuser.dat
    2008-05-09 22:47:15 0 d
    C:\Documents and Settings\My Computer\Application Data\Image Zone Express
    2008-05-09 18:50:22 0 d
    C:\Documents and Settings\All Users\Application Data\HP
    2008-05-09 18:50:05 0 d
    C:\Program Files\Common Files\HP
    2008-05-09 18:47:32 0 d
    C:\Program Files\Common Files\Hewlett-Packard
    2008-05-09 18:46:52 57344 --a
    C:\WINDOWS\system32\HPZisn12.dll <Not Verified; HP; HP SNMP Windows>
    2008-05-09 18:46:52 94208 --a
    C:\WINDOWS\system32\HPZipt12.dll <Not Verified; HP; HP SNMP Windows>
    2008-05-09 18:46:52 204800 --a
    C:\WINDOWS\system32\HPZipr12.dll <Not Verified; HP; HP PmlRtl>
    2008-05-09 18:46:52 69632 --a
    C:\WINDOWS\system32\HPZipm12.exe <Not Verified; HP; HP PML>
    2008-05-09 18:46:52 61440 --a
    C:\WINDOWS\system32\HPZinw12.exe <Not Verified; HP; HP Dot4Net Windows>
    2008-05-09 18:46:52 278584 --a
    C:\WINDOWS\system32\HPZidr12.dll <Not Verified; HP; HP Dot4Rtl>
    2008-05-09 18:46:48 306688 --a
    C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
    2008-05-09 18:40:52 0 d
    C:\Program Files\HP
    2008-05-09 18:37:21 112054 --a
    C:\WINDOWS\hpoins07.dat
    2008-05-09 18:37:20 21124
    n--- C:\WINDOWS\hpomdl07.dat
    2008-05-09 18:37:13 0 d
    C:\Documents and Settings\My Computer\Application Data\HP
    2008-05-08 21:21:22 0 d
    C:\Documents and Settings\My Computer\Application Data\LimeWire
    2008-05-08 21:21:12 0 d
    C:\Program Files\LimeWire
    2008-05-07 10:23:25 0 d
    C:\Program Files\Garena
    2008-05-07 03:04:11 0 d
    C:\Program Files\MSXML 4.0
    2008-05-06 22:19:59 0 d
    C:\Program Files\CCleaner
    2008-05-06 17:56:09 0 d
    C:\Documents and Settings\My Computer\Application Data\DVD Flick
    2008-05-06 16:55:05 0 d
    C:\Documents and Settings\All Users\Application Data\LightScribe
    2008-05-06 13:43:03 0 d
    C:\WINDOWS\system32\PreInstall
    2008-05-06 11:01:27 0 d
    C:\WINDOWS\system32\SoftwareDistribution
    2008-05-06 09:53:57 4682 --a
    C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
    2008-05-06 09:48:39 0 d
    C:\Program Files\Common Files\INCA Shared
    2008-05-06 09:03:38 73728 --a
    C:\WINDOWS\system32\GkSui18.EXE
    2008-05-06 09:03:38 69632 --a
    C:\WINDOWS\system32\Copy of GkSui18.EXE
    2008-05-06 07:48:12 0 --a
    C:\WINDOWS\nsreg.dat
    2008-05-06 07:48:07 0 d
    C:\Documents and Settings\My Computer\Application Data\Mozilla
    2008-05-06 07:27:21 0 d
    C:\Program Files\SpeedFan
    2008-05-06 07:25:33 65536 --a
    C:\WINDOWS\IFinst27.exe
    2008-05-06 03:07:53 0 d
    C:\Program Files\Dragonfly
    2008-05-06 03:07:35 0 d
    C:\Documents and Settings\My Computer\Application Data\InstallShield
    2008-05-06 01:52:34 0 d--hs---- C:\WINDOWS\Installer
    2008-05-06 01:52:33 0 d
    C:\Program Files\Common Files\ODBC
    2008-05-06 01:52:30 0 d
    C:\Program Files\Common Files\SpeechEngines
    2008-05-06 01:52:29 0 dr
    C:\Program Files
    2008-05-06 01:52:29 0 d
    C:\Program Files\Common Files
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\Templates
    2008-05-06 01:52:06 0 dr
    C:\Documents and Settings\Default User\Start Menu
    2008-05-06 01:52:06 0 dr-h
    C:\Documents and Settings\Default User\SendTo
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\Recent
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\PrintHood
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\NetHood
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\Default User\My Documents
    2008-05-06 01:52:06 0 dr-h
    C:\Documents and Settings\Default User\Local Settings
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\Default User\Favorites
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\Default User\Desktop
    2008-05-06 01:52:06 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\All Users\Templates
    2008-05-06 01:52:06 0 dr
    C:\Documents and Settings\All Users\Start Menu
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\All Users\Favorites
    2008-05-06 01:52:06 0 dr
    C:\Documents and Settings\All Users\Documents
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\All Users\Desktop
    2008-05-06 01:51:53 0 d
    C:\WINDOWS\system32\CatRoot2
    2008-05-06 01:51:53 0 d
    C:\WINDOWS\system32\CatRoot
    2008-05-06 01:51:48 0 dr-h
    C:\Documents and Settings\Default User\Application Data
    2008-05-06 01:51:48 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-05-06 01:51:47 0 dr-h
    C:\Documents and Settings\All Users\Application Data
    2008-05-06 01:51:47 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-05-06 01:51:27 0 d--hs---- C:\System Volume Information
    2008-05-06 01:51:27 0 d
    C:\Documents and Settings
    2008-05-06 01:45:51 0 d
    C:\WINDOWS
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\WinSxS
    2008-05-06 01:45:51 0 dr
    C:\WINDOWS\Web
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\twain_32
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\wins
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\wbem
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\usmt
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\spool
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\ShellExt
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\Setup
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\ras
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\oobe
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\npp
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\mui
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\inetsrv
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\IME
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\icsxml
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\ias
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\export
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\drivers
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\drivers\etc
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\drivers\disdn
    2008-05-06 01:45:51 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\dhcp
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\config
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\3com_dmi
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\3076
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\2052
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1054
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1042
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1041
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1037
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1033
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1031
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1028
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1025
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\security
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Resources
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\repair
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Provisioning
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\PeerNet
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\pchealth
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\mui
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\msapps
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\msagent
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Media
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\java
