Please Help..BSOD crashes after TROJ_VB event

Unknown

Hello, I am new to this forum and so-so at these sort of problems. Thank you for taking the time to consider my plea.

Basic description of my problem:

I have Trend PC-Cillin It caught an attack TROJ_VB and quickly quarantined it. But later my system froze and upon restart a BSOD 0x0000008E stop error would occur just as log in to windows was achieved. I was able to enter safe mode with difficulty. It would lock up and give an svchost error. I backed up my crucial files and then started to do whatever I could to help the system. I ran trend micro anti-virus again and it found nothing. I ran NDD and NWD in safe mode, these did not help. I discovered that the system was somewhat stable when I used selective startup when only services were selected but no startup items . Once I got to this point I was able to install spybot S&D. It found many things, some were in memory and the program suggested to let Spybot S&D run at startup. Although it said it was cleaning some items, they reappear after reboot and are re-found. I made some screen captures...and combined them and ran hijack this. Thank you for any help you can give. I am posting this in the morning, I will not be able to address any suggestions until evening.

[screencaptures]

Spybot items that re-appeared
http://i73.photobucket.com/albums/i240/nebulagirl/blog/spybotlog.jpg

Items in the startup tab of msconfig. When these were disabled, I could boot and login successfully
http://i73.photobucket.com/albums/i240/nebulagirl/blog/startupitems.jpg



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:02:58 AM, on 1/5/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Cepstral\bin\CepstralLicSrv.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [SpybotDeletingA9630] command /c del "C:\WINDOWS\system32\vCbbLRqr.ini"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4341] cmd /c del "C:\WINDOWS\system32\vCbbLRqr.ini"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Program Files\NaturalReaders\Natural Voice Text To Speech Software Standard\read.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/webgames/popcaploader_v10.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Cepstral License Server - Cepstral, LLC - C:\Program Files\Cepstral\bin\CepstralLicSrv.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 10192 bytes

Katana

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

1. Please Read All Instructions Carefully
2. If you don't understand something, stop and ask! Don't keep going on.
3. Please do not run any other tools or scans whilst I am helping you
4. Please continue to respond until I give you the "All Clear"
   (Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

---

Disable Teatimer
First step:

• Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
• If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
• If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

• Open Spybot S&D
• Click Mode, choose Advanced Mode
• Go To the bottom of the Vertical Panel on the Left, Click Tools
• then, also in left panel, click Resident shows a red/white shield.
• If your firewall raises a question, say OK
• In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
• OK any prompts.
• Use File, Exit to terminate Spybot
• Reboot your machine for the changes to take effect.

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
• If requested, please reboot
  
  • If you accidently close it, the log file is saved here and will be named like this:
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Download and Run RSIT

• Please download Random's System Information Tool by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open:
  
  • log.txt will be opened maximized.
  • info.txt will be opened minimized.
• Please post the contents of both log.txt and info.txt.

vulcansage

Thank you Katana, I am at work and can not work on the system until this evening, I will follow the instructions and post the results here ASAP. Thank you!

vulcansage

Malwarebytes' Anti-Malware 1.32
Database version: 1625
Windows 5.1.2600 Service Pack 2

1/6/2009 9:54:22 PM
mbam-log-2009-01-06 (21-54-22).txt

Scan type: Full Scan (C:\|)
Objects scanned: 219617
Time elapsed: 1 hour(s), 23 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 30
Registry Values Infected: 3
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 30

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\rqRLbbCv.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ttdjcdad.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\nbmzqj.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\hgGxWnOh.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bf595ab-99c0-44a9-b2cc-25fa2b582ec0} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2bf595ab-99c0-44a9-b2cc-25fa2b582ec0} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9235fcf5-8ca8-41f6-ba42-351ab92719b8} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{9235fcf5-8ca8-41f6-ba42-351ab92719b8} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2bf595ab-99c0-44a9-b2cc-25fa2b582ec0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hggxwnoh (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9235fcf5-8ca8-41f6-ba42-351ab92719b8} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\spyware guard (Rogue.SpywareGuard) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2c19020f (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Security Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\rqrlbbcv -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\rqrlbbcv -> Delete on reboot.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\nbmzqj.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\rqRLbbCv.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vCbbLRqr.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vCbbLRqr.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ttdjcdad.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\dadcjdtt.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGxWnOh.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
C:\Documents and Settings\Nebulagirl\Local Settings\Temp\senekab133.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Nebulagirl\Local Settings\Temp\TDSSca24.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Nebulagirl\Local Settings\Temporary Internet Files\Content.IE5\22H7FYE6\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Nebulagirl\Local Settings\Temporary Internet Files\Content.IE5\HG237CRY\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\prunnet.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\senekavtmftnpq.dll (Trojan.Seneka) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qoMcbyVL.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yjsulebf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\senekafquftitu.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\senekaylhbgikk.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\senekadf.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\seneka.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\senekalog.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\seneka.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\senekajbqoygfy.sys (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\svhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\track.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Nebulagirl\Local Settings\Temp\TDSSc968.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSoiqh.dll (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\TDSSpqlt.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\TDSSpqxt.sys (Rootkit.Agent) -> Quarantined and deleted successfully.



ITEMS REMOVED IN REBOOT [SCREEN CAPTURE]
http://i73.photobucket.com/albums/i240/nebulagirl/blog/RebootItems01.jpg

vulcansage

RSIT LOG:

Logfile of random's system information tool 1.05 (written by random/random)
Run by Nebulagirl at 2009-01-06 22:00:55
Microsoft Windows XP Professional Service Pack 2
System drive C: has 49 GB (45%) free of 109 GB
Total RAM: 2046 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:13 PM, on 1/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Cepstral\bin\CepstralLicSrv.exe
C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
D:\Random's System Information Tool\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Nebulagirl.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Program Files\NaturalReaders\Natural Voice Text To Speech Software Standard\read.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWirelessUploadControl.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL nbmzqj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Cepstral License Server - Cepstral, LLC - C:\Program Files\Cepstral\bin\CepstralLicSrv.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 10811 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 118842]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 184423]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8260C2B8-E0D1-448a-B062-33D12D468BF0}]
ALOT eMusic Toolbar - C:\Program Files\alot\bin\alot.dll [2007-08-10 551208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}]
ST - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-01-25 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-26 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
MSNToolBandBHO - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\Program Files\BAE\BAE.dll [2006-12-08 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-01-25 2403392]
{8260C2B8-E0D1-448a-B062-33D12D468BF0} - ALOT eMusic Toolbar - C:\Program Files\alot\bin\alot.dll [2007-08-10 551208]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - MSN - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll [2006-01-17 282624]
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2007-03-23 1025584]
{F053C368-5458-45B2-9B4D-D8914BDDDBFF} - TextAloud - C:\PROGRA~1\TEXTAL~1\TAForIE.dll [2007-08-25 658432]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2005-09-26 169984]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2006-10-16 87584]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2006-10-16 1941784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adokikayisuki]
C:\WINDOWS\Bluvafisequpal.dll [2009-01-02 40448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe [2006-10-23 71216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe [2006-01-02 45056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-01-15 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\Program Files\DNA\btdna.exe [2008-12-19 342848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTEMON.EXE]
/h []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe [2005-10-31 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
C:\WINDOWS\system32\dla\tfswctrl.exe [2004-12-06 127035]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
C:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-21 2752512]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2007-01-19 169984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
C:\Program Files\Common Files\AOL\1170380176\ee\AOLSoftware.exe [2007-10-08 41824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ImgTask]
C:\WINDOWS\Imgtask.exe [2006-12-12 20480]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2006-10-18 696320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2006-10-18 802816]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe [2005-08-11 249856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-08-11 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech BT Wizard]
LBTWiz.exe -silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
C:\WINDOWS\KHALMNPR.EXE [2005-08-12 28160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
Rundll32 CTMBHA.DLL []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM]
C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe [2006-08-04 321040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM2_Monitor]
C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe /OM []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpScheduler]
C:\Program Files\ScanSoft\OmniPagePro14.0\OpScheduler.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Opware14]
C:\Program Files\ScanSoft\OmniPagePro14.0\Opware14.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe [2006-11-21 1807960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
C:\Program Files\Dell\MediaDirect\PCMService.exe [2007-05-02 184320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\prunnet]
C:\WINDOWS\system32\prunnet.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-01-10 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]
C:\Program Files\REGSHAVE\REGSHAVE.EXE [2002-02-04 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
C:\WINDOWS\MIDIDef.exe [2004-12-22 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
C:\WINDOWS\stsystra.exe [2006-03-24 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-14 68856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-08 761947]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-04-28 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2006-10-16 1164912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe [2006-02-16 1118208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager]
C:\WINDOWS\system32\WDBtnMgr.exe [2007-04-02 339968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe [2007-05-14 35328]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorkFlowTray]
C:\Program Files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [2006-05-24 622653]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
C:\PROGRA~1\Logitech\SetPoint\SetPoint.exe [2005-09-06 528384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VProperty.lnk]
C:\WINDOWS\VPro610.exe [2005-10-17 463360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nebulagirl^Start Menu^Programs^Startup^Adobe Gamma.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nebulagirl^Start Menu^Programs^Startup^Drempels Desktop.lnk]
C:\WINDOWS\drempels.exe /y []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Nebulagirl^Start Menu^Programs^Startup^Norton Disk Doctor.LNK]
D:\NU\NDD32.EXE /Q []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL nbmzqj.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-23 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll [2005-09-06 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2004-08-04 239616]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Dell\MediaDirect\PCMService.exe"="C:\Program Files\Dell\MediaDirect\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Common Files\AOL\1170380176\ee\aolsoftware.exe"="C:\Program Files\Common Files\AOL\1170380176\ee\aolsoftware.exe:*:Enabled:AOL Services"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\e frontier\Poser 7\Poser.exe"="C:\Program Files\e frontier\Poser 7\Poser.exe:*:Enabled:Poser executable file"
"C:\Program Files\MyNetStorage FTP\MyNetStorageFtp.exe"="C:\Program Files\MyNetStorage FTP\MyNetStorageFtp.exe:*:Enabled:MyNetStorage.com"
"C:\Program Files\SecondLifeVoiceFirstLook\SLVoice.exe"="C:\Program Files\SecondLifeVoiceFirstLook\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\SecondLifeVoiceFirstLook\SLVoiceAgent.exe"="C:\Program Files\SecondLifeVoiceFirstLook\SLVoiceAgent.exe:*:Enabled:SLVoiceAgent"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\Program Files\SecondLife\SLVoice.exe"="C:\Program Files\SecondLife\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\SecondLifeWindLight\SLVoice.exe"="C:\Program Files\SecondLifeWindLight\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe"="C:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam"
"C:\Program Files\CoreFTP\coreftp.exe"="C:\Program Files\CoreFTP\coreftp.exe:*:Enabled:Core FTP App"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Turbine\Dungeons & Dragons Online - Stormreach\dndclient.exe"="C:\Program Files\Turbine\Dungeons & Dragons Online - Stormreach\dndclient.exe:*:Enabled:dndclient"
"C:\Program Files\SecondLifeReleaseCandidate\SLVoice.exe"="C:\Program Files\SecondLifeReleaseCandidate\SLVoice.exe:*:Enabled:SLVoice"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\NetMeeting\conf.exe"="C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting®"
"C:\Program Files\AOL 9.1\waol.exe"="C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe"="C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed"
"C:\Program Files\Common Files\AOL\System Information\sinf.exe"="C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL System Information"
"C:\Program Files\Electronic Arts\EADM\Core.exe"="C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39f8f5c6-abd5-11db-987d-0019b951ad92}]
shell\AutoRun\command - G:\Autorun.exe /run
shell\Shell00\command - G:\Autorun.exe /run
shell\Shell01\command - G:\Autorun.exe /action
shell\Shell02\command - G:\Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{785e543a-de16-11db-98fc-0019b951ad92}]
shell\AutoRun\command - F:\Autorun.exe /run
shell\Shell00\command - F:\Autorun.exe /run
shell\Shell01\command - F:\Autorun.exe /action
shell\Shell02\command - F:\Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
shell\AutoRun\command - F:\Autorun.exe /run
shell\Shell00\command - F:\Autorun.exe /run
shell\Shell01\command - F:\Autorun.exe /action
shell\Shell02\command - F:\Autorun.exe /uninstall


======List of files/folders created in the last 1 months======

2009-01-06 22:00:55 ----D---- C:\rsit
2009-01-06 20:25:49 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\Malwarebytes
2009-01-06 20:25:33 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-01-06 20:25:28 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-06 20:17:10 ----A---- C:\WINDOWS\system32\273ac671-.txt
2009-01-05 02:54:13 ----A---- C:\WINDOWS\system32\gmxccpae.exe
2009-01-04 23:16:06 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-01-04 23:16:06 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 20:32:50 ----D---- C:\Program Files\CheckIt
2009-01-04 20:28:19 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\iolo
2009-01-04 20:28:19 ----D---- C:\Documents and Settings\All Users\Application Data\iolo
2009-01-04 02:51:44 ----A---- C:\WINDOWS\system32\ulliyiks.dll
2009-01-04 02:48:44 ----A---- C:\WINDOWS\system32\tyxcctpu.exe
2009-01-03 21:18:22 ----A---- C:\WINDOWS\DUMP9809.tmp
2009-01-03 19:32:33 ----D---- C:\WINDOWS\SoftwareDistribution
2009-01-03 16:52:06 ----D---- C:\WINDOWS\pss
2009-01-02 15:39:43 ----A---- C:\WINDOWS\system32\k9261108.exe
2009-01-02 15:39:43 ----A---- C:\WINDOWS\Bluvafisequpal.dll
2008-12-09 23:12:24 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-09 23:12:17 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-09 23:10:43 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-09 23:10:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

======List of files/folders modified in the last 1 months======

2009-01-06 22:00:50 ----D---- C:\WINDOWS\Prefetch
2009-01-06 21:59:51 ----RASH---- C:\boot.ini
2009-01-06 21:59:50 ----A---- C:\WINDOWS\win.ini
2009-01-06 21:59:50 ----A---- C:\WINDOWS\system.ini
2009-01-06 21:59:08 ----A---- C:\WINDOWS\NeroDigital.ini
2009-01-06 21:58:48 ----D---- C:\WINDOWS\Temp
2009-01-06 21:58:37 ----A---- C:\WINDOWS\ModemLog_Conexant HDA D110 MDC V.92 Modem.txt
2009-01-06 21:57:34 ----D---- C:\WINDOWS\system32\drivers
2009-01-06 21:57:34 ----D---- C:\WINDOWS\system32
2009-01-06 21:57:11 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-01-06 21:55:34 ----D---- C:\WINDOWS\system32\FxsTmp
2009-01-06 21:55:34 ----D---- C:\Program Files\psp
2009-01-06 20:25:28 ----RD---- C:\Program Files
2009-01-05 06:43:13 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-01-05 06:42:12 ----SHD---- C:\WINDOWS\CSC
2009-01-05 06:41:01 ----A---- C:\WINDOWS\ntbtlog.txt
2009-01-05 06:26:25 ----D---- C:\WINDOWS
2009-01-05 01:15:42 ----SHD---- C:\WINDOWS\Installer
2009-01-05 01:15:01 ----D---- C:\Program Files\Lavasoft
2009-01-05 01:11:40 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-01-05 01:02:13 ----A---- C:\WINDOWS\wininit.ini
2009-01-05 00:25:35 ----D---- C:\Program Files\Common Files
2009-01-05 00:21:02 ----D---- C:\Program Files\AskTBar
2009-01-04 23:45:35 ----D---- C:\Program Files\Trend Micro
2009-01-04 20:29:25 ----D---- C:\Program Files\TextAloud
2009-01-04 20:29:24 ----D---- C:\Program Files\Mozilla Firefox
2009-01-04 20:24:36 ----D---- C:\WINDOWS\Minidump
2009-01-04 02:51:13 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\BitTorrent
2009-01-04 02:13:01 ----A---- C:\WINDOWS\cdplayer.ini
2009-01-04 02:04:59 ----SHD---- C:\System Volume Information
2009-01-04 02:04:59 ----D---- C:\WINDOWS\system32\Restore
2009-01-03 21:46:31 ----D---- C:\Program Files\DNA
2009-01-03 21:46:31 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\DNA
2009-01-03 21:45:23 ----D---- C:\MDT
2009-01-02 22:12:46 ----D---- C:\WINDOWS\system32\CatRoot2
2009-01-02 21:36:55 ----D---- C:\Program Files\Steam
2009-01-02 21:36:54 ----D---- C:\Program Files\Visual Sample Plan
2009-01-02 21:36:53 ----D---- C:\Program Files\Windows Media Connect 2
2009-01-02 21:36:53 ----D---- C:\Program Files\viewsonic
2009-01-02 21:36:51 ----D---- C:\Program Files\SpongeBob SquarePants Diner Dash
2009-01-02 21:36:49 ----D---- C:\Program Files\Photomatix
2009-01-02 15:49:39 ----D---- C:\My Music
2009-01-02 15:34:37 ----D---- C:\Program Files\MyNetStorage FTP
2009-01-02 15:34:34 ----D---- C:\Program Files\Modem Helper
2009-01-02 15:34:34 ----D---- C:\Program Files\Messenger
2009-01-02 15:34:32 ----D---- C:\Program Files\bfgclient
2009-01-02 15:34:32 ----D---- C:\Program Files\BFG
2009-01-02 15:34:31 ----D---- C:\Program Files\Avimator
2009-01-02 15:34:27 ----D---- C:\Program Files\DivX
2009-01-02 15:34:26 ----D---- C:\Program Files\CamManager
2009-01-02 15:34:24 ----D---- C:\Program Files\Amazon
2009-01-02 15:34:24 ----D---- C:\Program Files\AhaView v4.01
2009-01-02 15:34:23 ----D---- C:\Program Files\ADSTech DVD Xpress DX2
2009-01-01 20:09:29 ----A---- C:\VETlog.txt
2008-12-28 16:52:48 ----SHD---- C:\WINDOWS\system32\dllcache
2008-12-28 16:50:51 ----HD---- C:\WINDOWS\inf
2008-12-24 00:18:21 ----A---- C:\WINDOWS\IE4 Error Log.txt
2008-12-23 20:37:11 ----D---- C:\Program Files\Last.fm
2008-12-22 20:45:22 ----D---- C:\Program Files\BitTorrent
2008-12-18 03:00:28 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-13 01:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-10 22:36:08 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\Mozilla
2008-12-09 23:13:05 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-12-09 23:12:30 ----A---- C:\WINDOWS\imsins.BAK
2008-12-09 23:11:59 ----D---- C:\Program Files\Internet Explorer
2008-12-09 18:24:37 ----A---- C:\WINDOWS\system32\MRT.exe
2008-12-07 18:58:14 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\Skype
2008-12-07 17:01:36 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\skypePM
2008-12-07 12:01:42 ----D---- C:\Documents and Settings\Nebulagirl\Application Data\CoreFTP

vulcansage

RSIT LOG continued


======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 APPDRV;APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [2005-08-12 16128]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 36096]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R1 omci;OMCI WDM Device Driver; C:\WINDOWS\system32\DRIVERS\omci.sys [2004-02-13 17153]
R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2004-07-14 5627]
R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2004-07-14 23545]
R1 tmtdi;Trend Micro TDI Driver; C:\WINDOWS\system32\DRIVERS\tmtdi.sys [2006-11-09 73288]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-04 8832]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.6.0.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-04-08 21425]
R2 BCMNTIO;BCMNTIO; \??\C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys []
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2004-11-23 40480]
R2 MAPMEM;MAPMEM; \??\C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys []
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2004-03-16 13059]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2006-10-19 12544]
R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2004-12-06 25883]
R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2004-12-06 34843]
R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2004-12-06 4123]
R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2004-12-06 2239]
R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2004-12-06 86586]
R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2004-12-06 15227]
R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2004-12-06 6363]
R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2004-12-06 98714]
R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2004-12-06 100603]
R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2007-06-15 39264]
R2 tmpreflt;tmpreflt; C:\WINDOWS\system32\DRIVERS\tmpreflt.sys [2008-08-16 36368]
R2 tmxpflt;tmxpflt; C:\WINDOWS\system32\drivers\TmXPFlt.sys [2008-08-16 205328]
R2 vsapint;vsapint; C:\WINDOWS\system32\DRIVERS\vsapint.sys [2008-08-16 1195448]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-23 1578496]
R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-08-25 44544]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2006-05-24 851434]
R3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2006-05-24 45683]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2006-05-24 66488]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-10 138752]
R3 CTUSFSYN;Creative SoundFont Synthesizer; C:\WINDOWS\system32\drivers\ctusfsyn.sys [2005-05-25 158464]
R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM); C:\WINDOWS\system32\DRIVERS\vrtaucbl.sys [2006-03-24 30728]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-08-12 137728]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-07-21 1035008]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-07-21 201600]
R3 LHidKe;Logitech SetPoint HID Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidKE.Sys [2005-08-12 25984]
R3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouKE.Sys [2005-08-12 68992]
R3 monfilt;monfilt; C:\WINDOWS\system32\drivers\monfilt.sys [2006-01-04 1389056]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NETw3x32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw3x32.sys [2006-10-17 1711104]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-10 106496]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-11-21 47360]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2005-11-02 10368]
R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-10-14 28544]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-10-14 51328]
R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-10-14 307968]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-04 67584]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2006-03-24 1156648]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-08 191872]
R3 tmcfw;Trend Micro Common Firewall Service; C:\WINDOWS\system32\DRIVERS\TM_CFW.sys [2006-11-09 280392]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2005-10-25 27264]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2003-01-10 33588]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-07-21 717952]
S1 seneka;seneka; C:\WINDOWS\system32\drivers\senekajbqoygfy.sys []
S1 TDSSserv.sys;TDSSserv.sys; C:\WINDOWS\system32\drivers\TDSSserv.sys []
S2 Ca504av;Mega Camera, WDM Video Capture; C:\WINDOWS\System32\Drivers\Ca504av.sys [2002-06-18 516149]
S3 ADSEXPB;ADS DVD Express B; C:\WINDOWS\System32\Drivers\adsexpb.sys [2005-04-06 34240]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 DSproct;DSproct; \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys []
S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 RimUsb;BlackBerry Device; C:\WINDOWS\System32\Drivers\RimUsb.sys [2006-10-05 22272]
S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2004-08-04 11136]
S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2004-08-04 10240]
S3 SIUSBXP;SIUSBXP; C:\WINDOWS\system32\drivers\SiUSBXp.sys [2007-03-05 14848]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 SPC610NC;SPC 610NC Laptop Camera; C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2005-09-07 151040]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 STVqx3;Intel Play QX3 Microscope; C:\WINDOWS\system32\drivers\STVqx3.sys [2001-04-12 131776]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 USBCamera;Mega Camera Still Image Capture, Version 1.00; C:\WINDOWS\System32\Drivers\Bulk504.sys [2002-07-25 10986]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2004-08-03 78464]
S3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver; C:\WINDOWS\system32\DRIVERS\w39n51.sys [2006-04-26 1429632]
S3 WISTechVIDCAP;ADS DVD XPRESS DX2; C:\WINDOWS\system32\drivers\wisgostrm.sys [2006-06-05 268736]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2004-08-04 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2004-08-04 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2004-08-04 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2004-08-03 5504]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2004-08-04 41088]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2006-10-16 230944]
R2 AOL ACS;AOL Connectivity Service; C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe [2006-10-23 46640]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-23 409600]
R2 bgsvcgen;B's Recorder GOLD Library General Service; C:\WINDOWS\system32\bgsvcgen.exe [2005-04-30 86016]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2006-05-24 266295]
R2 Cepstral License Server;Cepstral License Server; C:\Program Files\Cepstral\bin\CepstralLicSrv.exe [2007-03-15 57344]
R2 Creative Labs Licensing Service;Creative Labs Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe [2007-01-19 69632]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2006-10-18 434176]
R2 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE [2005-09-06 81920]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 MSSQL$MICROSOFTSMLBIZ;MSSQL$MICROSOFTSMLBIZ; C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe [2008-05-25 9154560]
R2 PcCtlCom;Trend Micro Central Control Component; C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe [2008-05-19 1475936]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2006-10-18 327680]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2006-10-18 946176]
R2 STI Simulator;STI Simulator; C:\WINDOWS\System32\PAStiSvc.exe [2005-01-14 53248]
R2 Tmntsrv;Trend Micro Real-time Service; C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-09-25 345696]
R2 TmPfw;Trend Micro Personal Firewall; C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-11-09 923216]
R2 tmproxy;Trend Micro Proxy Service; C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-11-09 566872]
R2 WANMiniportService;WAN Miniport (ATW) Service; C:\WINDOWS\wanmpsvc.exe [2003-08-27 65536]
R2 WLANKEEPER;Intel(R) PROSet/Wireless SSO Service; C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe [2006-10-18 290816]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2004-08-04 267776]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-06-29 72704]
S3 ADVService;Amazon Unbox Video Service; C:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [2007-07-11 25640]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-25 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 License Management Service ESD;License Management Service ESD; C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe [2007-04-05 68608]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2005-05-03 73728]
S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-15 774144]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-01-15 266240]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLAgent$MICROSOFTSMLBIZ;SQLAgent$MICROSOFTSMLBIZ; C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE [2005-05-03 323584]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

---

EOF

---

vulcansage

RSIT INFO

info.txt logfile of random's system information tool 1.05 2009-01-06 22:01:17

======Uninstall list======

-->"C:\Program Files\AOL\AOL Toolbar 5.0\uninstall.exe"
-->"C:\Program Files\Creative Installation Information\CREATIVE_MEDIASOURCE_U\Setup.exe" /remove /l0x0009
-->"C:\Program Files\Creative Installation Information\CTCMSGO\Setup.exe" /remove /l0x0009
-->"C:\Program Files\Creative Installation Information\E-CENTER_NET_CONTENT_U\Setup.exe" /remove /l0x0009
-->"C:\Program Files\Creative\SBAudigy\Program\CTZapxx.EXE" ctsbmb.ini /U /N /S /W
-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
-->C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32B4B536-4443-42F0-9676-98373BE9114F}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34EBD418-B8E6-4E86-89C4-33B72CF5663F}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34EBD418-B8E6-4E86-89C4-33B72CF5663F}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{52338F65-A1C3-4CDC-B733-50051682B297}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{52338F65-A1C3-4CDC-B733-50051682B297}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{569A9538-86EC-44C3-8EE4-C68B165F2A75}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{569A9538-86EC-44C3-8EE4-C68B165F2A75}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5EEE551B-7692-4D68-91BF-DAD745243AFB}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{73919E2B-725C-4FAA-8473-45E063A3575F}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{73919E2B-725C-4FAA-8473-45E063A3575F}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C64409FA-42A7-49C6-837A-D2E5D813BD57}\setup.exe" -l0x9 /remove
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DE4A4C48-2232-4CCB-AD61-490ACD29BA85}\setup.exe" -l0x9 /remove
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
123 Free Solitaire-->C:\PROGRA~1\123FRE~1\UNWISE.EXE C:\PROGRA~1\123FRE~1\INSTALL.LOG
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2775 Sound Effects-->C:\WINDOWS\uninst.exe -f"C:\Program Files\Starshine\sound\DeIsL1.isu" -c"C:\Program Files\Starshine\sound\_ISREG32.DLL"
517142 - ZBrush (Windows) (Shared Components)-->C:\Program Files\Common Files\element5 Shared\Uninstall\517142 ZBrush Windows\B1FFA000\UninstApplet.exe /uninstall
7-Zip 4.57-->"C:\Program Files\7-Zip\Uninstall.exe"
Acronis True Image Home-->MsiExec.exe /X{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Audition 2.0-->msiexec /I {01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5102}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 2.0-->MsiExec.exe /I{8FFC924C-ED06-44CB-8867-3CA778ECE903}
ADS Tech Master Installer V3.8-->C:\PROGRA~1\ADSTech\UNWISE.EXE C:\PROGRA~1\ADSTech\INSTALL.LOG
ADS Tech V3.8 DVD Xpress DX2 CapWiz-->C:\PROGRA~1\ADSTEC~2\UNWISE.EXE C:\PROGRA~1\ADSTEC~2\INSTALL.LOG
AhaView-->"C:\Program Files\AhaView v4.01\uninstall.exe"
AIM 6.0-->C:\Program Files\AIM6\uninst.exe
AirClick 2.0-->C:\Program Files\Griffin Technology\AirClick\uninstall.exe
Alchemy Deluxe 1.6-->C:\Program Files\PopCap Games\Alchemy Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Alchemy Deluxe\Install.log"
Alias SketchBook Pro 2.0-->MsiExec.exe /X{3470101E-A698-4B27-9532-5528B02A5FE0}
ALOT eMusic Toolbar-->"C:\Program Files\alot\alotUninst.exe"
Amazon Unbox Video-->C:\Program Files\InstallShield Installation Information\{54A4839E-87F8-4BD1-9682-A349E9943F0A}\setup.exe -runfromtemp -l0x0409
Andrea VoiceCenter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8D2AE3F6-79DF-423C-91CB-389F6FB5837B}\Setup.exe" -Remove
Anime Studio Pro 5.5-->"C:\Program Files\e frontier\Anime Studio Pro\unins000.exe"
AOL Coach Version 1.0(Build:20040229.1 en)-->C:\Program Files\Common Files\aolshare\Coach\AolCInUn.exe
AOL Toolbar 5.0-->"C:\Program Files\AOL\AOL Toolbar 5.0\uninstall.exe"
AOL Uninstaller (Choose which Products to Remove)-->C:\Program Files\Common Files\AOL\uninstaller.exe
AOLIcon-->MsiExec.exe /I{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}
ASIO4ALL-->C:\Program Files\ASIO4ALL v2\uninstall.exe
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Atomica Deluxe 2.52-->C:\Program Files\PopCap Games\Atomica Deluxe\PopUninstall.exe C:\Program Files\PopCap Games\Atomica Deluxe\Install.log
Audiosurf-->"C:\Program Files\Steam\steam.exe" steam://uninstall/12900
Avimator (remove only)-->C:\Program Files\Avimator\Uninstall.exe
Bejeweled 2 Deluxe 1.0-->C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Bejeweled 2 Deluxe\Install.log"
Beyond Good and Evil-->"C:\Program Files\Steam\steam.exe" steam://uninstall/15130
Big City Adventure Sydney-->C:\Documents and Settings\All Users\Application Data\Last.fm\Client\UninstWA\unins000.exe
Big Fish Games Client-->C:\Program Files\bfgclient\Uninstall.exe
Blender (remove only)-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Bookworm Adventures Deluxe 1.0-->C:\Program Files\PopCap Games\Bookworm Adventures Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Bookworm Adventures Deluxe\Install.log"
BookWorm Deluxe 1.01-->C:\Program Files\Shockwave.com\BookWorm Deluxe\PopUninstall.exe "C:\Program Files\Shockwave.com\BookWorm Deluxe\Install.log"
BookWorm Deluxe 1.03-->C:\Program Files\PopCap Games\BookWorm Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\BookWorm Deluxe\Install.log"
Broadcom Management Programs-->MsiExec.exe /I{26E1BFB0-E87E-4696-9F89-B467F01F81E5}
Bryce 6-->C:\WINDOWS\unvise32.exe C:\Program Files\DAZ\Bryce 6\Bryce Uninstall.log
Cepstral Duchess 4.2.0-->MsiExec.exe /I{1C5811AB-B3BD-496E-B0DB-08A306679881}
CheckIt Diagnostics-->C:\PROGRA~1\CheckIt\DIAGNO~1\UNWISE.EXE C:\PROGRA~1\CheckIt\DIAGNO~1\INSTALL.LOG
Chuzzle Deluxe 1.0-->C:\Program Files\PopCap Games\Chuzzle Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Chuzzle Deluxe\Install.log"
Collab-->C:\Program Files\Image-Line\Collab\uninstall.exe
Conexant HDA D110 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3\HXFSETUP.EXE -U -Idel1028k.inf
Cool Edit 2000-->C:\Program Files\Cool2000\ce2Kunin.exe
Core FTP LE 1.3c-->C:\PROGRA~1\CoreFTP\UNWISE.EXE C:\PROGRA~1\CoreFTP\INSTALL.LOG
Core FTP LE 2.1-->C:\PROGRA~1\CoreFTP2\UNWISE.EXE C:\PROGRA~1\CoreFTP2\INSTALL.LOG
CorelDRAW Graphics Suite X3-->MsiExec.exe /I{63218538-4A69-497F-8455-904261B0E9E4}
Creative Audio Pack-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5EEE551B-7692-4D68-91BF-DAD745243AFB}\setup.exe" -l0x9 /remove
CuteFTP 7 Home-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59D98250-CFEB-4A0B-A737-FC7CADE27852}\Setup.exe" -l0x9
DAZ|Studio 1.3.1.0-->C:\WINDOWS\unvise32.exe C:\Program Files\DAZ\Studio\DAZ Studio Uninstall.log
Debut-->C:\Program Files\NCH Software\Debut\uninst.exe
Diamond Mine Deluxe 1.8-->C:\Program Files\shockwave.com\Diamond Mine Deluxe\PopUninstall.exe C:\Program Files\shockwave.com\Diamond Mine Deluxe\Install.log
Dictionary 1.2.0084-->C:\WINDOWS\iun506.exe C:\Program Files\Romanian-Dictionary\irunin.ini
Digital Content Portal-->MsiExec.exe /I{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DreamFlag Screen Saver-->C:\Program Files\DreamFlag Screen Saver\uninstal.exe
DVD Decrypter (Remove Only)-->"C:\Program Files\DVD Decrypter\uninstall.exe"
Dynomite Deluxe 2.71-->C:\Program Files\PopCap Games\Dynomite Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Dynomite Deluxe\Install.log"
EA Download Manager-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EF7E931D-DC84-471B-8DB6-A83358095474} /l1033
eMusic Remote 1.0.0.2-->C:\Program Files\eMusic Remote\uninst.exe
EN-->MsiExec.exe /I{32A72502-BC2C-4C39-ACEA-BC3D463F0697}
Encore LaunchPad 6.8.25.100-->"C:\Program Files\Encore\LaunchPad\unins000.exe"
FinePixS20Pro ShootingDriver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{60DE73EA-5012-4106-84F1-2F0BD9EC6D9A}\Setup.exe" -l0x9
FinePixS2Pro ShootingDriver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{758E2C3F-24F1-4172-99A5-51A62E4A5775}\Setup.exe" -l0x9
FinePixS3Pro ShootingDriver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2CAB0F24-9552-4303-8C28-589F1911AA21}\Setup.exe" -l0x9
Fish Tycoon (remove only)-->C:\Program Files\Fish Tycoon\Uninstall.exe
FL Studio 7-->C:\Program Files\Image-Line\FL Studio 7\uninstall.exe
Flickr Uploadr 2.3-->"C:\Program Files\Flickr Uploadr\uninstall.exe"
FontNav-->MsiExec.exe /I{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}
Free Video to iPod Converter version 3.1-->"C:\Program Files\DVDVideoSoft\Free Video to iPod Converter\unins000.exe"
FUJIFILM Hyper-Utility Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{76583DD5-2BCE-46F7-ACC4-3BF37645F4E0}\SETUP.EXE" -l0x9
FUJIFILM USB Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE"
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly
Google Toolbar for Firefox-->MsiExec.exe /X{2CCBABCB-6427-4A55-B091-49864623C43F}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
High Definition Audio Driver Package - KB835221-->C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix 2050 for SQL Server 2000 ENU (KB948110)-->"C:\WINDOWS\$SQLUninstallSQL2000-KB948110-v8.00.2050-x86-ENU$\spuninst\spuninst.exe"
Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB914440)-->"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hoyle Puzzle Games 2003-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{5D3543CC-82B3-447E-B7D5-430C41946A54}
Hoyle Puzzle Games 2007-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{059689BF-89A3-4FE5-B459-6EAB2903124F}\setup.exe" -l0x9 -removeonly
Hyper-Utility Software Add-On-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{138CEA91-A651-45B0-9C2C-D69A44493E0F}\Setup.exe" -l0x9
Hyper-Utility2 CCD-RAW Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45634CA5-CFDE-4794-9C1C-65613F2A0E4E}\Setup.exe" -l0x9
Hyper-Utility2 CustomRendered Modifier Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8AE68327-FAA7-403D-AEEC-CBBA1DE2DBAD}\Setup.exe" -l0x9
Hyper-Utility2 FinePixS20Pro SHOOTING Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5D063AFD-05EF-4CE8-895A-7817118B1D6A}\Setup.exe" -l0x9
Hyper-Utility2 Preview Print-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{819A351B-09B9-4AE2-A9E9-EAFBF8952A56}\Setup.exe" -l0x9
Hyper-Utility2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0D19B2D8-4FE4-48B2-BBA1-194B82A81230}\Setup.exe" -l0x9
IL Download Manager-->C:\Program Files\Image-Line\Downloader\uninstall.exe
Insaniquarium Deluxe-->C:\PROGRA~1\GAMEHO~1\INSANI~1\UNWISE.EXE /U C:\PROGRA~1\GAMEHO~1\INSANI~1\INSTALL.LOG
Intel(r) Play(tm) QX3(tm) Computer Microscope-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{49AE768B-20DB-403D-AF92-53248BB0060D}\Setup.exe"
Intel(R) PROSet/Wireless Software-->C:\WINDOWS\Installer\iProInst.exe
Intel(r) System Information Viewer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C9DDCE0-66CF-11D4-9100-0090274FBE9A}\setup.exe"
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Kalachakra Screen Saver-->C:\Program Files\Kalachakra Screen Saver\uninstal.exe
L&H TTS3000 British English-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSENG.inf, Uninstall
Last.fm 1.5.1.29527-->"C:\Program Files\Last.fm\unins000.exe"
Learn2 Player (Uninstall Only)-->C:\Program Files\Learn2.com\StRunner\stuninst.exe
Lernout & Hauspie TruVoice American English TTS Engine-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\tv_enua.inf, Uninstall
Live 6.0.1-->C:\PROGRA~1\Ableton\LIVE60~1.1\Install\UNWISE.EXE C:\PROGRA~1\Ableton\LIVE60~1.1\Install\INSTALL.LOG
Logitech SetPoint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x9 -removeonly
Magic DVD Ripper V5.1.1-->"C:\Program Files\MagicDVDRipper\unins000.exe"
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Mani Screen Saver-->C:\Program Files\7 Angels\Mani Screen Saver\uninstal.exe
Mega Camera Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{37921810-D90B-4DFD-9284-BE35033B39C8}\Setup.exe"
Mega Camera, WDM Video Capture-->Rundll32 advpack.dll,LaunchINFSectionEx C:\WINDOWS\Ca504A.ini, Ca523AUnInstall
mHlpDell-->MsiExec.exe /I{49D687E5-6784-431B-A0A2-2F23B8CC5A1B}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROR /dll OSETUP.DLL
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Miditzer Style 216 ver. 0.84-->C:\Program Files\Miditzer Style 216\uninst.exe
mIRC-->C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F}
mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}
Modem Helper-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}
mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83}
MSN Toolbar-->C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\mtbs.exe c
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
mSSO-->MsiExec.exe /I{06BE8AFD-A8E2-4B63-BAE7-287016D16ACB}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
mWMI-->MsiExec.exe /I{63DB9CCD-2B56-4217-9A3D-507AC78320CA}
MyNetStorage FTP-->"C:\Program Files\MyNetStorage FTP\Uninstall.exe" "C:\Program Files\MyNetStorage FTP\install.log"
MySpaceIM-->C:\Program Files\MySpace\IM\Uninstall.exe
Mystery Case Files - Prime Suspects (remove only)-->C:\Program Files\Mystery Case Files - Prime Suspects\Uninstall.exe
Native Instruments Reaktor 5-->C:\PROGRA~1\NATIVE~1\REAKTO~1\UNWISE.EXE C:\PROGRA~1\NATIVE~1\REAKTO~1\INSTALL.LOG
NCH Tone Generator-->C:\Program Files\NCH Swift Sound\ToneGen\uninst.exe
NCH Toolbox-->C:\Program Files\NCH Swift Sound\ToolBox\uninst.exe
Nero 7 Ultra Edition-->MsiExec.exe /I{6D6C1253-F5A2-4E0C-9070-F3C1176C1033}
NetWaiting-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
NetZeroInstallers-->MsiExec.exe /X{352310C3-E46B-42D3-8F32-54721FDD72D9}
Noah's Ark Deluxe 1.1-->C:\Program Files\PopCap Games\Noah's Ark Deluxe\PopUninstall.exe C:\Program Files\PopCap Games\Noah's Ark Deluxe\Install.log
PageBreeze Free HTML Editor-->C:\PROGRA~1\PAGEBR~1\UNWISE.EXE C:\PROGRA~1\PAGEBR~1\INSTALL.LOG
Philips VLounge-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{89ACA875-BDB9-443C-B7C7-D74D3BDE8FE2}\Setup.exe" -l0x9
Photo Viewer 2.3-->"C:\Program Files\Photo Viewer\uninstall.exe"
Photomatix Pro version 2.5.4-->"C:\Program Files\Photomatix\unins000.exe"
Pixelus Deluxe 1.0-->C:\Program Files\PopCap Games\Pixelus Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Pixelus Deluxe\Install.log"
Poser 7-->C:\WINDOWS\unvise32.exe C:\Program Files\e frontier\Poser 7\uninstal.log
PrimoPDF-->"C:\WINDOWS\PrimoPDF4\uninstall.exe" "/U:C:\Program Files\activePDF\PrimoPDF\Uninstall\uninstallPrimoPDF4.xml"
Prism Video Converter-->C:\Program Files\NCH Software\Prism\uninst.exe
Qualxserve Service Agreement-->MsiExec.exe /X{0F756CD9-4A1E-409B-B101-601DDC4C03AA}
QuickTime-->MsiExec.exe /I{6EC874C2-F950-4B7E-A5B7-B1066D6B74AA}
Raven Lite 1.0-->"C:\Program Files\Raven Lite 1.0\UninstallerData\Uninstall Raven.exe"
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Renoise 1.8.0-->"C:\Program Files\Renoise 1.8.0\unins000.exe"
SearchAssist-->C:\DELL\SearchAssist\UninstSA.bat
SecondLife (remove only)-->"C:\Program Files\SecondLife\uninst.exe" /P="SecondLife"
SecondLifeReleaseCandidate (remove only)-->"C:\Program Files\SecondLifeReleaseCandidate\uninst.exe"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Step By Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows Media Player 9 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)-->"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918899)-->"C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)-->"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923694)-->"C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925454)-->"C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937894)-->"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)-->"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
SensiQ Discovery A.04X-->"C:\Program Files\SensiQ Discovery\unins000.exe"
SensiQ Discovery USB Drivers (Driver Removal)-->C:\WINDOWS\system32\Silabs\DriverUninstaller.exe USBXpress\SIUSBXP&071A&3002
Shockwave.com Zuma-->C:\PROGRA~1\SHOCKW~1.COM\Zuma\UNWISE.EXE C:\PROGRA~1\SHOCKW~1.COM\Zuma\INSTALL.LOG
SHOUTcast Source DSP 1.9.0 (remove only)-->C:\Program Files\Winamp\uninst-dsp.exe
Skypeâ„¢ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
Sonic Foundry ACID Pro v2.0 (60)-->C:\WINDOWS\UNWISE.EXE C:\audio\acid\INSTALL.LOG
Sonic MyDVD LE-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Data-->MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Sony Cinescore 1.0-->MsiExec.exe /X{08DBD80F-C2C1-442F-8117-7E82833197D7}
Sony Cinescore Plug-In 1.0-->MsiExec.exe /X{2DEC0493-C221-4E34-BC88-6334077DF72D}
Sound Blaster ADVANCED MB Drivers-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{943884D4-B604-496F-B132-DFA9C63FAF6A}\setup.exe" -l0x9 /remove
Sound Blaster Audigy ADVANCED MB Product Registration-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EEEF992E-270C-4B4C-8389-4B3DEEE33190}\Setup.exe" -l0x9 /remove
Sound Blaster Audigy ADVANCED MB-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{53C6D09E-EAB6-49E5-BA4C-BA7FF13830FB}\Setup.exe" -l0x9 /remove
SPC 610NC Laptop Camera -->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{E66653A2-2B5C-4909-B71E-218164336960} /l1033
SpongeBob SquarePants Diner Dash (remove only)-->C:\Program Files\SpongeBob SquarePants Diner Dash\Uninstall.exe
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Studio Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{80B3B090-7FE0-487D-9065-5D0B3FB9FC31}\Setup.exe" -l0x9
Switch Sound File Converter-->C:\Program Files\NCH Swift Sound\Switch\uninst.exe
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
TempoPerfect-->C:\Program Files\NCH Swift Sound\TempoPerfect\uninst.exe
TextAloud-->"C:\Program Files\TextAloud\unins000.exe"
The Wonderful End of the World Trial v1.0-->"C:\Program Files\The Wonderful End of the World Trial\unins000.exe"
TipTop Deluxe 1.1-->C:\Program Files\PopCap Games\TipTop Deluxe\PopUninstall.exe C:\Program Files\PopCap Games\TipTop Deluxe\Install.log
Trend Micro PC-cillin Internet Security 14-->C:\PROGRA~1\TRENDM~1\INTERN~1\remove.exe
Ulead Straight-to-Disc SDK-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8D2C1E44-7685-4D05-8342-B0DC6422FA47}\setup.exe" -l0x9
Uninstall 1.0.0.1-->"C:\Program Files\Common Files\DVDVideoSoft\unins000.exe"
Update for Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB904942)-->"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB929338)-->"C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update for Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Update for Windows XP (KB933360)-->"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)-->"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
URGE-->MsiExec.exe /I{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}
URL Assistant-->regsvr32 /u /s "C:\Program Files\BAE\BAE.dll"
VideoLAN VLC media player 0.8.6d-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Virtual Audio Cable 4.01-->C:\Program Files\Virtual Audio Cable\setup.exe -u
Visual Sample Plan-->MsiExec.exe /I{655EA118-F094-4C93-9254-77FF40AAF2B6}
VX-7 Commander v1.3.4-->"C:\Program Files\VX-7 Commander\unins000.exe"
WavePad Uninstall-->C:\Program Files\NCH Swift Sound\WavePad\uninst.exe
WD Diagnostics-->MsiExec.exe /X{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}
WIDCOMM Bluetooth Software-->MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}
Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Hotfix - KB885295-->C:\WINDOWS\$NtUninstallKB885295$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Wondershare PPT2DVD 3.10.3.4-->"C:\Program Files\Wondershare\PPT2DVD\unins000.exe"
Wondershare PPT2DVD Build 3.8.2.218-->"C:\Program Files\Wondershare\PPT2DVD\unins000.exe"
Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
ZBrush2-->"C:\Program Files\Pixologic\ZBrush2\UninstallerData\Uninstall ZBrush2.exe"
Zuma Deluxe 1.0-->C:\Program Files\PopCap Games\Zuma Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Zuma Deluxe\Install.log"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: PC-cillin Internet Security - Virus Protection
FW: PC-cillin Internet Security - Firewall