    2008-05-06 01:45:51 0 d--h
    C:\WINDOWS\inf
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\ime
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Help
    2008-05-06 01:45:51 0 dr--s---- C:\WINDOWS\Fonts
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\ehome
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Driver Cache
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Debug
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Cursors
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Connection Wizard
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Config
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\AppPatch
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\addins
    2008-05-06 01:08:55 0 d
    C:\Program Files\Common Files\LightScribe
    2008-05-06 01:07:34 0 d
    C:\Documents and Settings\My Computer\Application Data\Ahead
    2008-05-06 01:06:06 0 d
    C:\Documents and Settings\All Users\Application Data\Ahead
    2008-05-06 01:00:42 0 d
    C:\Program Files\Nero
    2008-05-06 01:00:42 0 d
    C:\Program Files\Common Files\Ahead
    2008-05-06 01:00:42 0 d
    C:\Documents and Settings\All Users\Application Data\Nero
    2008-05-05 23:18:11 0 d
    C:\WINDOWS\.jagex_cache_32
    2008-05-05 23:10:23 0 d
    C:\WINDOWS\Sun
    2008-05-05 23:10:23 0 d
    C:\Documents and Settings\My Computer\Application Data\Sun
    2008-05-05 22:13:39 0 d
    C:\Program Files\Java
    2008-05-05 21:54:06 0 d
    C:\Program Files\Common Files\Java
    2008-05-05 21:31:42 0 d
    C:\Downloads
    2008-05-05 21:30:15 0 d
    C:\Documents and Settings\My Computer\Application Data\Free Download Manager
    2008-05-05 21:30:11 0 d
    C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
    2008-05-05 21:30:09 0 d
    C:\Program Files\Free Download Manager
    2008-05-05 20:55:57 0 d
    C:\Documents and Settings\My Computer\Application Data\Yahoo!
    2008-05-05 20:55:57 0 d
    C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-05-05 19:53:04 0 d
    C:\Program Files\Activision
    2008-05-05 19:51:04 0 d--hs---- C:\WINDOWS\ftpcache
    2008-05-05 19:46:16 0 d
    C:\Program Files\Windows Media Connect 2
    2008-05-05 19:45:06 0 d
    C:\WINDOWS\system32\LogFiles
    2008-05-05 19:45:06 0 d
    C:\WINDOWS\system32\drivers\UMDF
    2008-05-05 19:21:33 0 d
    C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-05-05 19:20:40 0 d
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-05-05 19:18:04 0 d
    C:\Documents and Settings\My Computer\Application Data\WinRAR
    2008-05-05 19:15:42 49152 --a
    C:\WINDOWS\system32\ChCfg.exe
    2008-05-05 19:15:16 0 d
    C:\Program Files\Realtek AC97
    2008-05-05 19:15:11 315392 --a
    C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Update driver Tool>
    2008-05-05 19:15:11 0 d--h
    C:\Program Files\InstallShield Installation Information
    2008-05-05 18:56:35 0 d--h
    C:\WINDOWS\$hf_mig$
    2008-05-05 18:53:09 0 d
    C:\Program Files\Microsoft Works
    2008-05-05 18:53:00 0 d
    C:\Program Files\MSBuild
    2008-05-05 18:48:08 0 d
    C:\WINDOWS\SHELLNEW
    2008-05-05 18:46:48 0 d
    C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-05 18:46:16 0 dr-h
    C:\MSOCache
    2008-05-05 18:23:05 0 d
    C:\Documents and Settings\My Computer\Application Data\Macromedia
    2008-05-05 18:12:24 0 d
    C:\WINDOWS\nview
    2008-05-05 18:11:23 0 d
    C:\Program Files\Common Files\InstallShield
    2008-05-05 18:09:10 0 d
    C:\Documents and Settings\My Computer\Application Data\PC Tools
    2008-05-05 18:08:50 0 d-a
    C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-05 18:08:49 0 d
    C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-05-05 18:08:43 299392 --a
    C:\WINDOWS\system32\imon.dll <Not Verified; Eset; NOD32 Antivirus System>
    2008-05-05 18:08:40 0 d
    C:\Program Files\Common Files\PC Tools
    2008-05-05 18:08:35 0 d
    C:\Program Files\PC Tools AntiVirus
    2008-05-05 18:08:35 0 d
    C:\Documents and Settings\All Users\Application Data\PC Tools
    2008-05-05 18:08:14 0 d
    C:\Program Files\Yahoo!
    2008-05-05 18:06:08 0 d
    C:\Documents and Settings\My Computer\Application Data\Identities
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\Templates
    2008-05-05 18:06:02 0 dr
    C:\Documents and Settings\My Computer\Start Menu
    2008-05-05 18:06:02 0 dr-h
    C:\Documents and Settings\My Computer\SendTo
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\PrintHood
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\NetHood
    2008-05-05 18:06:02 0 dr
    C:\Documents and Settings\My Computer\My Documents
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\Local Settings
    2008-05-05 18:06:02 0 dr
    C:\Documents and Settings\My Computer\Favorites
    2008-05-05 18:06:02 0 d
    C:\Documents and Settings\My Computer\Desktop
    2008-05-05 18:06:02 0 d--hs---- C:\Documents and Settings\My Computer\Cookies
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\Application Data
    2008-05-05 18:05:15 0 d
    C:\WINDOWS\SoftwareDistribution
    2008-05-05 18:05:06 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-05-05 18:05:05 0 d--h
    C:\Documents and Settings\LocalService\Local Settings
    2008-05-05 18:05:05 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-05-05 18:05:05 0 d
    C:\Documents and Settings\LocalService\Application Data
    2008-05-05 18:05:05 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-05-05 18:04:46 225280 --a
    C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-05-05 18:04:46 0 d--h
    C:\Documents and Settings\NetworkService\Local Settings
    2008-05-05 18:04:46 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
    2008-05-05 18:04:46 0 d
    C:\Documents and Settings\NetworkService\Application Data
    2008-05-05 18:04:46 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-05-05 18:01:53 0 d
    C:\WINDOWS\system32\xircom
    2008-05-05 18:01:53 0 d
    C:\Program Files\microsoft frontpage
    2008-05-05 18:01:39 225280 ---h
    C:\Documents and Settings\Default User\NTUSER.DAT
    2008-05-05 18:01:34 0 -rahs---- C:\MSDOS.SYS
    2008-05-05 18:01:34 0 -rahs---- C:\IO.SYS
    2008-05-05 18:01:34 0 --a
    C:\CONFIG.SYS
    2008-05-05 18:01:34 0 --a
    C:\AUTOEXEC.BAT
    2008-05-05 18:00:18 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-05-05 18:00:08 0 dr
    C:\WINDOWS\Offline Web Pages
    2008-05-05 18:00:08 0 d---s---- C:\WINDOWS\Downloaded Program Files
    2008-05-05 17:59:57 0 d--h
    C:\Program Files\WindowsUpdate
    2008-05-05 17:59:37 0 d
    C:\WINDOWS\system32\DirectX
    2008-05-05 17:59:06 0 d---s---- C:\WINDOWS\Tasks
    2008-05-05 17:59:05 0 d
    C:\Program Files\Common Files\MSSoap
    2008-05-05 17:59:02 0 d
    C:\WINDOWS\system32\Macromed
    2008-05-05 17:59:02 0 d
    C:\WINDOWS\srchasst
    2008-05-05 17:58:54 0 d
    C:\Program Files\Movie Maker
    2008-05-05 17:58:48 0 d
    C:\WINDOWS\system32\Restore
    2008-05-05 17:58:11 21640 --a
    C:\WINDOWS\system32\emptyregdb.dat
    2008-05-05 17:57:55 0 d
    C:\WINDOWS\Registration
    2008-05-05 17:57:48 0 d
    C:\Program Files\Online Services
    2008-05-05 17:57:42 0 d
    C:\Program Files\Messenger
    2008-05-05 17:57:38 0 d
    C:\Program Files\MSN Gaming Zone
    2008-05-05 17:57:03 0 d
    C:\Program Files\Windows NT
    2008-05-05 17:57:00 0 d
    C:\WINDOWS\system32\MsDtc
    2008-05-05 17:56:59 0 d
    C:\WINDOWS\system32\Com

    -- Find3M Report
    2008-05-12 22:23:33 73014 --a
    C:\Documents and Settings\My Computer\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
    2008-05-12 22:22:34 2145 --a
    C:\Documents and Settings\My Computer\Application Data\HPSU_48BitScanUpdate.log
    2008-05-12 22:15:51 169176 --a
    C:\Documents and Settings\My Computer\Application Data\Update_HP_RedboxHprblog_HPSU.log
    2008-05-06 01:52:06 62 --ahs---- C:\Documents and Settings\My Computer\Application Data\desktop.ini

    -- Registry Dump
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\A system shutdown is in progress.]
    A system shutdown is in progress.
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "A system shutdown is in progress."= A system shutdown is in progress. [ ]
    [HKEY_CLASSES_ROOT\CLSID\A system shutdown is in progress.]


    -- End of Deckard's System Scanner: finished at 2008-05-21 13:20:42




    Extra by DSS:

    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.
    -- System Information
    Microsoft Windows XP Professional (build 2600) SP 3.0
    Architecture: X86; Language: English
    CPU 0: AMD Sempron(tm) Processor 2800+
    Percentage of Memory in Use: 39%
    Physical Memory (total/avail): 1278.42 MiB / 774.02 MiB
    Pagefile Memory (total/avail): 3687.51 MiB / 3362.77 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1877.85 MiB
    C: is Fixed (NTFS) - 27.35 GiB total, 7.4 GiB free.
    D: is Fixed (NTFS) - 9.95 GiB total, 8.21 GiB free.
    E: is CDROM (No Media)
    [URL="file://\\.\PHYSICALDRIVE0"]\\.\PHYSICALDRIVE0[/URL] - SAMSUNG SP0411N - 37.31 GiB - 2 partitions
    \PARTITION0 (bootable) - Installable File System - 27.35 GiB - C:
    \PARTITION1 - Extended w/Extended Int 13 - 9.95 GiB - D:

    -- Security Center
    AUOptions is scheduled to auto-install.

    -- Environment Variables

    -- User Profiles
    My Computer (admin)

    -- Add/Remove Programs

    -- Application Event Log
    Event Record #/Type2153 / Error
    Event Submitted/Written: 05/21/2008 01:17:29 PM
    Event ID/Source: 8 / crypt32
    Event Description:
    Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.
    Event Record #/Type2152 / Error
    Event Submitted/Written: 05/21/2008 01:17:28 PM
    Event ID/Source: 8 / crypt32
    Event Description:
    Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.
    Event Record #/Type2151 / Error
    Event Submitted/Written: 05/21/2008 01:17:26 PM
    Event ID/Source: 8 / crypt32
    Event Description:
    Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This operation returned because the timeout period expired.
    Event Record #/Type2149 / Warning
    Event Submitted/Written: 05/21/2008 04:40:26 AM
    Event ID/Source: 1001 / MsiInstaller
    Event Description:
    Detection of product '{69EF2652-2DEC-40B6-A822-BF4DCB027099}', feature '_MainFeature' failed during request for component '{397D101B-A762-11D2-B97E-006097C4DE24}'
    Event Record #/Type2148 / Warning
    Event Submitted/Written: 05/21/2008 04:40:26 AM
    Event ID/Source: 1004 / MsiInstaller
    Event Description:
    Detection of product '{69EF2652-2DEC-40B6-A822-BF4DCB027099}', feature '_MainFeature', component '{1A1D6306-2198-4850-B7B5-86AA16DE6155}' failed. The resource 'D:\wbemdisp.tlb' does not exist.

    -- Security Event Log
    No Errors/Warnings found.

    -- System Event Log
    Event Record #/Type5429 / Warning
    Event Submitted/Written: 05/21/2008 04:39:44 AM
    Event ID/Source: 1003 / Dhcp
    Event Description:
    Your computer was not able to renew its address from the network (from the
    DHCP Server) for the Network Card with network address 00E04CF2CEB9. The following
    error occurred:
    %%121.
    Your computer will continue to try and obtain an address on its own from
    the network address (DHCP) server.
    Event Record #/Type5114 / Warning
    Event Submitted/Written: 05/20/2008 10:01:01 PM
    Event ID/Source: 4226 / Tcpip
    Event Description:
    TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
    Event Record #/Type4820 / Error
    Event Submitted/Written: 05/20/2008 06:52:14 PM
    Event ID/Source: 11 / Cdrom
    Event Description:
    The driver detected a controller error on \Device\CdRom0.
    Event Record #/Type4816 / Error
    Event Submitted/Written: 05/20/2008 06:51:49 PM
    Event ID/Source: 11 / Cdrom
    Event Description:
    The driver detected a controller error on \Device\CdRom0.
    Event Record #/Type4815 / Error
    Event Submitted/Written: 05/20/2008 06:51:17 PM
    Event ID/Source: 11 / Cdrom
    Event Description:
    The driver detected a controller error on \Device\CdRom0.