System event log

Computer Name: NEBBY
Event Code: 62465
Message: Bandwidth limitation. Overlay allocation failed

Record Number: 107438
Source Name: ati2mtag
Time Written: 20081221132304.000000-300
Event Type: warning
User:

Computer Name: NEBBY
Event Code: 62486
Message: Invalid parameters

Record Number: 107437
Source Name: ati2mtag
Time Written: 20081221132304.000000-300
Event Type: information
User:

Computer Name: NEBBY
Event Code: 62465
Message: Bandwidth limitation. Overlay allocation failed

Record Number: 107436
Source Name: ati2mtag
Time Written: 20081221132304.000000-300
Event Type: warning
User:

Computer Name: NEBBY
Event Code: 62486
Message: Invalid parameters

Record Number: 107435
Source Name: ati2mtag
Time Written: 20081221132304.000000-300
Event Type: information
User:

Computer Name: NEBBY
Event Code: 62465
Message: Bandwidth limitation. Overlay allocation failed

Record Number: 107434
Source Name: ati2mtag
Time Written: 20081221132304.000000-300
Event Type: warning
User:

Application event log

Computer Name: NEBBY
Event Code: 105
Message: The service was started.

Record Number: 12246
Source Name: Creative Service for CDROM Access
Time Written: 20080620211132.000000-240
Event Type: information
User:

Computer Name: NEBBY
Event Code: 0
Message:
Record Number: 12245
Source Name: btwdins
Time Written: 20080620211132.000000-240
Event Type: information
User:

Computer Name: NEBBY
Event Code: 0
Message:
Record Number: 12244
Source Name: EvtEng
Time Written: 20080620211128.000000-240
Event Type: information
User:

Computer Name: NEBBY
Event Code: 1517
Message: Windows saved user NEBBY\Nebulagirl registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.


This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Record Number: 12243
Source Name: Userenv
Time Written: 20080620001755.000000-240
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: NEBBY
Event Code: 2
Message: Successful auto update retrieval of third-party root list cab from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab&gt;

Record Number: 12242
Source Name: crypt32
Time Written: 20080619202254.000000-240
Event Type: information
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\Cepstral\bin;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=0f06
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=C:\Program Files\Common Files\Sonic Shared\Sonic Central\
"CLASSPATH"=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip

---

EOF

---

Katana

Step 1


Flash Disinfector by sUBs
Please download Flash_Disinfector.exe by sUBs and save it to your desktop:

• Double-click Flash_Disinfector.exe to run it.
• Follow any prompts that may appear.
• Wait until the program has finished scanning, then please exit the program.
  The tool may ask you to insert your flash drive, or other removable drives. Please do so and allow the tool to clean it up as well.
  

Please restart your computer.

---

---

Step 2

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

• You must download it to and run it from your Desktop
  
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  
• Double click combofix.exe & follow the prompts.
  
• When finished, it will produce a log. Please save that log to post in your next reply
  
• Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

---

---

Step 3

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download Java Runtime Environment (JRE) . ( don't install it yet )
Now download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location.

Now install the Java Runtime Environment (JRE) package you downloaded
(it comes with a toolbar pre-selected, so make sure you uncheck the box)

You can delete JavaRa (zip and exe)

---

---

Step 4


Fix With HJT

Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present

O2 - BHO: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: ALOT eMusic Toolbar - {8260C2B8-E0D1-448a-B062-33D12D468BF0} - C:\Program Files\alot\bin\alot.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL nbmzqj.dll

- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis

---

---

Step 5


Logs/Information to Post in Reply
Please post the following logs/Information in your reply

• Combofix Log
• How are things running now ?

vulcansage

Thanks, I will do this and post the logs later tonight when I am home.

I have a question about the ComboFix step. It seems to me that I am just running a ComboFix scan and posting a log. The disclaimer about ComboFix and how you guys are not "responsible for any damage you may have caused your machine by running ComboFix on your own." If I'm just running a scan...there isn't really any danger...right? The real issue/danger happens when you remove or change something using ComboFix? I just want to understand the risks involved with the various steps I am performing.

Thank you Sooo much.

After doing all that I have done so far, it seems that the system is more stable...if I had left it on before it would have eventually BSOD crashed after an hour or two in selective startup.

vulcansage

Oh One more question.

When I went looking to download the Java stuff

Java SE Runtime Environment 6u11
jre-6u11-windows-i586-p.exe

I found there were optional items. Should I install the optional items below?

Windows Kernel Installation
jre-6u11-windows-i586-p-iftw-k.exe

Windows Online Installation
jre-6u11-windows-i586-p-iftw.exe

Katana

Combofix automatically fixes a lot of things when you run it.
It is safe to run though as I know what is on your machine.

You only need to download the Windows Offline Installation package

vulcansage

I am able to boot in normal bootup now with not BSOD yet. That is good news. When I restarted normally, teatimer was activated and I saw one process that you had told me to remove with hijack this. One of the emusic ones. I denied it. That item was not there when I just ran hijack this. For some reason the system 32 window opens up upon startup.

Teatimer is popping up a lot of changes to the registry. some look legit others mysterious. I did not write them all down. I just denied them. this one keeps popping even if I deny it:

Category: System Startup Global Entry
Change: Value Added
Entry: Ysomaciwiquloya
New Data: rundll32.exe "C:\WINDOWS\omiriheh.dll",e

The computer has still been on for 30 minutes with no BSOD.

I have a few more little questions


1) I used the flash disinfector. May I ask for guidance on how to "disinfect" all my external hard drives in case there are bad items there?

2 What programs do you recommend I use to supplement my PC-cillin Internet Security 14 on a regular basis? (also..other issues come to ming: spybot seems

to nag that ad-aware may conflict with it for example)

3) Are some startup items really neccessary and how can I perminently remove them? Do people just run their computers in selective startup "forever"

THANK YOU FOR YOUR HELP!!

HERE ARE THE LOGS

JavaRa 1.13 Removal Log.Report follows after line.

---

The JavaRa removal process was started on Wed Jan 07 20:41:02 2009

Found and removed: C:\Windows\System32\jpicpl32.cplFound and removed: Software\JavaSoft\Java2D\1.5.0_06Found and removed:

SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510006Found

and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006Found and removed:

SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510006Found and removed: SOFTWARE\Classes\JavaPlugin.150_06Found and removed:

SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_06Found and removed: SOFTWARE\JavaSoft\Java

Runtime Environment\1.5Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06Found and removed: SOFTWARE\Microsoft\Code Store

Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}Found and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510006Found and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006Found and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150060}Found and removed: SOFTWARE\JavaSoft\Java Web

Start\1.5.0_06Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}Found and

removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02Found and removed: SOFTWARE\JavaSoft\Java Web

Start\1.0.1_03Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2Found and removed:

SOFTWARE\JavaSoft\Java Web Start\1.2.0_01Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}Found and removed:

Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}Found and

removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}Found and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\Found and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_06\Found and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zipFound and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zipFound and removed:

SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base

Images\jre1.5.0.b64\core3.zip

---

Finished reporting.JavaRa 1.13 Removal Log.Report follows after

line.

---

The JavaRa removal process was started on Wed Jan 07 20:41:23 2009

---

Finished reporting.





ComboFix 09-01-06.02 - Nebulagirl 2009-01-07 20:19:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1549 [GMT -5:00]
Running from: c:\documents and settings\Nebulagirl\Desktop\ComboFix.exe
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Updated)
FW: PC-cillin Internet Security - Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Nebulagirl\Application Data\inst.exe
c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

---

\Legacy_TDSSSERV.SYS

---

\Service_seneka

---

\Service_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2008-12-08 to 2009-01-08 )))))))))))))))))))))))))))))))
.

2009-01-06 22:00 . 2009-01-06 22:02 <DIR> d

---

C:\rsit
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\program files\Malwarebytes' Anti-Malware
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\documents and settings\Nebulagirl\Application Data\Malwarebytes
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-06 20:25 . 2009-01-04 18:38 38,496 --a

---

c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 20:25 . 2009-01-04 18:38 15,504 --a

---

c:\windows\system32\drivers\mbam.sys
2009-01-06 20:17 . 2009-01-06 21:58 12,288 --ahs---- c:\windows\system32\Thumbs.db
2009-01-05 02:54 . 2009-01-05 02:54 176,640 --a

---

c:\windows\system32\gmxccpae.exe
2009-01-04 23:16 . 2009-01-04 23:18 <DIR> d

---

c:\program files\Spybot - Search & Destroy
2009-01-04 23:16 . 2009-01-05 00:21 <DIR> d

---

c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 20:32 . 2009-01-04 20:32 <DIR> d

---

c:\program files\CheckIt
2009-01-04 20:28 . 2009-01-04 20:28 <DIR> d

---

c:\documents and settings\Nebulagirl\Application Data\iolo
2009-01-04 20:28 . 2009-01-04 20:28 <DIR> d

---

c:\documents and settings\All Users\Application Data\iolo
2009-01-04 02:51 . 2009-01-04 02:51 91,648 --a

---

c:\windows\system32\ulliyiks.dll
2009-01-04 02:48 . 2009-01-04 02:48 23,552 --a

---

c:\windows\system32\tyxcctpu.exe
2009-01-03 21:18 . 2009-01-05 06:26 102,400 --a

---

c:\windows\DUMP9809.tmp
2009-01-02 15:39 . 2009-01-02 15:39 40,448 --a

---

c:\windows\system32\k9261108.exe
2009-01-02 15:39 . 2009-01-02 15:39 40,448 --a

---

c:\windows\Bluvafisequpal.dll
2008-12-28 16:52 . 2004-08-03 23:07 59,264 --a

---

c:\windows\system32\drivers\USBAUDIO.sys
2008-12-28 16:52 . 2004-08-03 23:07 59,264 --a

---

c:\windows\system32\dllcache\usbaudio.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-07 02:55

---

d

---

w c:\program files\psp
2009-01-05 06:15

---

d

---

w c:\program files\Lavasoft
2009-01-05 06:11

---

d

---

w c:\program files\Common Files\Wise Installation Wizard
2009-01-05 05:21

---

d

---

w c:\program files\AskTBar
2009-01-05 04:45

---

d

---

w c:\program files\Trend Micro
2009-01-05 01:29

---

d

---

w c:\program files\TextAloud
2009-01-04 07:51

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\BitTorrent
2009-01-04 02:46

---

d

---

w c:\program files\DNA
2009-01-04 02:46

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\DNA
2009-01-03 02:36

---

d

---

w c:\program files\Windows Media Connect 2
2009-01-03 02:36

---

d

---

w c:\program files\Visual Sample Plan
2009-01-03 02:36

---

d

---

w c:\program files\viewsonic
2009-01-03 02:36

---

d

---

w c:\program files\Steam
2009-01-03 02:36

---

d

---

w c:\program files\SpongeBob SquarePants Diner Dash
2009-01-03 02:36

---

d

---

w c:\program files\Photomatix
2009-01-02 20:34

---

d

---

w c:\program files\MyNetStorage FTP
2009-01-02 20:34

---

d

---

w c:\program files\Modem Helper
2009-01-02 20:34

---

d

---

w c:\program files\DivX
2009-01-02 20:34

---

d

---

w c:\program files\CamManager
2009-01-02 20:34

---

d

---

w c:\program files\bfgclient
2009-01-02 20:34

---

d

---

w c:\program files\BFG
2009-01-02 20:34

---

d

---

w c:\program files\Avimator
2009-01-02 20:34

---

d

---

w c:\program files\Amazon
2009-01-02 20:34

---

d

---

w c:\program files\AhaView v4.01
2009-01-02 20:34

---

d

---

w c:\program files\ADSTech DVD Xpress DX2
2008-12-24 01:37

---

d

---

w c:\program files\Last.fm
2008-12-23 01:45

---

d

---

w c:\program files\BitTorrent
2008-12-10 04:13

---

d

---

w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-07 23:58

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\Skype
2008-12-07 22:01

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\skypePM
2008-12-07 17:01

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\CoreFTP
2008-12-07 00:44

---

d

---

w c:\program files\SecondLifeReleaseCandidate
2008-12-04 03:24

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\SPORE
2008-12-04 01:36

---

d

---

w c:\program files\Electronic Arts
2008-12-04 01:33

---

d--h--w c:\program files\InstallShield Installation Information
2008-11-27 19:58

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\SPORE Creature Creator
2008-11-27 04:30

---

d

---

w c:\documents and settings\All Users\Application Data\AOL
2008-11-20 04:41

---

d

---

w c:\program files\Photo Viewer
2008-11-12 02:02

---

d

---

w c:\program files\DVDVideoSoft
2008-11-12 02:02

---

d

---

w c:\program files\Common Files\DVDVideoSoft
2008-11-12 01:47

---

d

---

w c:\program files\PQDVD
2008-11-09 03:53

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\dvdcss
2008-01-09 00:13 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-11-21 18:41 47,360 ----a-w c:\documents and settings\Nebulagirl\Application Data\pcouffin.sys
2002-09-11 14:26 63,730 ----a-w c:\program files\viewsonicinstruct_xp.pdf
2008-03-29 00:49 2,828 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2005-09-26 169984]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-08-13 5562368]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2005-09-06 02:44 53248 c:\program files\Common Files\Logitech\Bluetooth\LBTWlgn.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= vvlcodec.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"VIDC.SP50"= SP5X_32.DLL
"VIDC.SP51"= SP5X_32.DLL
"VIDC.SP52"= SP5X_32.DLL
"VIDC.SP53"= SP5X_32.DLL
"msvideo3"= STVqx3tg.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VProperty.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VProperty.lnk
backup=c:\windows\pss\VProperty.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Nebulagirl^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Nebulagirl\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nebulagirl^Start Menu^Programs^Startup^Drempels Desktop.lnk]
path=c:\documents and settings\Nebulagirl\Start Menu\Programs\Startup\Drempels Desktop.lnk
backup=c:\windows\pss\Drempels Desktop.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Nebulagirl^Start Menu^Programs^Startup^Norton Disk Doctor.LNK]
path=c:\documents and settings\Nebulagirl\Start Menu\Programs\Startup\Norton Disk Doctor.LNK
backup=c:\windows\pss\Norton Disk Doctor.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTEMON.EXE]
/h [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a

---

2006-10-16 20:13 87584 c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
--a

---

2006-10-16 20:17 1941784 c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a

---

2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adokikayisuki]
--a

---

2009-01-02 15:39 40448 c:\windows\Bluvafisequpal.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
-ra

---

2006-10-23 07:50 71216 c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a

---

2006-01-02 18:41 45056 c:\program files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a

---

2007-01-15 15:14 147456 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a

---

2008-12-19 03:17 342848 c:\program files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a

---

2004-08-04 06:00 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol]

---

2005-10-31 11:51 57344 c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
--a

---

2004-12-06 02:05 127035 c:\windows\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a

---

2008-07-21 14:07 2752512 c:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a

---

2007-01-19 23:25 169984 c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a

---

2007-10-08 16:50 41824 c:\program files\Common Files\AOL\1170380176\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ImgTask]
-ra

---

2006-12-12 22:26 20480 c:\windows\Imgtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
--a

---

2006-10-18 16:58 696320 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
--a

---

2006-10-18 17:04 802816 c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a

---

2005-08-11 15:30 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a

---

2005-08-11 15:30 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a

---

2004-10-13 11:24 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a

---

2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM]
--a

---

2006-08-04 17:15 321040 c:\program files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
--a

---

2006-11-21 13:02 1807960 c:\program files\Trend Micro\Internet Security 14\pccguide.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]

---

2007-05-02 17:16 184320 c:\program files\Dell\MediaDirect\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a

---

2008-01-10 15:27 385024 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE]

---

2002-02-04 22:32 53248 c:\program files\REGSHAVE\REGSHAVE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-09-16 12:16 1833296 c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a

---

2007-06-14 20:12 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
--a

---

2006-03-08 12:48 761947 c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a

---

2008-04-28 16:35 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a

---

2006-10-16 20:12 1164912 c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]

---

2000-05-11 02:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]

---

2006-02-16 10:20 1118208 c:\program files\Creative\VoiceCenter\AndreaVC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a

---

2007-05-14 17:22 35328 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a

---

2005-08-12 23:28 28160 c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
--a

---

2006-06-29 00:12 1355042 c:\windows\system32\CTMBHA.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
--a

---

2004-12-22 05:40 24576 c:\windows\MIDIDEF.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a

---

2006-03-24 17:30 282624 c:\windows\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WD Button Manager]
--a

---

2007-04-02 19:45 339968 c:\windows\system32\WDBtnMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1170380176\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\e frontier\\Poser 7\\Poser.exe"=
"c:\\Program Files\\MyNetStorage FTP\\MyNetStorageFtp.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\CoreFTP\\coreftp.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2919:UDP"= 2919:UDP:Windows Media Format SDK (iexplore.exe)
"2918:UDP"= 2918:UDP:Windows Media Format SDK (iexplore.exe)

R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\drivers\vrtaucbl.sys [2008-01-20 30728]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2006-09-25 280392]
R4 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2009-01-04 3744]
R4 Cepstral License Server;Cepstral License Server;c:\program files\Cepstral\bin\CepstralLicSrv.exe [2007-03-15 57344]
R4 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [2009-01-04 3904]
R4 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-09-25 345696]
R4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-09-25 923216]
R4 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2006-09-25 36368]
R4 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-09-25 566872]
S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [2007-06-12 14848]
S3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\drivers\SPC610NC.sys [2005-09-07 151040]
S3 STVqx3;Intel Play QX3 Microscope;c:\windows\system32\drivers\STVqx3.SYS [2007-02-23 131776]
S3 USBCamera;Mega Camera Still Image Capture, Version 1.00;c:\windows\system32\drivers\Bulk504.sys [2007-02-08 10986]
S4 Ca504av;Mega Camera, WDM Video Capture;c:\windows\system32\drivers\CA504AV.SYS [2007-02-08 516149]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{785e543a-de16-11db-98fc-0019b951ad92}]
\Shell\AutoRun\command - F:\Autorun.exe /run
\Shell\Shell00\Command - F:\Autorun.exe /run
\Shell\Shell01\Command - F:\Autorun.exe /action
\Shell\Shell02\Command - F:\Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
\Shell\AutoRun\command - F:\Autorun.exe /run
\Shell\Shell00\Command - F:\Autorun.exe /run
\Shell\Shell01\Command - F:\Autorun.exe /action
\Shell\Shell02\Command - F:\Autorun.exe /uninstall
.
Contents of the 'Scheduled Tasks' folder

2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-OM2_Monitor - c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe
MSConfigStartUp-OpScheduler - c:\program files\ScanSoft\OmniPagePro14.0\OpScheduler.exe
MSConfigStartUp-Opware14 - c:\program files\ScanSoft\OmniPagePro14.0\Opware14.exe
MSConfigStartUp-prunnet - c:\windows\system32\prunnet.exe
MSConfigStartUp-SSBkgdUpdate - c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
MSConfigStartUp-WorkFlowTray - c:\program files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe
MSConfigStartUp-Logitech BT Wizard - LBTWiz.exe


.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.com/
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: {{0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - c:\program files\NaturalReaders\Natural Voice Text To Speech Software Standard\read.html
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\Nebulagirl\Application Data\Mozilla\Firefox\Profiles\6kut8ja0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - AOL Search
FF - prefs.js: browser.startup.homepage - hxxp://www.secret-cinema.net/index.php
FF - prefs.js: keyword.URL - hxxp://aolsearch.aol.com/aol/search?invocationType=client_searchbox&query=
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 20:27:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\Microsoft\Windows\CurrentVersion\Shell

Extensions\Approved\{482A2F67-027E-96D5-EC9B-391B6B293AD5}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"eajpichocg"=hex:66,61,64,70,69,66,6b,62,6c,6b,65,61,00,fc
"daepfhfg"=hex:64,62,6c,62,61,6b,68,6f,6d,65,6d,64,6c,69,6d,65,69,67,66,6f,62,\
69,6f,65,6c,63,67,62,6f,64,6d,63,6f,6b,67,69,62,67,6e,69,00,00
"iabccpikhblijdlpah"=hex:6a,61,6f,63,65,63,6d,64,64,64,70,68,70,68,6e,70,67,62,\
6d,66,00,5a
"halbaakgefcalpdd"=hex:6a,61,6f,63,65,63,6d,64,64,64,70,68,70,68,6e,70,67,62,\
6d,66,00,97

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*NULL*]
"??"=hex:54,94,af,b6,64,a1,5f,ea,52,92,b6,b0,7e,e6,50,12,db,18,a7,51,a5,48,b5,\
2d,a1,a8,db,2f,c6,6a,40,99,9d,e3,d8,8f,ef,84,80,1b,39,fa,88,d1,c3,76,7b,6d,\
c5,af,fa,6b,53,22,42,2d,5a,d5,64,06,2a,43,2d,4c,e2,b0,dc,49,71,fa,5a,3a,cc,\
6e,02,f5,e2,13,da,6f,a3,42,6b,31,20,c1,cf,7a,7f,c4,75,d3,99,09,03,91,14,9e,\
cb,ad,f1,e9,67,9d,e9,dc,a2,ae,f1,7a,50,84,b3,dc,48,e0,57,9d,85,42,39,b5,03,\
ef,af,96,0c,23,fe,ae,d6,31,8b,40,c1,06,76,08,d7,bd,6c,2c,f0,e3,17,c4,ea,a8,\
f5,48,02,1c,0d,aa,9e,9c,93,e1,19,b1,b3,a0,6e,e7,22,bd,f0,f7,6d,b4,5d,d3,3a,\
c2,4e,62,a4,3c,ca,82,ff,dd,1b,d7,72,c2,ed,7d,b7,f4,d1,26,4e,fa,24,97,cc,96,\
0c,b5,67,38,60,66,50,51,84,64,9a,bb,38,2c,db,9c,63,81,a8,4a,72,05,32,ee,0b,\
ba,e6,2c,91,b3,74,47,46,f4,d3,9a,b4,d5,87,36,fc,65,a7,44,92,c9,de,ef,d9,8a,\
6a,22,26,00,a6,04,f0,36,5a,89,13,35,92,1f,60,26,bf,89,c3,02,50,45,e3,a0,74,\
5e,8a,e5,d3,92,f9,37,d1,a5,80,5e,cc,9d,09,b9,00,1f,48,12,19,02,d3,89,f2,fb,\
25,d3,07,ba,cf,79,d3,ab,99,f1,fd,31,df,8e,62,3e,78,84,51,7b,7c,0f,70,8c,67,\
ab,eb,07,f3,3e,a6,0e,a6,3c,58,f6,96,7f,03,36,22,e0,9b,c1,22,df,83,57,8a,15,\
70,a3,99,1a,55,17,cc,47,39,0d,70,05,da,be,f9,77,d0,66,0a,2c,ef,92,46,5b,cd,\
6d,5d,89,49,bd,eb,e2,0c,53,ad,13,fb,30,01,3f,13,d0,5c,a0,2a,06,08,49,25,b5,\
6b,05,c6,89,97,cb,cf,87,b7,dd,fe,12,cb,12,f7,68,1d,7b,dd,61,77,a3,fe,2f,9a,\
ca,30,39,cf,79,0f,72,db,98,52,58,55,2a,72,28,2d,5a,72,28,35,5a
"??"=hex:f6,5d,71,86,c6,3a,33,75,98,25,8c,5e,45,26,b6,9f