    -- End of Deckard's System Scanner: finished at 2008-05-21 13:20:42
  • ThomasThomas
    edited May 2008
    I hadn't seen this before - do you know what caused your registry to be read with these shutdown comments inserted instead of data?

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\A system shutdown is in progress.]
    A system shutdown is in progress.
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "A system shutdown is in progress."= A system shutdown is in progress. [ ]
    [HKEY_CLASSES_ROOT\CLSID\A system shutdown is in progress.]
  • garfield619garfield619 Philippines New
    edited May 2008
    i event dont know... i have searched some forums but mine is really totally different. Is there any way to remove or fix this?
  • ThomasThomas
    edited May 2008
    Just a mention - folks of all ages and walks of life review the threads in the forum, so maybe a less graphic word choice in your sig humor might be better (even with the missing vowel).


    Let's assume the malware if involved with that for now.

    Open HijackThis, and choose None of the above, just start the program. Click Config – Misc Tools – Open process manager. From the list, click each of the following if it is present, and Kill Process. Close HijackThis.

    C:\WINDOWS\password_viewer.exe

    Close Internet Explorer and all running programs and run a scan in HijackThis. Place a check next to all of the following lines, then select “Fix Checked” and close HijackThis.

    F2 - REG:system.ini: UserInit=userinit.exe,password_viewer.exe

    Download OTMoveIt2 by OldTimer to your desktop.

    Then click OTMoveIt2.exe to run it (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator").

    Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C, or right-click and choose Copy):
    C:\WINDOWS\pc-off.bat
C:\WINDOWS\password_viewer.exe

    Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window and select Paste. Then click the red MoveIt! button. A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder, in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.

    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose "Yes".

    Then locate those moved files just stored by OTMoveIt - go to the folder just created that will appear like this:

    C:\_OTMoveIt\MovedFiles\"mmddyyyy_hhmmss"

    In that folder will be a "WINDOWS" folder with those file copies.

    Then go here, press new topic, fill in the needed details and just give a link to your post back here. Then press the browse button and then navigate to & select that "Windows" folder on your computer.

    You DO NOT need to be a member to upload, anybody can upload the files. You will not be able to see the file once uploaded. If you are unable to locate the file on your system that is okay - just move to the next steps.

    Then go here and run the Kaspersky online scan, and post back the log it creates (it requires IE).

    To use the scan, accept the agreement and make sure you allow the ActiveX object to download and install (check the "yellow bar" at the top of IE if needed to allow this). Once the download has completed click Next, then Scan Settings, then make sure the "extended option" is checked (leave all others as they are) and click OK. Then click "My Computer" to begin the scan. Save the Report as a text file and post that back here.

    To save it as a text file, still with the page in Internet Explorer, go to the top of the page and select File - Save As... Then make sure in the "Save as type" drop down you change it to "Text File(*.txt)".

    Then still making sure dss.exe is directly on your desktop, go to Start - Run, and copy/paste the following (then press OK):

    "%userprofile%\desktop\dss.exe" /config

    When the DSS Configuration display opens click the "Check All" button. Next, under Main Log, again uncheck the following:

    System Restore
    Temp Cleanup
    Process Modules

    Then under Extra Log, uncheck all the boxes.

    Don't make any other changes at this time. Then click the "Scan!" button to start the scan.

    Once the scan has completed a textbox will appear - copy/paste those contents back here please (main.txt). (The logs can also be found in the C:\Deckard\System Scanner folder)

    Post that along with the Kaspersky log please.
  • garfield619garfield619 Philippines New
    edited May 2008
    About the sig, Removed it already, srry about it :bigggrin:.

    Back to the Logs, and about the file upload, the WINDOWS folder was blank. no files were found.


    HijackThis (main.txt):

    Deckard's System Scanner v20071014.68
    Run by My Computer on 2008-05-22 19:28:37
    Computer is in Normal Mode.

    -- HijackThis (run as My Computer.exe)
    Logfile of HijackThis v1.99.1
    Scan saved at 7:28:46 PM, on 5/22/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Eset\nod32kui.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\ijji\ENGLISH\u_gunz.exe
    C:\Documents and Settings\My Computer\desktop\dss.exe
    C:\PROGRA~1\HIJACK~1\My Computer.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [QuickFix] D:\\QuickFix.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?AuthParam=1209994629_2857e0e3fefb5557215fed4fdef1aaec&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    -- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\)
    backup-20080522-150511-761 F2 - REG:system.ini: UserInit=userinit.exe,password_viewer.exe
    -- File Associations
    .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*

    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    R0 giveio - c:\windows\system32\giveio.sys
    R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>

    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled
    S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe

    -- Device Manager: Disabled
    No disabled devices found.

    -- Files created between 2008-04-22 and 2008-05-22
    2008-05-22 15:16:43 0 d
    C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-05-22 15:16:41 0 d
    C:\WINDOWS\system32\Kaspersky Lab
    2008-05-22 15:16:37 0 d
    C:\WINDOWS\LastGood
    2008-05-21 23:16:41 0 d
    C:\Program Files\NHN USA
    2008-05-21 23:16:41 0 d
    C:\Documents and Settings\My Computer\Application Data\Xfire
    2008-05-21 23:16:14 0 dr-h
    C:\Documents and Settings\My Computer\Recent
    2008-05-21 07:15:02 0 d--h
    C:\Documents and Settings\My Computer\Application Data\ijjigame
    2008-05-21 07:14:12 704512 --a
    C:\WINDOWS\system32\ijjiSetup.exe <Not Verified; NHN USA; ijjiSetup Application>
    2008-05-21 07:11:18 0 d---s---- C:\Program Files\Xfire
    2008-05-21 07:07:09 0 d
    C:\ijji
    2008-05-15 00:56:42 0 d
    C:\WINDOWS\Prefetch
    2008-05-15 00:50:37 0 d
    C:\WINDOWS\system32\scripting
    2008-05-15 00:50:36 0 d
    C:\WINDOWS\system32\en
    2008-05-15 00:50:36 0 d
    C:\WINDOWS\l2schemas
    2008-05-15 00:50:35 0 d
    C:\WINDOWS\system32\bits
    2008-05-15 00:47:39 0 d
    C:\WINDOWS\ServicePackFiles
    2008-05-15 00:45:09 0 d
    C:\WINDOWS\network diagnostic
    2008-05-15 00:42:37 0 d
    C:\WINDOWS\system32\ReinstallBackups
    2008-05-14 23:25:38 0 d
    C:\Program Files\SystemRequirementsLab
    2008-05-14 21:54:35 0 d
    C:\Program Files\Warcraft
    2008-05-14 19:19:34 0 d
    C:\Program Files\NetGames
    2008-05-13 03:00:58 0 d
    C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-05-13 02:02:59 0 d
    C:\Program Files\Hewlett-Packard
    2008-05-12 22:43:42 0 d
    C:\Program Files\Lavalys
    2008-05-12 21:20:02 0 d
    C:\Documents and Settings\My Computer\Application Data\Adobe
    2008-05-12 21:19:07 0 d
    C:\Documents and Settings\All Users\Application Data\Adobe
    2008-05-12 21:19:00 0 d
    C:\Program Files\Common Files\Adobe
    2008-05-12 02:16:34 0 d
    C:\WINDOWS\system32\XPSViewer
    2008-05-12 02:16:29 0 d
    C:\Program Files\Reference Assemblies
    2008-05-12 02:13:20 0 d
    C:\Program Files\MSXML 6.0
    2008-05-10 22:26:09 3145728 --a
    C:\Documents and Settings\My Computer\ntuser.dat
    2008-05-10 22:26:09 229376 --a
    C:\Documents and Settings\LocalService\ntuser.dat
    2008-05-09 22:47:15 0 d
    C:\Documents and Settings\My Computer\Application Data\Image Zone Express
    2008-05-09 18:50:22 0 d
    C:\Documents and Settings\All Users\Application Data\HP
    2008-05-09 18:50:05 0 d
    C:\Program Files\Common Files\HP
    2008-05-09 18:47:32 0 d
    C:\Program Files\Common Files\Hewlett-Packard
    2008-05-09 18:46:52 57344 --a
    C:\WINDOWS\system32\HPZisn12.dll <Not Verified; HP; HP SNMP Windows>
    2008-05-09 18:46:52 94208 --a
    C:\WINDOWS\system32\HPZipt12.dll <Not Verified; HP; HP SNMP Windows>
    2008-05-09 18:46:52 204800 --a
    C:\WINDOWS\system32\HPZipr12.dll <Not Verified; HP; HP PmlRtl>
    2008-05-09 18:46:52 69632 --a
    C:\WINDOWS\system32\HPZipm12.exe <Not Verified; HP; HP PML>
    2008-05-09 18:46:52 61440 --a
    C:\WINDOWS\system32\HPZinw12.exe <Not Verified; HP; HP Dot4Net Windows>
    2008-05-09 18:46:52 278584 --a
    C:\WINDOWS\system32\HPZidr12.dll <Not Verified; HP; HP Dot4Rtl>
    2008-05-09 18:46:48 306688 --a
    C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
    2008-05-09 18:40:52 0 d
    C:\Program Files\HP
    2008-05-09 18:37:21 112054 --a
    C:\WINDOWS\hpoins07.dat
    2008-05-09 18:37:20 21124
    n--- C:\WINDOWS\hpomdl07.dat
    2008-05-09 18:37:13 0 d
    C:\Documents and Settings\My Computer\Application Data\HP
    2008-05-08 21:21:22 0 d
    C:\Documents and Settings\My Computer\Application Data\LimeWire
    2008-05-08 21:21:12 0 d
    C:\Program Files\LimeWire
    2008-05-07 10:23:25 0 d
    C:\Program Files\Garena
    2008-05-07 03:04:11 0 d
    C:\Program Files\MSXML 4.0
    2008-05-06 22:19:59 0 d
    C:\Program Files\CCleaner
    2008-05-06 17:56:09 0 d
    C:\Documents and Settings\My Computer\Application Data\DVD Flick
    2008-05-06 16:55:05 0 d
    C:\Documents and Settings\All Users\Application Data\LightScribe
    2008-05-06 13:43:03 0 d
    C:\WINDOWS\system32\PreInstall
    2008-05-06 11:01:27 0 d
    C:\WINDOWS\system32\SoftwareDistribution
    2008-05-06 09:53:57 4682 --a
    C:\WINDOWS\system32\npptNT2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT>
    2008-05-06 09:48:39 0 d
    C:\Program Files\Common Files\INCA Shared
    2008-05-06 09:03:38 73728 --a
    C:\WINDOWS\system32\GkSui18.EXE
    2008-05-06 09:03:38 69632 --a
    C:\WINDOWS\system32\Copy of GkSui18.EXE
    2008-05-06 07:48:12 0 --a
    C:\WINDOWS\nsreg.dat
    2008-05-06 07:48:07 0 d
    C:\Documents and Settings\My Computer\Application Data\Mozilla
    2008-05-06 07:27:21 0 d
    C:\Program Files\SpeedFan
    2008-05-06 07:25:33 65536 --a
    C:\WINDOWS\IFinst27.exe
    2008-05-06 03:07:53 0 d
    C:\Program Files\Dragonfly
    2008-05-06 03:07:35 0 d
    C:\Documents and Settings\My Computer\Application Data\InstallShield
    2008-05-06 01:52:34 0 d--hs---- C:\WINDOWS\Installer
    2008-05-06 01:52:33 0 d
    C:\Program Files\Common Files\ODBC
    2008-05-06 01:52:30 0 d
    C:\Program Files\Common Files\SpeechEngines
    2008-05-06 01:52:29 0 dr
    C:\Program Files
    2008-05-06 01:52:29 0 d
    C:\Program Files\Common Files
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\Templates
    2008-05-06 01:52:06 0 dr
    C:\Documents and Settings\Default User\Start Menu
    2008-05-06 01:52:06 0 dr-h
    C:\Documents and Settings\Default User\SendTo
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\Recent
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\PrintHood
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\Default User\NetHood
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\Default User\My Documents
    2008-05-06 01:52:06 0 dr-h
    C:\Documents and Settings\Default User\Local Settings
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\Default User\Favorites
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\Default User\Desktop
    2008-05-06 01:52:06 0 d---s---- C:\Documents and Settings\Default User\Cookies
    2008-05-06 01:52:06 0 d--h
    C:\Documents and Settings\All Users\Templates
    2008-05-06 01:52:06 0 dr
    C:\Documents and Settings\All Users\Start Menu
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\All Users\Favorites
    2008-05-06 01:52:06 0 dr
    C:\Documents and Settings\All Users\Documents
    2008-05-06 01:52:06 0 d
    C:\Documents and Settings\All Users\Desktop
    2008-05-06 01:51:53 0 d
    C:\WINDOWS\system32\CatRoot2
    2008-05-06 01:51:53 0 d
    C:\WINDOWS\system32\CatRoot
    2008-05-06 01:51:48 0 dr-h
    C:\Documents and Settings\Default User\Application Data
    2008-05-06 01:51:48 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
    2008-05-06 01:51:47 0 dr-h
    C:\Documents and Settings\All Users\Application Data
    2008-05-06 01:51:47 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
    2008-05-06 01:51:27 0 d--hs---- C:\System Volume Information
    2008-05-06 01:51:27 0 d
    C:\Documents and Settings
    2008-05-06 01:45:51 0 d
    C:\WINDOWS
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\WinSxS
    2008-05-06 01:45:51 0 dr
    C:\WINDOWS\Web
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\twain_32
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\wins
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\wbem
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\usmt
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\spool
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\ShellExt
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\Setup
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\ras
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\oobe
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\npp
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\mui
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\inetsrv
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\IME
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\icsxml
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\ias
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\export
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\drivers
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\drivers\etc
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\drivers\disdn
    2008-05-06 01:45:51 0 dr-hs--c- C:\WINDOWS\system32\dllcache
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\dhcp
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\config
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\3com_dmi
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\3076
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\2052