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\SecuROM\License information*NULL*]
"datasecu"=hex:99,8f,93,d1,99,7c,0a,7a,2d,f6,81,c1,a0,2d,cb,1e,c3,1a,58,da,7e,\
2b,7d,64,80,ce,d3,af,c7,03,af,3e,0f,bf,bf,17,fd,c7,8f,86,76,74,df,0d,5d,02,\
a9,87,79,3f,83,c8,a9,94,ce,65,a5,88,d0,4c,75,e6,85,94,2b,30,fc,4b,6d,b0,da,\
66,de,20,60,57,b5,bd,15,46,4d,31,65,ee,bc,01,75,7c,4e,c7,1b,0c,c2,7a,27,d5,\
6a,e5,45,7b,1d,92,2c,f5,c6,c0,c3,90,25,2d,41,a0,75,3b,61,ba,05,85,d2,69,36,\
62,0f,71,44,b4,3b,ed,3e,47,8f,a6,fb,15,b2,e3,5d,21,91,c4,25,70,a9,3a,57,a1,\
a7,17,fa,81,dd,11,80,b7,be,f1,1a,c3,b6,d6,56,6b,5e,5e,d8,b0,12,4c,d0,23,2b,\
a7,9b,b9,03,aa,dc,7f,4e,c4,72,cb,56,a5,6b,74,3d,5c,1d,2d,ef,fc,22,59,2e,a7,\
0d,15,fa,71,3e,ed,d8,42,85,13,ed,5e,6b,38,d8,35,51,a8,88,cf,fb,3f,9e,26,69,\
a9,1d,7c,39,3e,73,51,61,97,c6,ed,9e,9c,fb,df,17,03,94,99,d6,b4,a9,dc,d5,65,\
2a,06,54,76,ff,02,81,91,92,cc,35,57,1b,31,30,ff,e3,e3,90,57,7a,91,8c,5d,4c,\
ca,3c,62,21,b1,05,85,c3,90,ba,77,3e,48,a3,18,3d,85,de,ce,5f,0a,cd,d6,cf,eb,\
66,6c,c0,fb,3b,15,1d,a1,5e,7e,cc,5e,05,f9,72,c8,3f,ff,f3,ef,ea,c4,7f,dd,2f,\
76,c9,3d,e7,0f,b0,00,a9,63,23,77,95,29,f4,a2,d6,c6,8d,fd,ed,17,c1,7f,cd,99,\
99,2c,43,fd,58,3e,fc,a6,2c,1c,ed,a8,3b,27,71,ad,21,bd,c1,8d,2b,c5,d8,d6,61,\
24,07,60,c2,90,1e,67,83,8c,ae,15,b7,a1,70,ea,97,70,12,7a,51,b2,43,87,db,ec,\
84,9e,9c,64,8d,54,56,ff,9e,0e,01,61,57,1d,19,d9,a3,83,df,1c,f3,a0,65,92,88,\
3d,49,ad,73,7d,87,49,98,81,b4,71,d9,a2,7b,8e,76,c6,2b,7c,b9,4d,5d,b3,bf,60,\
52,53,db,a9,16,e8,62,30,14,20,44,ca,83,1b,57,ba,ef,15,4d,0b,9f,1d,5a,24,fc,\
ba,f9,2d,63,c0,b9,3f,8a,5b,db,0a,fb,d6,69,33,58,9a,d2,6e,ee,c8,90,ce,0b,b7,\
06,a4,71,6a,f7,01,95,77,0f,72,d5,68,71,21,97,fc,e9,5e,c9,dc,75,12,48,64,df,\
a3,4d,94,7d,cb,6f,e7,31,0e,c4,d8,43,ec,43,05,1e,63,e6,01,cb,16,c7,3e,8c,d5,\
f2,b8,4b,70,f0,d1,b8,21,58,ab,23,21,9d,53,a4,f0,57,12,ea,60,1e,09,6f,a9,7d,\
c8,65,a6,30,2a,00,5f,fa,72,31,4f,bd,b6,a6,bd,6e,8b,c7,c5,96,4b,11,e2,dd,e3,\
20,14,09,02,32,70,7b,55,66,2e,1c,d1,19,e9,b6,5b,67,b4,f2,d9,7d,b9,ab,d3,56,\
ab,b5,59,3f,3c,26,96,fc,77,0b,74,08,50,e2,16,7e,25,39,6d,ae,c2,ab,fb,1c,80,\
6c,b9,52,dd,21,e2,dc,82,a3,4e,ca,9c,0c,9f,c6,09,b1,5f,73,4f,fb,da,a1,fc,4e,\
b9,c6,1b,14,55,dc,05,65,4f,e1,79,4c,ad,23,0a,5d,1d,ca,90,ae,62,63,ec,87,17,\
e1,4e,56,c0,d6,7f,af,32,cf,18,7f,d5,2b,46,26,6d,76,f2,cb,3e,4c,a2,46,9c,6a,\
e5,30,c9,93,9a,60,ce,d7,87,03,19,44,51,b3,45,41,b3,0d,cd,78,52,d9,f9,27,6c,\
f7,2d,9c,31,0c,a5,48,55,59,53,4a,2f,c7,b9,7b,da,db,b0,01,97,56,29,26,b1,18,\
b0,79,08,ae,71,7f,f3,bf,b6,0d,ec,fe,50,5a,cc,19,8f,36,c1,28,49,be,90,07,cb,\
88,33,08,ba,f5,fd,2c,e7,21,dd,c3,44,7b,11,6c,f9,b7,c0,38,8d,43,c2,2c,ab,f7,\
9e,e5,36,af,ca,8b,be,a2,b1,79,c5,8a,9d,8f,92,3d,8c,1f,8f,e4,fb,4a,9d,39,1d,\
07,e9,87,db,b4,a3,8d,d3,05,73,9d,2f,66,8c,d1,6e,8d,25,34,bf,cc,d3,5f,46,f2,\
89,68,4d,35,c1,34,b3,05,6a,9f,8a,00,60,22,b6,6c,7a,66,cd,38,30,fe,e4,eb,30,\
d4,1a,ef,b5,c5,db,26,a2,2b,78,0b,55,f1,2a,e1,b1,48,c1,07,98,31,ea,e1,e9,d2,\
0e,c2,a0,2b,39,13,33,6e,55,26,67,20,30,54,07,42,33,c3,4c,ac,04,3f,09,4f,63,\
5b,e8,d1,4a,58,02,9b,95,85,2e,37,31,05,01,71,7e,56,45,b8,8c,18,7f,e3,e5,b2,\
3a,c3,5d,7d,1f,ff,b2,bc,7c,ab,80,3c,eb,53,df,c1,88,19,7c,22,2a,f9,60,d6,00,\
1e,a4,3a,0b,c7,19,dc,f0,7c,4a,e7,d0,0c,5f,70,ee,ab,ef,eb,96,ab,a5,04,fe,84,\
f5,a4,fe,8d,1b,4e,a0,29,ef,a1,9b,80,3d,b5,19,78,71,2c,98,27,c0,3a,10,2c,87,\
55,a2,46,50,b8,16,a8,53,87,62,31,c3,b5,46,bd,ce,eb,ca,17,50,4d,74,60,5d,68,\
67,9a,af,43,66,7f,14,cb,16,77,87,88,77,9d,21,16,26,ed,8b,ef,55,37,81,e0,8e,\
25,dd,3a,16,c3,62,83,5b,ae,29,15,21,9a,1c,1b,39,df,d8,6d,05,ad,07,18,f6,39,\
77,a2,ae,a7,d1,20,67,8e,d0,c0,1d,4e,d3,f0,5f,bb,96,dc,c7,40,93,ce,f5,39,34,\
e1,52,1e,d0,81,6b,f0,00,10,d2,05,35,d3,c0,4a,bd,48,62,56,e1,bb,94,57,c3,78,\
88,1c,21,d6,a6,e9,5a,c6,a0,6d,c9,56,d3,48,32,22,f9,2f,44,f6,2c,92,cd,ec,b1,\
dc,9d,60,fb,f6,58,08,a1,73,85,73,e9,0e,57,58,96,46,ae,c8,65,ee,c4,f2,c3,55,\
38,83,34,c8,5d,18,d8,3e,4e,dd,e4,c2,f0,20,c6,8b,ec,9d,15,7d,a7,62,b3,26,6d,\
84,2d,a3,97,7c,95,d2,e5,01,bd,84,f9,68,7d,c2,d8,69,1d,35,ec,11,7b,ee,98,4c,\
2e,70,14,81,7a,dc,6e,17,32,77,48,ff,fd,79,13,96,58,e1,14,5b,3e,d6,dd,4d,56,\
b7,4a,d1,0c,c7,35,a2,7a,d3,5b,60,d9,af,0b,bc,1c,e9,d2,f4,92,2e,d9,31,d0,92,\
90,e4,19,d8,cb,37,b4,e8,a8,1e,1d,3a,c8,5a,e1,24,17,f0,6d,1b,ed,69,fa,0a,45,\
0e,0c,fa,66,db,09,75,97,f5,f9,48,de,5c,36,4c,ff,05,29,5d,4b,8a,30,e4,cc,8a,\
7d,19,5c,25,cc,35,1c,02,48,a0,c5,2f,1f,47,a7,8a,52,16,8a,ec,10,4a,c7,8a,56,\
0c,fb,e8,30,92,4c,83,63,72,54,7c,18,25,c6,c9,1b,cc,e2,04,9d,41,ae,f1,6c,4d,\
e1,af,3a,2b,f1,09,34,60,1c,4e,d7,cb,55,f5,89,44,5c,da,d7,e3,2f,20,e0,1d,8c,\
f4,5f,f2,a9,f1,61,5b,bc,3b,a2,53,2c,27,e8,4f,68,07,c6,e6,60,ea,60,c6,51,80,\
50,a7,a7,4d,4a,9a,21,b9,b6,c9,8c,dd,8f,42,c2,73,93,ae,7d,ac,93,da,e4,9b,a9,\
8c,9e,2b,91,ae,af,59,68,eb,ac,3d,ff,a8,79,7f,0f,69,a9,b6,5a,c1,e9,7d,e0,65,\
42,65,c5,b0,84,d1,8b,8b,16,a0,1f,1b,67,db,f8,cd,09,6c,10,ea,92,33,73,c5,f5,\
20,b3,ae,e5,14,86,b1,40,ff,fc,b8,9f,d9,33,5b,6c,b9,1e,e5,50,2c,10,68,d8,12,\
ab,e9,c5,27,a2,5e,3e,1c,56,c6,00,39,d4,4d,b6,e1,c3,dc,f5,23,ac,08,4b,f7,d0,\
19,5d,e0,a1,8e,50,8b,f5,bd,c4,c8,45,14,9e,45,20,bd,fb,76,d7,d9,e6,d3,3f,c3,\
97,aa,25,3c,ae,ab,4c,c7,7e,52,ee,74,a3,34,cc,c2,d5,f8,93,bf,22,cd,75,b9,00,\
e5,36,3a,18,39,ac,e3,86,8c,2d,0f,c2,95,fe,a2,f6,59,28,73,fa,64,c9,b5,dd,de,\
c9,3d,96,ac,e7,26,df,89,5d,18,a3,52,95,6d,9d,21,e8,5e,fc,69,31,b2,a2,04,4c,\
cc,5b,40,37,59,82,87,5b,f0,03,dc,b1,00,71,10,b1,1d,d2,21,d7,57,f5,a7,ed,89,\
1f,6d,29,52,1c,6f,3d,2d,2c,de,44,69,b7,eb,0b,4b,b1,a2,ce,98,90,db,c3,55,4f,\
3a,84,3c,d3,a3,d0,fd,2d,e5,8e,e8,67,18,d8,06,a9,92,a4,e9,44,2a,9f,94,ba,68,\
2d,14,d9,cf,b7,8b,b4,7b,f9,f2,52,ea,4b,a0,83,a6,0d,e4,fd,cc,c0,f1,f4,af,b6,\
3b,f0,bd,f1,e4,4c,ea,77,ea,b3,d7,a9,85,81,13,5c,94,9a,bb,08,50,a6,b5,8f,a2,\
b1,8f,2f,cd,2d,d1,70,1d,06,af,36,2d,90,2c,de,84,3d,66,22,12,6c,09,33,ad,6f,\
27,6e,85,fd,cb,47,36,3e,23,cf,22,ce,a9,8c,73,89,6a,75,69,2e,c5,4b,00,76,8c,\
4f,4d,a6,b5,99,80,76,6f,f5,72,6f,03,fe,5a,5c,6b,11,cb,0c,3c,56,6e,fb,33,2c,\
5b,2a,bc,85,af,96,60,7b,1d,de,c1,ef,75,b5,fc,4c,a6,55,7f,2d,4f,e2,a0,a8,71,\
30,6c,03,8f,0d,8b,65,e9,86,be,73,95,39,35,af,e9,6e,0d,c6,37,39,9c,6f,71,c9,\
57,de,eb,62,4a,1f,bf,a3,ca,98,da,45,7e,e0,83,37,4c,e6,f9,54,11,77,a3,5b,ae,\
4b,e6,96,5d,46,d7,2b,b3,00,f0,c2,47,64,4d,ba,8a,dd,99,a2,91,0d,7e,15,53,37,\
39,0c,5d,28,51,ff,4a,b0,cf,7a,7b,b6,d7,5f,03,74,26,26,25,6f,63,a5,4e,e6,db,\
7b,9c,73,ba,26,d5,49,d5,c4,a3,99,f5,c2,35,b4,07,85,25,eb,05,4b,ee,3e,81,df,\
e0,e8,61,3f,24,f5,47,ae,eb,37,e2,5f,77,52,20,d7,3c,e5,4e,5e,a0,52,b5,79,74,\
05,be,b4,2d,5b,0b,3c,f5,52,52,8f,de,2c,88,97,50,34,02,f9,8a,79,f0,82,fb,c1,\
d2,c0,4b,30,f0,9d,bb,8b,d9,0b,74,fa,56,e7,75,6c,12,1b,a4,63,0e,74,fe,88,86,\
0a,24,4e,26,a8,bb,df,0c,62,33,34,29,94,29,9a,03,1d,44,bd,04,60,79,a0,8b,d5,\
7b,f6,b6,58,92,65,3f,11,33,fc,ca,fe,50,d5,c4,8e,ff,66,30,93,27,4b,39,99,ef,\
53,91,3e,20,13,4f,9b,66,41,bf,b7,1c,f4,9e,3a,d9,84,4c,44,7e,0c,05,f1,45,d2,\
e3,8e,7e,da,45,6b,7c,ca,8b,1b,91,56,7a,5d,9e,3e,ef,72,2a,df,43,94,23,86,32,\
01,73,dd,6f,af,7f,2d,df,de,c3,78,d1,94,35,91,67,a6,dc,69,7a,d0,fc,20,38,7e,\
f3,90,d6,ea,2f,8b,c0,eb,79,38,94,26,07,3b,28,10,0c,e7,ff,be,74,b5,9f,24,7e,\
5e,b9,cc,e9,07,37,24,ef,c7,9e,1b,af,e2,b2,27,f2,13,85,df,1d,b8,6d,90,ba,c3,\
65,30,8d,e2,9b,e1,4b,92,35,8d,73,ac,aa,bb,a0,8f,24,b2,47,15,77,79,49,10,5f,\
b7,1f,a2,31,da,36,96,d9,d1,89,80,e6,6e,03,46,08,84,5a,c0,6d,a2,e9,a0,6f,2a,\
0a,84,46,dd,31,42,bc,73,1c,b1,50,7b,8d,ea,b9,d5,97,0f,d5,41,16,90,48,25,31,\
e3,e0,1e,90,17,d0,7c,4e,f7,8f,cf,05,65,35,a6,0e,31,9f,d7,10,cf,bb,99,64,32,\
88,6d,63,ad,64,df,04,76,7b,d9,f0,aa,94,6e,9c,b2,14,9e,83,50,16,58,2f,b7,1e
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*NULL*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'winlogon.exe'(1560)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(1616)
c:\windows\system32\relog_ap.dll
.

---

Other Running Processes

---

.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\progra~1\TRENDM~1\INTERN~1\PcCtlCom.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\PAStiSvc.exe
c:\windows\wanmpsvc.exe
c:\windows\SoftwareDistribution\Download\7684fcdc5c1747eb53ef3c2d202add11\update\update.exe
.
**************************************************************************
.
Completion time: 2009-01-07 20:37:01 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-08 01:35:43

Pre-Run: 51,113,582,592 bytes free
Post-Run: 50,952,830,976 bytes free

496

Katana

Information

Teatimer is popping up a lot of changes to the registry. some look legit others mysterious. I did not write them all down. I just denied them. this one keeps popping even if I deny it:
1) I used the flash disinfector. May I ask for guidance on how to "disinfect" all my external hard drives in case there are bad items there?

2 What programs do you recommend I use to supplement my PC-cillin Internet Security 14 on a regular basis?

3) Are some startup items really neccessary and how can I perminently remove them? Do people just run their computers in selective startup "forever"

You need to leave Teatimer disabled until we are finished.
1)We will cover that as we do the clean
2)I will give you some reommendations to stay clean when we are finished
3)I use Winpatrol, I will give you a link to it soon.

---

---

Please ensure that any USB/Flash/External drives are connected whilst we are cleaning your machine.

---

---

Step 1

Disable Teatimer
We need to disable Teatimer as it may interfere with the cleaning.
Please do not re-enable it until I give instructions.

First step:

• Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
• If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
• If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

• Open Spybot S&D
• Click Mode, choose Advanced Mode
• Go To the bottom of the Vertical Panel on the Left, Click Tools
• then, also in left panel, click Resident shows a red/white shield.
• If your firewall raises a question, say OK
• In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
• OK any prompts.
• Use File, Exit to terminate Spybot
• Reboot your machine for the changes to take effect.

---

---

Step 2

Custom CFScript

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  

  http://icrontic.com/forum/showthread.php?p=664382#post664382
  Comment:: Katana
  Suspect::[4]
  c:\windows\system32\gmxccpae.exe
  c:\windows\system32\ulliyiks.dll
  c:\windows\system32\tyxcctpu.exe
  c:\windows\system32\k9261108.exe
  c:\windows\Bluvafisequpal.dll
  File::
  c:\windows\system32\gmxccpae.exe
  c:\windows\system32\ulliyiks.dll
  c:\windows\system32\tyxcctpu.exe
  c:\windows\system32\k9261108.exe
  c:\windows\Bluvafisequpal.dll
  Registry::
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTEMON.EXE]
  [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{785e543a-de16-11db-98fc-0019b951ad92}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
  ADS::
  

• Save this as CFScript.txt and place it on your desktop.
  
  
  
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  
• When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
  
• A window will open asking you to ensure you are connected to the internet, this is so a file can be submitted for analysis.
  
• Click OK and follow the instructions to submit the file.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

---

---

Step 3

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

---

---

Step 4


Logs/Information to Post in Reply
Please post the following logs/Information in your reply

• Combofix Log
• Kaspersky Log
• How are things running now ?

vulcansage

Thank you!

I will do these steps and post the logs when I am home tonight.

FYI
The system was stable last night, with no crashes for several hours of operation. It shut down normally without any hanging of the system.

vulcansage

Here is the Latest ComboFix Log after following your latest instructions. The Kaspersky is at 3%. I will post it as soon as it finishes and give a status update on how things are running.

ComboFix 09-01-06.02 - Nebulagirl 2009-01-08 19:36:59.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1393 [GMT -5:00]
Running from: c:\documents and settings\Nebulagirl\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Nebulagirl\Desktop\CFScript.txt
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Updated)
FW: PC-cillin Internet Security - Firewall *disabled*
* Created a new restore point

FILE ::
c:\windows\Bluvafisequpal.dll
c:\windows\system32\gmxccpae.exe
c:\windows\system32\k9261108.exe
c:\windows\system32\tyxcctpu.exe
c:\windows\system32\ulliyiks.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Bluvafisequpal.dll
c:\windows\system32\gmxccpae.exe
c:\windows\system32\k9261108.exe
c:\windows\system32\tyxcctpu.exe
c:\windows\system32\ulliyiks.dll
H:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-12-09 to 2009-01-09 )))))))))))))))))))))))))))))))
.

2009-01-08 00:38 . 2009-01-08 00:38 0 --a

---

c:\windows\Dvm.INI
2009-01-08 00:26 . 2009-01-08 00:26 <DIR> d

---

c:\program files\Thomson
2009-01-07 21:24 . 2009-01-07 21:24 134,656 --a

---

c:\windows\omiriheh.dll
2009-01-07 20:44 . 2009-01-07 20:43 410,984 --a

---

c:\windows\system32\deploytk.dll
2009-01-07 20:44 . 2009-01-07 20:43 73,728 --a

---

c:\windows\system32\javacpl.cpl
2009-01-06 22:00 . 2009-01-06 22:02 <DIR> d

---

C:\rsit
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\program files\Malwarebytes' Anti-Malware
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\documents and settings\Nebulagirl\Application Data\Malwarebytes
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-06 20:25 . 2009-01-04 18:38 38,496 --a

---

c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 20:25 . 2009-01-04 18:38 15,504 --a

---

c:\windows\system32\drivers\mbam.sys
2009-01-06 20:17 . 2009-01-06 21:58 12,288 --ahs---- c:\windows\system32\Thumbs.db
2009-01-04 23:16 . 2009-01-04 23:18 <DIR> d

---

c:\program files\Spybot - Search & Destroy
2009-01-04 23:16 . 2009-01-05 00:21 <DIR> d

---

c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 20:32 . 2009-01-04 20:32 <DIR> d

---

c:\program files\CheckIt
2009-01-04 20:28 . 2009-01-04 20:28 <DIR> d

---

c:\documents and settings\Nebulagirl\Application Data\iolo
2009-01-04 20:28 . 2009-01-04 20:28 <DIR> d

---

c:\documents and settings\All Users\Application Data\iolo
2009-01-03 21:18 . 2009-01-05 06:26 102,400 --a

---

c:\windows\DUMP9809.tmp
2008-12-28 16:52 . 2004-08-03 23:07 59,264 --a

---

c:\windows\system32\drivers\USBAUDIO.sys
2008-12-28 16:52 . 2004-08-03 23:07 59,264 --a

---

c:\windows\system32\dllcache\usbaudio.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-08 05:46

---

d

---

w c:\program files\Google
2009-01-08 05:26

---

d--h--w c:\program files\InstallShield Installation Information
2009-01-08 05:10

---

d

---

w c:\program files\TextAloud
2009-01-08 03:41

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\BitTorrent
2009-01-08 02:08

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\DNA
2009-01-08 01:58

---

d

---

w c:\program files\DNA
2009-01-08 01:43

---

d

---

w c:\program files\Java
2009-01-07 02:55

---

d

---

w c:\program files\psp
2009-01-05 06:15

---

d

---

w c:\program files\Lavasoft
2009-01-05 06:11

---

d

---

w c:\program files\Common Files\Wise Installation Wizard
2009-01-05 05:21

---

d

---

w c:\program files\AskTBar
2009-01-05 04:45

---

d

---

w c:\program files\Trend Micro
2009-01-03 02:36

---

d

---

w c:\program files\Windows Media Connect 2
2009-01-03 02:36

---

d

---

w c:\program files\Visual Sample Plan
2009-01-03 02:36

---

d

---

w c:\program files\viewsonic
2009-01-03 02:36

---

d

---

w c:\program files\Steam
2009-01-03 02:36

---

d

---

w c:\program files\SpongeBob SquarePants Diner Dash
2009-01-03 02:36

---

d

---

w c:\program files\Photomatix
2009-01-02 20:34

---

d

---

w c:\program files\MyNetStorage FTP
2009-01-02 20:34

---

d

---

w c:\program files\Modem Helper
2009-01-02 20:34

---

d

---

w c:\program files\DivX
2009-01-02 20:34

---

d

---

w c:\program files\CamManager
2009-01-02 20:34

---

d

---

w c:\program files\bfgclient
2009-01-02 20:34

---

d

---

w c:\program files\BFG
2009-01-02 20:34

---

d

---

w c:\program files\Avimator
2009-01-02 20:34

---

d

---

w c:\program files\Amazon
2009-01-02 20:34

---

d

---

w c:\program files\AhaView v4.01
2009-01-02 20:34

---

d

---

w c:\program files\ADSTech DVD Xpress DX2
2008-12-24 01:37

---

d

---

w c:\program files\Last.fm
2008-12-23 01:45

---

d

---

w c:\program files\BitTorrent
2008-12-10 04:13

---

d

---

w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-07 23:58

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\Skype
2008-12-07 22:01

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\skypePM
2008-12-07 17:01

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\CoreFTP
2008-12-07 00:44

---

d

---

w c:\program files\SecondLifeReleaseCandidate
2008-12-04 03:24

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\SPORE
2008-12-04 01:36

---

d

---

w c:\program files\Electronic Arts
2008-11-27 19:58

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\SPORE Creature Creator
2008-11-27 04:30

---

d

---

w c:\documents and settings\All Users\Application Data\AOL
2008-11-20 04:41

---

d

---

w c:\program files\Photo Viewer
2008-11-12 02:02

---

d

---

w c:\program files\DVDVideoSoft
2008-11-12 02:02

---

d

---

w c:\program files\Common Files\DVDVideoSoft
2008-11-12 01:47

---

d

---

w c:\program files\PQDVD
2008-11-09 03:53

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\dvdcss
2008-01-09 00:13 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-11-21 18:41 47,360 ----a-w c:\documents and settings\Nebulagirl\Application Data\pcouffin.sys
2002-09-11 14:26 63,730 ----a-w c:\program files\viewsonicinstruct_xp.pdf
2008-03-29 00:49 2,828 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2009-01-07_20.34.04.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-11-10 17:27:06 49,248 ----a-w c:\windows\system32\java.exe
+ 2009-01-08 01:43:41 144,792 ----a-w c:\windows\system32\java.exe
- 2005-11-10 17:27:16 49,250 ----a-w c:\windows\system32\javaw.exe
+ 2009-01-08 01:43:41 144,792 ----a-w c:\windows\system32\javaw.exe
- 2005-11-10 19:03:54 127,078 ----a-w c:\windows\system32\javaws.exe
+ 2009-01-08 01:43:41 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2009-01-09 00:45:39 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_534.dat
+ 2009-01-09 00:45:39 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-10-16 1164912]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 185896]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-10 385024]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-05-02 184320]
"pccguide.exe"="c:\program files\Trend Micro\Internet Security 14\pccguide.exe" [2006-11-21 1807960]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"ImgTask"="c:\windows\Imgtask.exe" [2006-12-12 20480]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2006-10-16 1941784]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-10-16 87584]
"Ysomaciwiquloya"="c:\windows\omiriheh.dll" [2009-01-07 134656]
"HostManager"="c:\program files\Common Files\AOL\1170380176\ee\AOLSoftware.exe" [2007-10-08 41824]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"WD Button Manager"="WDBtnMgr.exe" [2007-04-02 c:\windows\system32\WDBtnMgr.exe]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]
"MBMon"="CTMBHA.DLL" [2006-06-29 c:\windows\system32\CTMBHA.DLL]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-08-12 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-08-13 5562368]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 622653]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-01-25 528384]
VProperty.lnk - c:\windows\VPro610.exe [2005-10-17 463360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2005-09-06 02:44 53248 c:\program files\Common Files\Logitech\Bluetooth\LBTWlgn.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= vvlcodec.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"VIDC.SP50"= SP5X_32.DLL
"VIDC.SP51"= SP5X_32.DLL
"VIDC.SP52"= SP5X_32.DLL
"VIDC.SP53"= SP5X_32.DLL
"msvideo3"= STVqx3tg.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1170380176\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\e frontier\\Poser 7\\Poser.exe"=
"c:\\Program Files\\MyNetStorage FTP\\MyNetStorageFtp.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\CoreFTP\\coreftp.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2919:UDP"= 2919:UDP:Windows Media Format SDK (iexplore.exe)
"2918:UDP"= 2918:UDP:Windows Media Format SDK (iexplore.exe)

R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\drivers\vrtaucbl.sys [2008-01-20 30728]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2006-09-25 280392]
R4 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2009-01-04 3744]
R4 Cepstral License Server;Cepstral License Server;c:\program files\Cepstral\bin\CepstralLicSrv.exe [2007-03-15 57344]
R4 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [2009-01-04 3904]
R4 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2006-09-25 36368]
S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [2007-06-12 14848]
S3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\drivers\SPC610NC.sys [2005-09-07 151040]
S3 STVqx3;Intel Play QX3 Microscope;c:\windows\system32\drivers\STVqx3.SYS [2007-02-23 131776]
S3 USBCamera;Mega Camera Still Image Capture, Version 1.00;c:\windows\system32\drivers\Bulk504.sys [2007-02-08 10986]
S4 Ca504av;Mega Camera, WDM Video Capture;c:\windows\system32\drivers\CA504AV.SYS [2007-02-08 516149]
S4 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-09-25 345696]
S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-09-25 923216]
S4 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-09-25 566872]

--- Other Services/Drivers In Memory ---

*Deregistered* - ATWPKT2

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39f8f5c6-abd5-11db-987d-0019b951ad92}]
\Shell\AutoRun\command - G:\Autorun.exe /run
\Shell\Shell00\Command - G:\Autorun.exe /run
\Shell\Shell01\Command - G:\Autorun.exe /action
\Shell\Shell02\Command - G:\Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{785e543a-de16-11db-98fc-0019b951ad92}]
\Shell\AutoRun\command - F:\Autorun.exe /run
\Shell\Shell00\Command - F:\Autorun.exe /run
\Shell\Shell01\Command - F:\Autorun.exe /action
\Shell\Shell02\Command - F:\Autorun.exe /uninstall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
\Shell\AutoRun\command - F:\Autorun.exe /run
\Shell\Shell00\Command - F:\Autorun.exe /run
\Shell\Shell01\Command - F:\Autorun.exe /action
\Shell\Shell02\Command - F:\Autorun.exe /uninstall
.
Contents of the 'Scheduled Tasks' folder

2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -

BHO-{2bf595ab-99c0-44a9-b2cc-25fa2b582ec0} - (no file)
BHO-{D764A60D-8064-4C41-80AB-233E746181CE} - (no file)
HKLM-Run-Adokikayisuki - c:\windows\Bluvafisequpal.dll
Notify-hgGxWnOh - (no file)


.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.com/
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: {{0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - c:\program files\NaturalReaders\Natural Voice Text To Speech Software Standard\read.html
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\Nebulagirl\Application Data\Mozilla\Firefox\Profiles\6kut8ja0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - AOL Search
FF - prefs.js: browser.startup.homepage - hxxp://www.secret-cinema.net/index.php
FF - prefs.js: keyword.URL - hxxp://aolsearch.aol.com/aol/search?invocationType=client_searchbox&query=
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-08 19:47:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{482A2F67-027E-96D5-EC9B-391B6B293AD5}*NULL*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"eajpichocg"=hex:66,61,64,70,69,66,6b,62,6c,6b,65,61,00,fc
"daepfhfg"=hex:64,62,6c,62,61,6b,68,6f,6d,65,6d,64,6c,69,6d,65,69,67,66,6f,62,\
69,6f,65,6c,63,67,62,6f,64,6d,63,6f,6b,67,69,62,67,6e,69,00,00
"iabccpikhblijdlpah"=hex:6a,61,6f,63,65,63,6d,64,64,64,70,68,70,68,6e,70,67,62,\
6d,66,00,5a
"halbaakgefcalpdd"=hex:6a,61,6f,63,65,63,6d,64,64,64,70,68,70,68,6e,70,67,62,\
6d,66,00,97

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*NULL*]
"??"=hex:54,94,af,b6,64,a1,5f,ea,52,92,b6,b0,7e,e6,50,12,db,18,a7,51,a5,48,b5,\
2d,a1,a8,db,2f,c6,6a,40,99,9d,e3,d8,8f,ef,84,80,1b,39,fa,88,d1,c3,76,7b,6d,\
c5,af,fa,6b,53,22,42,2d,5a,d5,64,06,2a,43,2d,4c,e2,b0,dc,49,71,fa,5a,3a,cc,\
6e,02,f5,e2,13,da,6f,a3,42,6b,31,20,c1,cf,7a,7f,c4,75,d3,99,09,03,91,14,9e,\
cb,ad,f1,e9,67,9d,e9,dc,a2,ae,f1,7a,50,84,b3,dc,48,e0,57,9d,85,42,39,b5,03,\
ef,af,96,0c,23,fe,ae,d6,31,8b,40,c1,06,76,08,d7,bd,6c,2c,f0,e3,17,c4,ea,a8,\
f5,48,02,1c,0d,aa,9e,9c,93,e1,19,b1,b3,a0,6e,e7,22,bd,f0,f7,6d,b4,5d,d3,3a,\
c2,4e,62,a4,3c,ca,82,ff,dd,1b,d7,72,c2,ed,7d,b7,f4,d1,26,4e,fa,24,97,cc,96,\
0c,b5,67,38,60,66,50,51,84,64,9a,bb,38,2c,db,9c,63,81,a8,4a,72,05,32,ee,0b,\
ba,e6,2c,91,b3,74,47,46,f4,d3,9a,b4,d5,87,36,fc,65,a7,44,92,c9,de,ef,d9,8a,\
6a,22,26,00,a6,04,f0,36,5a,89,13,35,92,1f,60,26,bf,89,c3,02,50,45,e3,a0,74,\
5e,8a,e5,d3,92,f9,37,d1,a5,80,5e,cc,9d,09,b9,00,1f,48,12,19,02,d3,89,f2,fb,\
25,d3,07,ba,cf,79,d3,ab,99,f1,fd,31,df,8e,62,3e,78,84,51,7b,7c,0f,70,8c,67,\
ab,eb,07,f3,3e,a6,0e,a6,3c,58,f6,96,7f,03,36,22,e0,9b,c1,22,df,83,57,8a,15,\
70,a3,99,1a,55,17,cc,47,39,0d,70,05,da,be,f9,77,d0,66,0a,2c,ef,92,46,5b,cd,\
6d,5d,89,49,bd,eb,e2,0c,53,ad,13,fb,30,01,3f,13,d0,5c,a0,2a,06,08,49,25,b5,\
6b,05,c6,89,97,cb,cf,87,b7,dd,fe,12,cb,12,f7,68,1d,7b,dd,61,77,a3,fe,2f,9a,\
ca,30,39,cf,79,0f,72,db,98,52,58,55,2a,72,28,2d,5a,72,28,35,5a
"??"=hex:f6,5d,71,86,c6,3a,33,75,98,25,8c,5e,45,26,b6,9f