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1054
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1042
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1041
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1037
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1033
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1031
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1028
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system32\1025
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\system
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\security
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Resources
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\repair
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Provisioning
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\PeerNet
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\pchealth
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\mui
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\msapps
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\msagent
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Media
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\java
    2008-05-06 01:45:51 0 d--h
    C:\WINDOWS\inf
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\ime
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Help
    2008-05-06 01:45:51 0 dr--s---- C:\WINDOWS\Fonts
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\ehome
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Driver Cache
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Debug
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Cursors
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Connection Wizard
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\Config
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\AppPatch
    2008-05-06 01:45:51 0 d
    C:\WINDOWS\addins
    2008-05-06 01:08:55 0 d
    C:\Program Files\Common Files\LightScribe
    2008-05-06 01:07:34 0 d
    C:\Documents and Settings\My Computer\Application Data\Ahead
    2008-05-06 01:06:06 0 d
    C:\Documents and Settings\All Users\Application Data\Ahead
    2008-05-06 01:00:42 0 d
    C:\Program Files\Nero
    2008-05-06 01:00:42 0 d
    C:\Program Files\Common Files\Ahead
    2008-05-06 01:00:42 0 d
    C:\Documents and Settings\All Users\Application Data\Nero
    2008-05-05 23:18:11 0 d
    C:\WINDOWS\.jagex_cache_32
    2008-05-05 23:10:23 0 d
    C:\WINDOWS\Sun
    2008-05-05 23:10:23 0 d
    C:\Documents and Settings\My Computer\Application Data\Sun
    2008-05-05 22:13:39 0 d
    C:\Program Files\Java
    2008-05-05 21:54:06 0 d
    C:\Program Files\Common Files\Java
    2008-05-05 21:31:42 0 d
    C:\Downloads
    2008-05-05 21:30:15 0 d
    C:\Documents and Settings\My Computer\Application Data\Free Download Manager
    2008-05-05 21:30:11 0 d
    C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG
    2008-05-05 21:30:09 0 d
    C:\Program Files\Free Download Manager
    2008-05-05 20:55:57 0 d
    C:\Documents and Settings\My Computer\Application Data\Yahoo!
    2008-05-05 20:55:57 0 d
    C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
    2008-05-05 19:53:04 0 d
    C:\Program Files\Activision
    2008-05-05 19:51:04 0 d--hs---- C:\WINDOWS\ftpcache
    2008-05-05 19:46:16 0 d
    C:\Program Files\Windows Media Connect 2
    2008-05-05 19:45:06 0 d
    C:\WINDOWS\system32\LogFiles
    2008-05-05 19:45:06 0 d
    C:\WINDOWS\system32\drivers\UMDF
    2008-05-05 19:21:33 0 d
    C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-05-05 19:20:40 0 d
    C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
    2008-05-05 19:18:04 0 d
    C:\Documents and Settings\My Computer\Application Data\WinRAR
    2008-05-05 19:15:42 49152 --a
    C:\WINDOWS\system32\ChCfg.exe
    2008-05-05 19:15:16 0 d
    C:\Program Files\Realtek AC97
    2008-05-05 19:15:11 315392 --a
    C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Update driver Tool>
    2008-05-05 19:15:11 0 d--h
    C:\Program Files\InstallShield Installation Information
    2008-05-05 18:56:35 0 d--h
    C:\WINDOWS\$hf_mig$
    2008-05-05 18:53:09 0 d
    C:\Program Files\Microsoft Works
    2008-05-05 18:53:00 0 d
    C:\Program Files\MSBuild
    2008-05-05 18:48:08 0 d
    C:\WINDOWS\SHELLNEW
    2008-05-05 18:46:48 0 d
    C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-05 18:46:16 0 dr-h
    C:\MSOCache
    2008-05-05 18:23:05 0 d
    C:\Documents and Settings\My Computer\Application Data\Macromedia
    2008-05-05 18:12:24 0 d
    C:\WINDOWS\nview
    2008-05-05 18:11:23 0 d
    C:\Program Files\Common Files\InstallShield
    2008-05-05 18:09:10 0 d
    C:\Documents and Settings\My Computer\Application Data\PC Tools
    2008-05-05 18:08:50 0 d-a
    C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-05 18:08:49 0 d
    C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-05-05 18:08:43 299392 --a
    C:\WINDOWS\system32\imon.dll <Not Verified; Eset; NOD32 Antivirus System>
    2008-05-05 18:08:40 0 d
    C:\Program Files\Common Files\PC Tools
    2008-05-05 18:08:35 0 d
    C:\Program Files\PC Tools AntiVirus
    2008-05-05 18:08:35 0 d
    C:\Documents and Settings\All Users\Application Data\PC Tools
    2008-05-05 18:08:14 0 d
    C:\Program Files\Yahoo!
    2008-05-05 18:06:08 0 d
    C:\Documents and Settings\My Computer\Application Data\Identities
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\Templates
    2008-05-05 18:06:02 0 dr
    C:\Documents and Settings\My Computer\Start Menu
    2008-05-05 18:06:02 0 dr-h
    C:\Documents and Settings\My Computer\SendTo
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\PrintHood
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\NetHood
    2008-05-05 18:06:02 0 dr
    C:\Documents and Settings\My Computer\My Documents
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\Local Settings
    2008-05-05 18:06:02 0 dr
    C:\Documents and Settings\My Computer\Favorites
    2008-05-05 18:06:02 0 d
    C:\Documents and Settings\My Computer\Desktop
    2008-05-05 18:06:02 0 d--hs---- C:\Documents and Settings\My Computer\Cookies
    2008-05-05 18:06:02 0 d--h
    C:\Documents and Settings\My Computer\Application Data
    2008-05-05 18:05:15 0 d
    C:\WINDOWS\SoftwareDistribution
    2008-05-05 18:05:06 0 d---s---- C:\WINDOWS\system32\Microsoft
    2008-05-05 18:05:05 0 d--h
    C:\Documents and Settings\LocalService\Local Settings
    2008-05-05 18:05:05 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
    2008-05-05 18:05:05 0 d
    C:\Documents and Settings\LocalService\Application Data
    2008-05-05 18:05:05 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
    2008-05-05 18:04:46 225280 --a
    C:\Documents and Settings\NetworkService\NTUSER.DAT
    2008-05-05 18:04:46 0 d--h
    C:\Documents and Settings\NetworkService\Local Settings
    2008-05-05 18:04:46 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
    2008-05-05 18:04:46 0 d
    C:\Documents and Settings\NetworkService\Application Data
    2008-05-05 18:04:46 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
    2008-05-05 18:01:53 0 d
    C:\WINDOWS\system32\xircom
    2008-05-05 18:01:53 0 d
    C:\Program Files\microsoft frontpage
    2008-05-05 18:01:39 225280 ---h
    C:\Documents and Settings\Default User\NTUSER.DAT
    2008-05-05 18:01:34 0 -rahs---- C:\MSDOS.SYS
    2008-05-05 18:01:34 0 -rahs---- C:\IO.SYS
    2008-05-05 18:01:34 0 --a
    C:\CONFIG.SYS
    2008-05-05 18:01:34 0 --a
    C:\AUTOEXEC.BAT
    2008-05-05 18:00:18 0 d--hs---- C:\Documents and Settings\All Users\DRM
    2008-05-05 18:00:08 0 dr
    C:\WINDOWS\Offline Web Pages
    2008-05-05 18:00:08 0 d---s---- C:\WINDOWS\Downloaded Program Files
    2008-05-05 17:59:57 0 d--h
    C:\Program Files\WindowsUpdate
    2008-05-05 17:59:37 0 d
    C:\WINDOWS\system32\DirectX
    2008-05-05 17:59:06 0 d---s---- C:\WINDOWS\Tasks
    2008-05-05 17:59:05 0 d
    C:\Program Files\Common Files\MSSoap
    2008-05-05 17:59:02 0 d
    C:\WINDOWS\system32\Macromed
    2008-05-05 17:59:02 0 d
    C:\WINDOWS\srchasst
    2008-05-05 17:58:54 0 d
    C:\Program Files\Movie Maker
    2008-05-05 17:58:48 0 d
    C:\WINDOWS\system32\Restore
    2008-05-05 17:58:11 21640 --a
    C:\WINDOWS\system32\emptyregdb.dat
    2008-05-05 17:57:55 0 d
    C:\WINDOWS\Registration
    2008-05-05 17:57:48 0 d
    C:\Program Files\Online Services
    2008-05-05 17:57:42 0 d
    C:\Program Files\Messenger
    2008-05-05 17:57:38 0 d
    C:\Program Files\MSN Gaming Zone
    2008-05-05 17:57:03 0 d
    C:\Program Files\Windows NT
    2008-05-05 17:57:00 0 d
    C:\WINDOWS\system32\MsDtc
    2008-05-05 17:56:59 0 d
    C:\WINDOWS\system32\Com