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\SecuROM\License information*NULL*]
"datasecu"=hex:99,8f,93,d1,99,7c,0a,7a,2d,f6,81,c1,a0,2d,cb,1e,c3,1a,58,da,7e,\
2b,7d,64,80,ce,d3,af,c7,03,af,3e,0f,bf,bf,17,fd,c7,8f,86,76,74,df,0d,5d,02,\
a9,87,79,3f,83,c8,a9,94,ce,65,a5,88,d0,4c,75,e6,85,94,2b,30,fc,4b,6d,b0,da,\
66,de,20,60,57,b5,bd,15,46,4d,31,65,ee,bc,01,75,7c,4e,c7,1b,0c,c2,7a,27,d5,\
6a,e5,45,7b,1d,92,2c,f5,c6,c0,c3,90,25,2d,41,a0,75,3b,61,ba,05,85,d2,69,36,\
62,0f,71,44,b4,3b,ed,3e,47,8f,a6,fb,15,b2,e3,5d,21,91,c4,25,70,a9,3a,57,a1,\
a7,17,fa,81,dd,11,80,b7,be,f1,1a,c3,b6,d6,56,6b,5e,5e,d8,b0,12,4c,d0,23,2b,\
a7,9b,b9,03,aa,dc,7f,4e,c4,72,cb,56,a5,6b,74,3d,5c,1d,2d,ef,fc,22,59,2e,a7,\
0d,15,fa,71,3e,ed,d8,42,85,13,ed,5e,6b,38,d8,35,51,a8,88,cf,fb,3f,9e,26,69,\
a9,1d,7c,39,3e,73,51,61,97,c6,ed,9e,9c,fb,df,17,03,94,99,d6,b4,a9,dc,d5,65,\
2a,06,54,76,ff,02,81,91,92,cc,35,57,1b,31,30,ff,e3,e3,90,57,7a,91,8c,5d,4c,\
ca,3c,62,21,b1,05,85,c3,90,ba,77,3e,48,a3,18,3d,85,de,ce,5f,0a,cd,d6,cf,eb,\
66,6c,c0,fb,3b,15,1d,a1,5e,7e,cc,5e,05,f9,72,c8,3f,ff,f3,ef,ea,c4,7f,dd,2f,\
76,c9,3d,e7,0f,b0,00,a9,63,23,77,95,29,f4,a2,d6,c6,8d,fd,ed,17,c1,7f,cd,99,\
99,2c,43,fd,58,3e,fc,a6,2c,1c,ed,a8,3b,27,71,ad,21,bd,c1,8d,2b,c5,d8,d6,61,\
24,07,60,c2,90,1e,67,83,8c,ae,15,b7,a1,70,ea,97,70,12,7a,51,b2,43,87,db,ec,\
84,9e,9c,64,8d,54,56,ff,9e,0e,01,61,57,1d,19,d9,a3,83,df,1c,f3,a0,65,92,88,\
3d,49,ad,73,7d,87,49,98,81,b4,71,d9,a2,7b,8e,76,c6,2b,7c,b9,4d,5d,b3,bf,60,\
52,53,db,a9,16,e8,62,30,14,20,44,ca,83,1b,57,ba,ef,15,4d,0b,9f,1d,5a,24,fc,\
ba,f9,2d,63,c0,b9,3f,8a,5b,db,0a,fb,d6,69,33,58,9a,d2,6e,ee,c8,90,ce,0b,b7,\
06,a4,71,6a,f7,01,95,77,0f,72,d5,68,71,21,97,fc,e9,5e,c9,dc,75,12,48,64,df,\
a3,4d,94,7d,cb,6f,e7,31,0e,c4,d8,43,ec,43,05,1e,63,e6,01,cb,16,c7,3e,8c,d5,\
f2,b8,4b,70,f0,d1,b8,21,58,ab,23,21,9d,53,a4,f0,57,12,ea,60,1e,09,6f,a9,7d,\
c8,65,a6,30,2a,00,5f,fa,72,31,4f,bd,b6,a6,bd,6e,8b,c7,c5,96,4b,11,e2,dd,e3,\
20,14,09,02,32,70,7b,55,66,2e,1c,d1,19,e9,b6,5b,67,b4,f2,d9,7d,b9,ab,d3,56,\
ab,b5,59,3f,3c,26,96,fc,77,0b,74,08,50,e2,16,7e,25,39,6d,ae,c2,ab,fb,1c,80,\
6c,b9,52,dd,21,e2,dc,82,a3,4e,ca,9c,0c,9f,c6,09,b1,5f,73,4f,fb,da,a1,fc,4e,\
b9,c6,1b,14,55,dc,05,65,4f,e1,79,4c,ad,23,0a,5d,1d,ca,90,ae,62,63,ec,87,17,\
e1,4e,56,c0,d6,7f,af,32,cf,18,7f,d5,2b,46,26,6d,76,f2,cb,3e,4c,a2,46,9c,6a,\
e5,30,c9,93,9a,60,ce,d7,87,03,19,44,51,b3,45,41,b3,0d,cd,78,52,d9,f9,27,6c,\
f7,2d,9c,31,0c,a5,48,55,59,53,4a,2f,c7,b9,7b,da,db,b0,01,97,56,29,26,b1,18,\
b0,79,08,ae,71,7f,f3,bf,b6,0d,ec,fe,50,5a,cc,19,8f,36,c1,28,49,be,90,07,cb,\
88,33,08,ba,f5,fd,2c,e7,21,dd,c3,44,7b,11,6c,f9,b7,c0,38,8d,43,c2,2c,ab,f7,\
9e,e5,36,af,ca,8b,be,a2,b1,79,c5,8a,9d,8f,92,3d,8c,1f,8f,e4,fb,4a,9d,39,1d,\
07,e9,87,db,b4,a3,8d,d3,05,73,9d,2f,66,8c,d1,6e,8d,25,34,bf,cc,d3,5f,46,f2,\
89,68,4d,35,c1,34,b3,05,6a,9f,8a,00,60,22,b6,6c,7a,66,cd,38,30,fe,e4,eb,30,\
d4,1a,ef,b5,c5,db,26,a2,2b,78,0b,55,f1,2a,e1,b1,48,c1,07,98,31,ea,e1,e9,d2,\
0e,c2,a0,2b,39,13,33,6e,55,26,67,20,30,54,07,42,33,c3,4c,ac,04,3f,09,4f,63,\
5b,e8,d1,4a,58,02,9b,95,85,2e,37,31,05,01,71,7e,56,45,b8,8c,18,7f,e3,e5,b2,\
3a,c3,5d,7d,1f,ff,b2,bc,7c,ab,80,3c,eb,53,df,c1,88,19,7c,22,2a,f9,60,d6,00,\
1e,a4,3a,0b,c7,19,dc,f0,7c,4a,e7,d0,0c,5f,70,ee,ab,ef,eb,96,ab,a5,04,fe,84,\
f5,a4,fe,8d,1b,4e,a0,29,ef,a1,9b,80,3d,b5,19,78,71,2c,98,27,c0,3a,10,2c,87,\
55,a2,46,50,b8,16,a8,53,87,62,31,c3,b5,46,bd,ce,eb,ca,17,50,4d,74,60,5d,68,\
67,9a,af,43,66,7f,14,cb,16,77,87,88,77,9d,21,16,26,ed,8b,ef,55,37,81,e0,8e,\
25,dd,3a,16,c3,62,83,5b,ae,29,15,21,9a,1c,1b,39,df,d8,6d,05,ad,07,18,f6,39,\
77,a2,ae,a7,d1,20,67,8e,d0,c0,1d,4e,d3,f0,5f,bb,96,dc,c7,40,93,ce,f5,39,34,\
e1,52,1e,d0,81,6b,f0,00,10,d2,05,35,d3,c0,4a,bd,48,62,56,e1,bb,94,57,c3,78,\
88,1c,21,d6,a6,e9,5a,c6,a0,6d,c9,56,d3,48,32,22,f9,2f,44,f6,2c,92,cd,ec,b1,\
dc,9d,60,fb,f6,58,08,a1,73,85,73,e9,0e,57,58,96,46,ae,c8,65,ee,c4,f2,c3,55,\
38,83,34,c8,5d,18,d8,3e,4e,dd,e4,c2,f0,20,c6,8b,ec,9d,15,7d,a7,62,b3,26,6d,\
84,2d,a3,97,7c,95,d2,e5,01,bd,84,f9,68,7d,c2,d8,69,1d,35,ec,11,7b,ee,98,4c,\
2e,70,14,81,7a,dc,6e,17,32,77,48,ff,fd,79,13,96,58,e1,14,5b,3e,d6,dd,4d,56,\
b7,4a,d1,0c,c7,35,a2,7a,d3,5b,60,d9,af,0b,bc,1c,e9,d2,f4,92,2e,d9,31,d0,92,\
90,e4,19,d8,cb,37,b4,e8,a8,1e,1d,3a,c8,5a,e1,24,17,f0,6d,1b,ed,69,fa,0a,45,\
0e,0c,fa,66,db,09,75,97,f5,f9,48,de,5c,36,4c,ff,05,29,5d,4b,8a,30,e4,cc,8a,\
7d,19,5c,25,cc,35,1c,02,48,a0,c5,2f,1f,47,a7,8a,52,16,8a,ec,10,4a,c7,8a,56,\
0c,fb,e8,30,92,4c,83,63,72,54,7c,18,25,c6,c9,1b,cc,e2,04,9d,41,ae,f1,6c,4d,\
e1,af,3a,2b,f1,09,34,60,1c,4e,d7,cb,55,f5,89,44,5c,da,d7,e3,2f,20,e0,1d,8c,\
f4,5f,f2,a9,f1,61,5b,bc,3b,a2,53,2c,27,e8,4f,68,07,c6,e6,60,ea,60,c6,51,80,\
50,a7,a7,4d,4a,9a,21,b9,b6,c9,8c,dd,8f,42,c2,73,93,ae,7d,ac,93,da,e4,9b,a9,\
8c,9e,2b,91,ae,af,59,68,eb,ac,3d,ff,a8,79,7f,0f,69,a9,b6,5a,c1,e9,7d,e0,65,\
42,65,c5,b0,84,d1,8b,8b,16,a0,1f,1b,67,db,f8,cd,09,6c,10,ea,92,33,73,c5,f5,\
20,b3,ae,e5,14,86,b1,40,ff,fc,b8,9f,d9,33,5b,6c,b9,1e,e5,50,2c,10,68,d8,12,\
ab,e9,c5,27,a2,5e,3e,1c,56,c6,00,39,d4,4d,b6,e1,c3,dc,f5,23,ac,08,4b,f7,d0,\
19,5d,e0,a1,8e,50,8b,f5,bd,c4,c8,45,14,9e,45,20,bd,fb,76,d7,d9,e6,d3,3f,c3,\
97,aa,25,3c,ae,ab,4c,c7,7e,52,ee,74,a3,34,cc,c2,d5,f8,93,bf,22,cd,75,b9,00,\
e5,36,3a,18,39,ac,e3,86,8c,2d,0f,c2,95,fe,a2,f6,59,28,73,fa,64,c9,b5,dd,de,\
c9,3d,96,ac,e7,26,df,89,5d,18,a3,52,95,6d,9d,21,e8,5e,fc,69,31,b2,a2,04,4c,\
cc,5b,40,37,59,82,87,5b,f0,03,dc,b1,00,71,10,b1,1d,d2,21,d7,57,f5,a7,ed,89,\
1f,6d,29,52,1c,6f,3d,2d,2c,de,44,69,b7,eb,0b,4b,b1,a2,ce,98,90,db,c3,55,4f,\
3a,84,3c,d3,a3,d0,fd,2d,e5,8e,e8,67,18,d8,06,a9,92,a4,e9,44,2a,9f,94,ba,68,\
2d,14,d9,cf,b7,8b,b4,7b,f9,f2,52,ea,4b,a0,83,a6,0d,e4,fd,cc,c0,f1,f4,af,b6,\
3b,f0,bd,f1,e4,4c,ea,77,ea,b3,d7,a9,85,81,13,5c,94,9a,bb,08,50,a6,b5,8f,a2,\
b1,8f,2f,cd,2d,d1,70,1d,06,af,36,2d,90,2c,de,84,3d,66,22,12,6c,09,33,ad,6f,\
27,6e,85,fd,cb,47,36,3e,23,cf,22,ce,a9,8c,73,89,6a,75,69,2e,c5,4b,00,76,8c,\
4f,4d,a6,b5,99,80,76,6f,f5,72,6f,03,fe,5a,5c,6b,11,cb,0c,3c,56,6e,fb,33,2c,\
5b,2a,bc,85,af,96,60,7b,1d,de,c1,ef,75,b5,fc,4c,a6,55,7f,2d,4f,e2,a0,a8,71,\
30,6c,03,8f,0d,8b,65,e9,86,be,73,95,39,35,af,e9,6e,0d,c6,37,39,9c,6f,71,c9,\
57,de,eb,62,4a,1f,bf,a3,ca,98,da,45,7e,e0,83,37,4c,e6,f9,54,11,77,a3,5b,ae,\
4b,e6,96,5d,46,d7,2b,b3,00,f0,c2,47,64,4d,ba,8a,dd,99,a2,91,0d,7e,15,53,37,\
39,0c,5d,28,51,ff,4a,b0,cf,7a,7b,b6,d7,5f,03,74,26,26,25,6f,63,a5,4e,e6,db,\
7b,9c,73,ba,26,d5,49,d5,c4,a3,99,f5,c2,35,b4,07,85,25,eb,05,4b,ee,3e,81,df,\
e0,e8,61,3f,24,f5,47,ae,eb,37,e2,5f,77,52,20,d7,3c,e5,4e,5e,a0,52,b5,79,74,\
05,be,b4,2d,5b,0b,3c,f5,52,52,8f,de,2c,88,97,50,34,02,f9,8a,79,f0,82,fb,c1,\
d2,c0,4b,30,f0,9d,bb,8b,d9,0b,74,fa,56,e7,75,6c,12,1b,a4,63,0e,74,fe,88,86,\
0a,24,4e,26,a8,bb,df,0c,62,33,34,29,94,29,9a,03,1d,44,bd,04,60,79,a0,8b,d5,\
7b,f6,b6,58,92,65,3f,11,33,fc,ca,fe,50,d5,c4,8e,ff,66,30,93,27,4b,39,99,ef,\
53,91,3e,20,13,4f,9b,66,41,bf,b7,1c,f4,9e,3a,d9,84,4c,44,7e,0c,05,f1,45,d2,\
e3,8e,7e,da,45,6b,7c,ca,8b,1b,91,56,7a,5d,9e,3e,ef,72,2a,df,43,94,23,86,32,\
01,73,dd,6f,af,7f,2d,df,de,c3,78,d1,94,35,91,67,a6,dc,69,7a,d0,fc,20,38,7e,\
f3,90,d6,ea,2f,8b,c0,eb,79,38,94,26,07,3b,28,10,0c,e7,ff,be,74,b5,9f,24,7e,\
5e,b9,cc,e9,07,37,24,ef,c7,9e,1b,af,e2,b2,27,f2,13,85,df,1d,b8,6d,90,ba,c3,\
65,30,8d,e2,9b,e1,4b,92,35,8d,73,ac,aa,bb,a0,8f,24,b2,47,15,77,79,49,10,5f,\
b7,1f,a2,31,da,36,96,d9,d1,89,80,e6,6e,03,46,08,84,5a,c0,6d,a2,e9,a0,6f,2a,\
0a,84,46,dd,31,42,bc,73,1c,b1,50,7b,8d,ea,b9,d5,97,0f,d5,41,16,90,48,25,31,\
e3,e0,1e,90,17,d0,7c,4e,f7,8f,cf,05,65,35,a6,0e,31,9f,d7,10,cf,bb,99,64,32,\
88,6d,63,ad,64,df,04,76,7b,d9,f0,aa,94,6e,9c,b2,14,9e,83,50,16,58,2f,b7,1e
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*NULL*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'winlogon.exe'(1576)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'lsass.exe'(1632)
c:\windows\system32\relog_ap.dll
.

---

Other Running Processes

---

.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\PAStiSvc.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\rundll32.exe
c:\docume~1\NEBULA~1\LOCALS~1\temp\clclean.0001
c:\windows\system32\wscntfy.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2009-01-08 19:55:48 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-09 00:54:30
ComboFix2.txt 2009-01-08 01:37:02

Pre-Run: 49,933,996,032 bytes free
Post-Run: 49,918,963,712 bytes free

454

Katana

Please post the Kaspersky Log when you have it.

vulcansage

Just woke up..I had a large external drive attached to the computer while it scanned since it was attached the day the serious infection occurred. So I let it run overnight.

Here is the Kaspersky Log

Friday, January 9, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, January 08, 2009 23:48:04
Records in database: 1589644

Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
C:\
D:\
E:\
H:\

Scan statistics
Files scanned 521899
Threat name 4
Infected objects 7
Suspicious objects 0
Duration of the scan 04:44:54

File name Threat name Threats count
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.63 1
C:\Qoobox\Quarantine\C\WINDOWS\Bluvafisequpal.dll.vir Infected: Trojan-Downloader.Win32.Agent.azcz 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gmxccpae.exe.vir Infected: Trojan-Downloader.Win32.Small.izs 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\k9261108.exe.vir Infected: Trojan-Dropper.Win32.Agent.adhp 1
C:\Qoobox\Quarantine\[4]-Submit_2009-01-08@19.36.zip Infected: Trojan-Downloader.Win32.Agent.azcz 1
C:\Qoobox\Quarantine\[4]-Submit_2009-01-08@19.36.zip Infected: Trojan-Downloader.Win32.Small.izs 1
C:\Qoobox\Quarantine\[4]-Submit_2009-01-08@19.36.zip Infected: Trojan-Dropper.Win32.Agent.adhp 1
The selected area was scanned.

vulcansage

The computer didn't crash or reboot over night. The computer seems to be running well, it shuts down smoothly and restarts. I rebooted and it seems to be running ok. I still have teatimer disabled.

vulcansage

I realized I am only SP2 ...I guess I should go to SP3 after we resolve everything.

Katana

vulcansage wrote:

I realized I am only SP2 ...I guess I should go to SP3 after we resolve everything.

It's a good idea, SP3 fills in a few more holes

Create A Batch File
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad.
Save it as "All Files" and name it fix.bat Please save it on your desktop.

@echo off
swreg null delete "HKU\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{482A2F67-027E-96D5-EC9B-391B6B293AD5}*" /n *
del /q %0
exit

Double click on fix.bat
It will only take a moment, and you won't see much

Custom CFScript

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  

  Registry::
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{39f8f5c6-abd5-11db-987d-0019b951ad92}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{785e543a-de16-11db-98fc-0019b951ad92}]
  [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints 2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
  
  ADS::
  

• Save this as CFScript.txt and place it on your desktop.
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

vulcansage

Thank you Katana, I will do this tonight and post the ComboFix log.

vulcansage

ComboFix 09-01-06.02 - Nebulagirl 2009-01-09 21:02:40.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1182 [GMT -5:00]
Running from: c:\documents and settings\Nebulagirl\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Nebulagirl\Desktop\CFScript.txt
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Updated)
FW: PC-cillin Internet Security - Firewall *disabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-12-10 to 2009-01-10 )))))))))))))))))))))))))))))))
.
2009-01-08 00:38 . 2009-01-08 00:38 0 --a

---

c:\windows\Dvm.INI
2009-01-08 00:26 . 2009-01-08 00:26 <DIR> d

---

c:\program files\Thomson
2009-01-07 21:24 . 2009-01-07 21:24 134,656 --a

---

c:\windows\omiriheh.dll
2009-01-07 20:44 . 2009-01-07 20:43 410,984 --a

---

c:\windows\system32\deploytk.dll
2009-01-07 20:44 . 2009-01-07 20:43 73,728 --a

---

c:\windows\system32\javacpl.cpl
2009-01-06 22:00 . 2009-01-06 22:02 <DIR> d

---

C:\rsit
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\program files\Malwarebytes' Anti-Malware
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\documents and settings\Nebulagirl\Application Data\Malwarebytes
2009-01-06 20:25 . 2009-01-06 20:25 <DIR> d

---

c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-06 20:25 . 2009-01-04 18:38 38,496 --a

---

c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 20:25 . 2009-01-04 18:38 15,504 --a

---

c:\windows\system32\drivers\mbam.sys
2009-01-06 20:17 . 2009-01-06 21:58 12,288 --ahs---- c:\windows\system32\Thumbs.db
2009-01-04 23:16 . 2009-01-04 23:18 <DIR> d

---

c:\program files\Spybot - Search & Destroy
2009-01-04 23:16 . 2009-01-05 00:21 <DIR> d

---

c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-04 20:32 . 2009-01-04 20:32 <DIR> d

---

c:\program files\CheckIt
2009-01-04 20:28 . 2009-01-04 20:28 <DIR> d

---

c:\documents and settings\Nebulagirl\Application Data\iolo
2009-01-04 20:28 . 2009-01-04 20:28 <DIR> d

---

c:\documents and settings\All Users\Application Data\iolo
2009-01-03 21:18 . 2009-01-05 06:26 102,400 --a

---

c:\windows\DUMP9809.tmp
2008-12-28 16:52 . 2004-08-03 23:07 59,264 --a

---

c:\windows\system32\drivers\USBAUDIO.sys
2008-12-28 16:52 . 2004-08-03 23:07 59,264 --a

---

c:\windows\system32\dllcache\usbaudio.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-09 14:22

---

d

---

w c:\program files\TextAloud
2009-01-08 05:46

---

d

---

w c:\program files\Google
2009-01-08 05:26

---

d--h--w c:\program files\InstallShield Installation Information
2009-01-08 03:41

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\BitTorrent
2009-01-08 02:08

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\DNA
2009-01-08 01:58

---

d

---

w c:\program files\DNA
2009-01-08 01:43

---

d

---

w c:\program files\Java
2009-01-07 02:55

---

d

---

w c:\program files\psp
2009-01-05 06:15

---

d

---

w c:\program files\Lavasoft
2009-01-05 06:11

---

d

---

w c:\program files\Common Files\Wise Installation Wizard
2009-01-05 05:21

---

d

---

w c:\program files\AskTBar
2009-01-05 04:45

---

d

---

w c:\program files\Trend Micro
2009-01-03 02:36

---

d

---

w c:\program files\Windows Media Connect 2
2009-01-03 02:36

---

d

---

w c:\program files\Visual Sample Plan
2009-01-03 02:36

---

d

---

w c:\program files\viewsonic
2009-01-03 02:36

---

d

---

w c:\program files\Steam
2009-01-03 02:36

---

d

---

w c:\program files\SpongeBob SquarePants Diner Dash
2009-01-03 02:36

---

d

---

w c:\program files\Photomatix
2009-01-02 20:34

---

d

---

w c:\program files\MyNetStorage FTP
2009-01-02 20:34

---

d

---

w c:\program files\Modem Helper
2009-01-02 20:34

---

d

---

w c:\program files\DivX
2009-01-02 20:34

---

d

---

w c:\program files\CamManager
2009-01-02 20:34

---

d

---

w c:\program files\bfgclient
2009-01-02 20:34

---

d

---

w c:\program files\BFG
2009-01-02 20:34

---

d

---

w c:\program files\Avimator
2009-01-02 20:34

---

d

---

w c:\program files\Amazon
2009-01-02 20:34

---

d

---

w c:\program files\AhaView v4.01
2009-01-02 20:34

---

d

---

w c:\program files\ADSTech DVD Xpress DX2
2008-12-24 01:37

---

d

---

w c:\program files\Last.fm
2008-12-23 01:45

---

d

---

w c:\program files\BitTorrent
2008-12-10 04:13

---

d

---

w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-07 23:58

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\Skype
2008-12-07 22:01

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\skypePM
2008-12-07 17:01

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\CoreFTP
2008-12-07 00:44

---

d

---

w c:\program files\SecondLifeReleaseCandidate
2008-12-04 03:24

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\SPORE
2008-12-04 01:36

---

d

---

w c:\program files\Electronic Arts
2008-11-27 19:58

---

d

---

w c:\documents and settings\Nebulagirl\Application Data\SPORE Creature Creator
2008-11-27 04:30