    -- Find3M Report
    2008-05-12 22:23:33 73014 --a
    C:\Documents and Settings\My Computer\Application Data\PatchUpdate_HP_CounterReport_Update_HPSU.log
    2008-05-12 22:22:34 2145 --a
    C:\Documents and Settings\My Computer\Application Data\HPSU_48BitScanUpdate.log
    2008-05-12 22:15:51 169176 --a
    C:\Documents and Settings\My Computer\Application Data\Update_HP_RedboxHprblog_HPSU.log
    2008-05-06 01:52:06 62 --ahs---- C:\Documents and Settings\My Computer\Application Data\desktop.ini

    -- Registry Dump
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [05/05/2008 06:17 PM]
    "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [05/05/2008 06:08 PM]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [01/03/2008 10:26 PM]
    "nwiz"="nwiz.exe" [01/03/2008 10:26 PM C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [01/03/2008 10:26 PM]
    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM]
    "SoundMan"="SOUNDMAN.EXE" [04/16/2007 03:28 PM C:\WINDOWS\soundman.exe]
    "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [01/11/2008 12:41 AM]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 03:57 PM]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [05/11/2005 11:12 PM]
    "QuickFix"="D:\\QuickFix.exe" []
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [07/16/2007 03:17 PM]
    "YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [01/11/2008 12:41 AM]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [06/01/2007 10:21 AM]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 08:12 AM]
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [5/11/2005 11:23:26 PM]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
    C:\WINDOWS\System32\dimsntfy.dll
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @=&quot;Service"
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @=&quot;Volume shadow copy"
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    eapsvcs eaphost
    dot3svc dot3svc
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    napagent
    hkmsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1af5bf36-1bd4-11dd-8843-00e04cf2ceb9}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe winconfig.dll.vbs
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f74ab80-25b2-11dd-8869-00e04cf2ceb9}]
    AutoRun\command- F:\password_viewer.exe %1
    Explore\command- F:\password_viewer.exe %1
    Open\command- F:\password_viewer.exe %1
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f74ab81-25b2-11dd-8869-00e04cf2ceb9}]
    AutoRun\command- H:\password_viewer.exe %1
    Explore\command- H:\password_viewer.exe %1
    Open\command- H:\password_viewer.exe %1
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac310a86-27b8-11dd-8875-00e04cf2ceb9}]
    AutoRun\command- G:\password_viewer.exe %1
    Explore\command- G:\password_viewer.exe %1
    Open\command- G:\password_viewer.exe %1
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcb4775f-20f7-11dd-884e-00e04cf2ceb9}]
    AutoRun\command- G:\password_viewer.exe %1
    Explore\command- G:\password_viewer.exe %1
    Open\command- G:\password_viewer.exe %1
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc05c85e-27b7-11dd-8874-00e04cf2ceb9}]
    AutoRun\command- F:\password_viewer.exe %1
    Explore\command- F:\password_viewer.exe %1
    Open\command- F:\password_viewer.exe %1

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

    -- End of Deckard's System Scanner: finished at 2008-05-22 19:31:21



    Kapersky:
    KASPERSKY ONLINE SCANNER REPORT
    Thursday, May 22, 2008 7:26:43 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 22/05/2008
    Kaspersky Anti-Virus database records: 794286
    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true
    Scan Target - My Computer:
    C:\
    D:\
    E:\
    Scan Statistics:
    Total number of scanned objects: 58837
    Number of viruses found: 3
    Number of infected objects: 3
    Number of suspicious objects: 0
    Duration of the scan process: 00:48:29
    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\My Computer\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Application Data\Identities\{340DBEFA-DFEF-4100-B234-3E3FB4027EEF}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Application Data\Identities\{340DBEFA-DFEF-4100-B234-3E3FB4027EEF}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\History\History.IE5\MSHist012008052220080523\index.dat Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Temp\hpodvd09.log Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Temp\~DF87B9.tmp Object is locked skipped
    C:\Documents and Settings\My Computer\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\My Computer\ntuser.dat Object is locked skipped
    C:\Documents and Settings\My Computer\NTUSER.DAT.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
    C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
    C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{01269F3A-CDDB-4533-9FDF-FE4A2C128236}\RP58\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    C:\_OTMoveIt\MovedFiles\05222008_150623\WINDOWS\password_viewer.exe Infected: IM-Worm.Win32.Sohanad.hp skipped
    C:\_OTMoveIt\MovedFiles\05222008_150623\WINDOWS\pc-off.bat Infected: Trojan.BAT.Shutdown.bi skipped
    D:\Music\Red Hot Chilli Peppers - Around the world.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped
    D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    Scan process completed.
  • ThomasThomas
    edited May 2008
    That flushed out the actual infection load points, and yes, it is an autoload that was returned from an infected flash drive used. Which means you need to make sure any and all flash drives/external drives used on this computer are installed for the next steps.

    FYI - when you download a music file from a less-than-reputable source, you instead get one with an added piece of code:

    D:\Music\Red Hot Chilli Peppers - Around the world.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped

    So you click on the file to listen to your new music, and get a popup telling you to use the file you need an additional authorization or authentication, and are provided with a website link to go to to get that. And at that website is a preset malware download to infect the system. Bait set, fish hooked, and the computer is now communicating with these folks.

    To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs.


    Go here and download Flash_Disinfector.exe and save it to your desktop.

    Doubleclick on Flash_Disinfector.exe to run it and follow the prompts. Wait until it has finished scanning and then exit the program.

    The utility may ask you to insert your flash drive and/or other removable drives. Please do so and allow the utility to clean up those drives as well.
    REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1af5bf36-1bd4-11dd-8843-00e04cf2ceb9}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f74ab80-25b2-11dd-8869-00e04cf2ceb9}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f74ab81-25b2-11dd-8869-00e04cf2ceb9}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac310a86-27b8-11dd-8875-00e04cf2ceb9}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bcb4775f-20f7-11dd-884e-00e04cf2ceb9}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fc05c85e-27b7-11dd-8874-00e04cf2ceb9}]
    Open Notepad (Start - Run, type notepad and OK) and copy and paste the above text (inside the box) into the text file. Now go to File > Save As and call it fixer.reg. Where it says "Files of Type", select All Files and click on Save. Exit Notepad, double-click on the file and ok the prompt asking if you wish to merge the file with your registry.

    Then do a search for the following file:

    winconfig.dll.vbs

    If located, please upload it to the same site I posted earlier.

    Then with the external drives still installed run a new Kaspersky online scan, and post that log back here please. Just that for now - we will check against changes once all active malware files are removed.
  • ThomasThomas
    edited May 2008
    Actually on second thought, after doing the Kaspersky scan go ahead and run and post back a new Deckards log using the same steps you just did. The possible changes installing the external drives will need to be checked again before any reboots occur.
  • garfield619garfield619 Philippines New
    edited May 2008
    Ok, but agh, i forgot to get my flash drives from my mom. she uses it in here office. About the music. damn. It is some of her friends downloading sh*t in my computer. I dont even bother downloading any because i listen through imeem or youtube. After getting the flashdrives i would be doing so. (I DONT EVEN LISTEN TO RED HOT CHILI PEPPERS' MUSIC)
  • ThomasThomas
    edited May 2008
    No, that is not good if your Mother has used flash drives from this computer on any other. They will infect it just by installing them, since the infection is set to autoload. You honestly need to discuss this issue with her, since flash drive autoload infections can cause a snowball effect - drive infects computer infects any other drive installed infects other computer infects drive and on and on.
  • ThomasThomas
    edited May 2008
    Just FYI - if the flash drive is installed on an infected computer and then that flash drive is reformatted, the infection immediately installs on the flash drive again. The only way to do the cleaning is for the infected drives and computer to be cleaned at one time, or the computer cleaned and the drives disposed of and not re-used.
  • garfield619garfield619 Philippines New
    edited May 2008
    ok. got it! so i think this case i already closed. RESOLVED :D
  • ThomasThomas
    edited May 2008
    The steps I posted are not a generic solution for all systems that are infected with this malware. Or the verification all infection is removed. Just so you know that. But you chose to close the request, so okay.
  • garfield619garfield619 Philippines New
    edited May 2008
    Thomas, A big thanks for you ^^! it really helped a LOT. THANKS THANKS THANKS THANKS!
Sign In or Register to comment.