---

d

---

w c:\documents and settings\All Users\Application Data\AOL
2008-11-20 04:41

---

d

---

w c:\program files\Photo Viewer
2008-11-12 02:02

---

d

---

w c:\program files\DVDVideoSoft
2008-11-12 02:02

---

d

---

w c:\program files\Common Files\DVDVideoSoft
2008-11-12 01:47

---

d

---

w c:\program files\PQDVD
2008-01-09 00:13 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
2007-11-21 18:41 47,360 ----a-w c:\documents and settings\Nebulagirl\Application Data\pcouffin.sys
2002-09-11 14:26 63,730 ----a-w c:\program files\viewsonicinstruct_xp.pdf
2008-03-29 00:49 2,828 --sha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( [EMAIL="snapshot@2009-01-07_20.34.04.68"]snapshot@2009-01-07_20.34.04.68[/EMAIL] )))))))))))))))))))))))))))))))))))))))))
.
- 2005-11-10 17:27:06 49,248 ----a-w c:\windows\system32\java.exe
+ 2009-01-08 01:43:41 144,792 ----a-w c:\windows\system32\java.exe
- 2005-11-10 17:27:16 49,250 ----a-w c:\windows\system32\javaw.exe
+ 2009-01-08 01:43:41 144,792 ----a-w c:\windows\system32\javaw.exe
- 2005-11-10 19:03:54 127,078 ----a-w c:\windows\system32\javaws.exe
+ 2009-01-08 01:43:41 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2009-01-10 02:11:32 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_31c.dat
+ 2009-01-10 02:11:32 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_350.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 147456]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-11-15 2356088]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2006-10-16 1164912]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 185896]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-10 385024]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-05-02 184320]
"pccguide.exe"="c:\program files\Trend Micro\Internet Security 14\pccguide.exe" [2006-11-21 1807960]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 249856]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320]
"ImgTask"="c:\windows\Imgtask.exe" [2006-12-12 20480]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2006-10-16 1941784]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2006-10-16 87584]
"Ysomaciwiquloya"="c:\windows\omiriheh.dll" [2009-01-07 134656]
"HostManager"="c:\program files\Common Files\AOL\1170380176\ee\AOLSoftware.exe" [2007-10-08 41824]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"WD Button Manager"="WDBtnMgr.exe" [2007-04-02 c:\windows\system32\WDBtnMgr.exe]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]
"MBMon"="CTMBHA.DLL" [2006-06-29 c:\windows\system32\CTMBHA.DLL]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-08-12 c:\windows\KHALMNPR.Exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2007-08-13 5562368]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 622653]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-01-25 528384]
VProperty.lnk - c:\windows\VPro610.exe [2005-10-17 463360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2005-09-06 02:44 53248 c:\program files\Common Files\Logitech\Bluetooth\LBTWlgn.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= vvlcodec.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"VIDC.SP50"= SP5X_32.DLL
"VIDC.SP51"= SP5X_32.DLL
"VIDC.SP52"= SP5X_32.DLL
"VIDC.SP53"= SP5X_32.DLL
"msvideo3"= STVqx3tg.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1170380176\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\e frontier\\Poser 7\\Poser.exe"=
"c:\\Program Files\\MyNetStorage FTP\\MyNetStorageFtp.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\SecondLife\\SLVoice.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Nero\\Nero 7\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\CoreFTP\\coreftp.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\SecondLifeReleaseCandidate\\SLVoice.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"2919:UDP"= 2919:UDP:Windows Media Format SDK (iexplore.exe)
"2918:UDP"= 2918:UDP:Windows Media Format SDK (iexplore.exe)
R3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\drivers\vrtaucbl.sys [2008-01-20 30728]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2006-09-25 280392]
R4 BCMNTIO;BCMNTIO;c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2009-01-04 3744]
R4 Cepstral License Server;Cepstral License Server;c:\program files\Cepstral\bin\CepstralLicSrv.exe [2007-03-15 57344]
R4 MAPMEM;MAPMEM;c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [2009-01-04 3904]
R4 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [2006-09-25 345696]
R4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [2006-09-25 923216]
R4 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2006-09-25 36368]
R4 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [2006-09-25 566872]
S3 SIUSBXP;SIUSBXP;c:\windows\system32\drivers\SiUSBXp.sys [2007-06-12 14848]
S3 SPC610NC;SPC 610NC Laptop Camera;c:\windows\system32\drivers\SPC610NC.sys [2005-09-07 151040]
S3 STVqx3;Intel Play QX3 Microscope;c:\windows\system32\drivers\STVqx3.SYS [2007-02-23 131776]
S3 USBCamera;Mega Camera Still Image Capture, Version 1.00;c:\windows\system32\drivers\Bulk504.sys [2007-02-08 10986]
S4 Ca504av;Mega Camera, WDM Video Capture;c:\windows\system32\drivers\CA504AV.SYS [2007-02-08 516149]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39f8f5c6-abd5-11db-987d-0019b951ad92}]
\Shell\AutoRun\command - G:\Autorun.exe /run
\Shell\Shell00\Command - G:\Autorun.exe /run
\Shell\Shell01\Command - G:\Autorun.exe /action
\Shell\Shell02\Command - G:\Autorun.exe /uninstall
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{785e543a-de16-11db-98fc-0019b951ad92}]
\Shell\AutoRun\command - F:\Autorun.exe /run
\Shell\Shell00\Command - F:\Autorun.exe /run
\Shell\Shell01\Command - F:\Autorun.exe /action
\Shell\Shell02\Command - F:\Autorun.exe /uninstall
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
\Shell\AutoRun\command - F:\Autorun.exe /run
\Shell\Shell00\Command - F:\Autorun.exe /run
\Shell\Shell01\Command - F:\Autorun.exe /action
\Shell\Shell02\Command - F:\Autorun.exe /uninstall
.
Contents of the 'Scheduled Tasks' folder
2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://www.google.com/
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: {{0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - c:\program files\NaturalReaders\Natural Voice Text To Speech Software Standard\read.html
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll
FF - ProfilePath - c:\documents and settings\Nebulagirl\Application Data\Mozilla\Firefox\Profiles\6kut8ja0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - AOL Search
FF - prefs.js: browser.startup.homepage - hxxp://www.secret-cinema.net/index.php
FF - prefs.js: keyword.URL - hxxp://aolsearch.aol.com/aol/search?invocationType=client_searchbox&query=
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-09 21:11:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...

**************************************************************************
.

---

LOCKED REGISTRY KEYS

---

[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*NULL*]
"??"=hex:54,94,af,b6,64,a1,5f,ea,52,92,b6,b0,7e,e6,50,12,db,18,a7,51,a5,48,b5,\
2d,a1,a8,db,2f,c6,6a,40,99,9d,e3,d8,8f,ef,84,80,1b,39,fa,88,d1,c3,76,7b,6d,\
c5,af,fa,6b,53,22,42,2d,5a,d5,64,06,2a,43,2d,4c,e2,b0,dc,49,71,fa,5a,3a,cc,\
6e,02,f5,e2,13,da,6f,a3,42,6b,31,20,c1,cf,7a,7f,c4,75,d3,99,09,03,91,14,9e,\
cb,ad,f1,e9,67,9d,e9,dc,a2,ae,f1,7a,50,84,b3,dc,48,e0,57,9d,85,42,39,b5,03,\
ef,af,96,0c,23,fe,ae,d6,31,8b,40,c1,06,76,08,d7,bd,6c,2c,f0,e3,17,c4,ea,a8,\
f5,48,02,1c,0d,aa,9e,9c,93,e1,19,b1,b3,a0,6e,e7,22,bd,f0,f7,6d,b4,5d,d3,3a,\
c2,4e,62,a4,3c,ca,82,ff,dd,1b,d7,72,c2,ed,7d,b7,f4,d1,26,4e,fa,24,97,cc,96,\
0c,b5,67,38,60,66,50,51,84,64,9a,bb,38,2c,db,9c,63,81,a8,4a,72,05,32,ee,0b,\
ba,e6,2c,91,b3,74,47,46,f4,d3,9a,b4,d5,87,36,fc,65,a7,44,92,c9,de,ef,d9,8a,\
6a,22,26,00,a6,04,f0,36,5a,89,13,35,92,1f,60,26,bf,89,c3,02,50,45,e3,a0,74,\
5e,8a,e5,d3,92,f9,37,d1,a5,80,5e,cc,9d,09,b9,00,1f,48,12,19,02,d3,89,f2,fb,\
25,d3,07,ba,cf,79,d3,ab,99,f1,fd,31,df,8e,62,3e,78,84,51,7b,7c,0f,70,8c,67,\
ab,eb,07,f3,3e,a6,0e,a6,3c,58,f6,96,7f,03,36,22,e0,9b,c1,22,df,83,57,8a,15,\
70,a3,99,1a,55,17,cc,47,39,0d,70,05,da,be,f9,77,d0,66,0a,2c,ef,92,46,5b,cd,\
6d,5d,89,49,bd,eb,e2,0c,53,ad,13,fb,30,01,3f,13,d0,5c,a0,2a,06,08,49,25,b5,\
6b,05,c6,89,97,cb,cf,87,b7,dd,fe,12,cb,12,f7,68,1d,7b,dd,61,77,a3,fe,2f,9a,\
ca,30,39,cf,79,0f,72,db,98,52,58,55,2a,72,28,2d,5a,72,28,35,5a
"??"=hex:f6,5d,71,86,c6,3a,33,75,98,25,8c,5e,45,26,b6,9f
[HKEY_USERS\S-1-5-21-2973496205-3688401339-2174111540-1006\Software\SecuROM\License information*NULL*]
"datasecu"=hex:99,8f,93,d1,99,7c,0a,7a,2d,f6,81,c1,a0,2d,cb,1e,c3,1a,58,da,7e,\
2b,7d,64,80,ce,d3,af,c7,03,af,3e,0f,bf,bf,17,fd,c7,8f,86,76,74,df,0d,5d,02,\
a9,87,79,3f,83,c8,a9,94,ce,65,a5,88,d0,4c,75,e6,85,94,2b,30,fc,4b,6d,b0,da,\
66,de,20,60,57,b5,bd,15,46,4d,31,65,ee,bc,01,75,7c,4e,c7,1b,0c,c2,7a,27,d5,\
6a,e5,45,7b,1d,92,2c,f5,c6,c0,c3,90,25,2d,41,a0,75,3b,61,ba,05,85,d2,69,36,\
62,0f,71,44,b4,3b,ed,3e,47,8f,a6,fb,15,b2,e3,5d,21,91,c4,25,70,a9,3a,57,a1,\
a7,17,fa,81,dd,11,80,b7,be,f1,1a,c3,b6,d6,56,6b,5e,5e,d8,b0,12,4c,d0,23,2b,\
a7,9b,b9,03,aa,dc,7f,4e,c4,72,cb,56,a5,6b,74,3d,5c,1d,2d,ef,fc,22,59,2e,a7,\
0d,15,fa,71,3e,ed,d8,42,85,13,ed,5e,6b,38,d8,35,51,a8,88,cf,fb,3f,9e,26,69,\
a9,1d,7c,39,3e,73,51,61,97,c6,ed,9e,9c,fb,df,17,03,94,99,d6,b4,a9,dc,d5,65,\
2a,06,54,76,ff,02,81,91,92,cc,35,57,1b,31,30,ff,e3,e3,90,57,7a,91,8c,5d,4c,\
ca,3c,62,21,b1,05,85,c3,90,ba,77,3e,48,a3,18,3d,85,de,ce,5f,0a,cd,d6,cf,eb,\
66,6c,c0,fb,3b,15,1d,a1,5e,7e,cc,5e,05,f9,72,c8,3f,ff,f3,ef,ea,c4,7f,dd,2f,\
76,c9,3d,e7,0f,b0,00,a9,63,23,77,95,29,f4,a2,d6,c6,8d,fd,ed,17,c1,7f,cd,99,\
99,2c,43,fd,58,3e,fc,a6,2c,1c,ed,a8,3b,27,71,ad,21,bd,c1,8d,2b,c5,d8,d6,61,\
24,07,60,c2,90,1e,67,83,8c,ae,15,b7,a1,70,ea,97,70,12,7a,51,b2,43,87,db,ec,\
84,9e,9c,64,8d,54,56,ff,9e,0e,01,61,57,1d,19,d9,a3,83,df,1c,f3,a0,65,92,88,\
3d,49,ad,73,7d,87,49,98,81,b4,71,d9,a2,7b,8e,76,c6,2b,7c,b9,4d,5d,b3,bf,60,\
52,53,db,a9,16,e8,62,30,14,20,44,ca,83,1b,57,ba,ef,15,4d,0b,9f,1d,5a,24,fc,\
ba,f9,2d,63,c0,b9,3f,8a,5b,db,0a,fb,d6,69,33,58,9a,d2,6e,ee,c8,90,ce,0b,b7,\
06,a4,71,6a,f7,01,95,77,0f,72,d5,68,71,21,97,fc,e9,5e,c9,dc,75,12,48,64,df,\
a3,4d,94,7d,cb,6f,e7,31,0e,c4,d8,43,ec,43,05,1e,63,e6,01,cb,16,c7,3e,8c,d5,\
f2,b8,4b,70,f0,d1,b8,21,58,ab,23,21,9d,53,a4,f0,57,12,ea,60,1e,09,6f,a9,7d,\
c8,65,a6,30,2a,00,5f,fa,72,31,4f,bd,b6,a6,bd,6e,8b,c7,c5,96,4b,11,e2,dd,e3,\
20,14,09,02,32,70,7b,55,66,2e,1c,d1,19,e9,b6,5b,67,b4,f2,d9,7d,b9,ab,d3,56,\
ab,b5,59,3f,3c,26,96,fc,77,0b,74,08,50,e2,16,7e,25,39,6d,ae,c2,ab,fb,1c,80,\
6c,b9,52,dd,21,e2,dc,82,a3,4e,ca,9c,0c,9f,c6,09,b1,5f,73,4f,fb,da,a1,fc,4e,\
b9,c6,1b,14,55,dc,05,65,4f,e1,79,4c,ad,23,0a,5d,1d,ca,90,ae,62,63,ec,87,17,\
e1,4e,56,c0,d6,7f,af,32,cf,18,7f,d5,2b,46,26,6d,76,f2,cb,3e,4c,a2,46,9c,6a,\
e5,30,c9,93,9a,60,ce,d7,87,03,19,44,51,b3,45,41,b3,0d,cd,78,52,d9,f9,27,6c,\
f7,2d,9c,31,0c,a5,48,55,59,53,4a,2f,c7,b9,7b,da,db,b0,01,97,56,29,26,b1,18,\
b0,79,08,ae,71,7f,f3,bf,b6,0d,ec,fe,50,5a,cc,19,8f,36,c1,28,49,be,90,07,cb,\
88,33,08,ba,f5,fd,2c,e7,21,dd,c3,44,7b,11,6c,f9,b7,c0,38,8d,43,c2,2c,ab,f7,\
9e,e5,36,af,ca,8b,be,a2,b1,79,c5,8a,9d,8f,92,3d,8c,1f,8f,e4,fb,4a,9d,39,1d,\
07,e9,87,db,b4,a3,8d,d3,05,73,9d,2f,66,8c,d1,6e,8d,25,34,bf,cc,d3,5f,46,f2,\
89,68,4d,35,c1,34,b3,05,6a,9f,8a,00,60,22,b6,6c,7a,66,cd,38,30,fe,e4,eb,30,\
d4,1a,ef,b5,c5,db,26,a2,2b,78,0b,55,f1,2a,e1,b1,48,c1,07,98,31,ea,e1,e9,d2,\
0e,c2,a0,2b,39,13,33,6e,55,26,67,20,30,54,07,42,33,c3,4c,ac,04,3f,09,4f,63,\
5b,e8,d1,4a,58,02,9b,95,85,2e,37,31,05,01,71,7e,56,45,b8,8c,18,7f,e3,e5,b2,\
3a,c3,5d,7d,1f,ff,b2,bc,7c,ab,80,3c,eb,53,df,c1,88,19,7c,22,2a,f9,60,d6,00,\
1e,a4,3a,0b,c7,19,dc,f0,7c,4a,e7,d0,0c,5f,70,ee,ab,ef,eb,96,ab,a5,04,fe,84,\
f5,a4,fe,8d,1b,4e,a0,29,ef,a1,9b,80,3d,b5,19,78,71,2c,98,27,c0,3a,10,2c,87,\
55,a2,46,50,b8,16,a8,53,87,62,31,c3,b5,46,bd,ce,eb,ca,17,50,4d,74,60,5d,68,\
67,9a,af,43,66,7f,14,cb,16,77,87,88,77,9d,21,16,26,ed,8b,ef,55,37,81,e0,8e,\
25,dd,3a,16,c3,62,83,5b,ae,29,15,21,9a,1c,1b,39,df,d8,6d,05,ad,07,18,f6,39,\
77,a2,ae,a7,d1,20,67,8e,d0,c0,1d,4e,d3,f0,5f,bb,96,dc,c7,40,93,ce,f5,39,34,\
e1,52,1e,d0,81,6b,f0,00,10,d2,05,35,d3,c0,4a,bd,48,62,56,e1,bb,94,57,c3,78,\
88,1c,21,d6,a6,e9,5a,c6,a0,6d,c9,56,d3,48,32,22,f9,2f,44,f6,2c,92,cd,ec,b1,\
dc,9d,60,fb,f6,58,08,a1,73,85,73,e9,0e,57,58,96,46,ae,c8,65,ee,c4,f2,c3,55,\
38,83,34,c8,5d,18,d8,3e,4e,dd,e4,c2,f0,20,c6,8b,ec,9d,15,7d,a7,62,b3,26,6d,\
84,2d,a3,97,7c,95,d2,e5,01,bd,84,f9,68,7d,c2,d8,69,1d,35,ec,11,7b,ee,98,4c,\
2e,70,14,81,7a,dc,6e,17,32,77,48,ff,fd,79,13,96,58,e1,14,5b,3e,d6,dd,4d,56,\
b7,4a,d1,0c,c7,35,a2,7a,d3,5b,60,d9,af,0b,bc,1c,e9,d2,f4,92,2e,d9,31,d0,92,\
90,e4,19,d8,cb,37,b4,e8,a8,1e,1d,3a,c8,5a,e1,24,17,f0,6d,1b,ed,69,fa,0a,45,\
0e,0c,fa,66,db,09,75,97,f5,f9,48,de,5c,36,4c,ff,05,29,5d,4b,8a,30,e4,cc,8a,\
7d,19,5c,25,cc,35,1c,02,48,a0,c5,2f,1f,47,a7,8a,52,16,8a,ec,10,4a,c7,8a,56,\
0c,fb,e8,30,92,4c,83,63,72,54,7c,18,25,c6,c9,1b,cc,e2,04,9d,41,ae,f1,6c,4d,\
e1,af,3a,2b,f1,09,34,60,1c,4e,d7,cb,55,f5,89,44,5c,da,d7,e3,2f,20,e0,1d,8c,\
f4,5f,f2,a9,f1,61,5b,bc,3b,a2,53,2c,27,e8,4f,68,07,c6,e6,60,ea,60,c6,51,80,\
50,a7,a7,4d,4a,9a,21,b9,b6,c9,8c,dd,8f,42,c2,73,93,ae,7d,ac,93,da,e4,9b,a9,\
8c,9e,2b,91,ae,af,59,68,eb,ac,3d,ff,a8,79,7f,0f,69,a9,b6,5a,c1,e9,7d,e0,65,\
42,65,c5,b0,84,d1,8b,8b,16,a0,1f,1b,67,db,f8,cd,09,6c,10,ea,92,33,73,c5,f5,\
20,b3,ae,e5,14,86,b1,40,ff,fc,b8,9f,d9,33,5b,6c,b9,1e,e5,50,2c,10,68,d8,12,\
ab,e9,c5,27,a2,5e,3e,1c,56,c6,00,39,d4,4d,b6,e1,c3,dc,f5,23,ac,08,4b,f7,d0,\
19,5d,e0,a1,8e,50,8b,f5,bd,c4,c8,45,14,9e,45,20,bd,fb,76,d7,d9,e6,d3,3f,c3,\
97,aa,25,3c,ae,ab,4c,c7,7e,52,ee,74,a3,34,cc,c2,d5,f8,93,bf,22,cd,75,b9,00,\
e5,36,3a,18,39,ac,e3,86,8c,2d,0f,c2,95,fe,a2,f6,59,28,73,fa,64,c9,b5,dd,de,\
c9,3d,96,ac,e7,26,df,89,5d,18,a3,52,95,6d,9d,21,e8,5e,fc,69,31,b2,a2,04,4c,\
cc,5b,40,37,59,82,87,5b,f0,03,dc,b1,00,71,10,b1,1d,d2,21,d7,57,f5,a7,ed,89,\
1f,6d,29,52,1c,6f,3d,2d,2c,de,44,69,b7,eb,0b,4b,b1,a2,ce,98,90,db,c3,55,4f,\
3a,84,3c,d3,a3,d0,fd,2d,e5,8e,e8,67,18,d8,06,a9,92,a4,e9,44,2a,9f,94,ba,68,\
2d,14,d9,cf,b7,8b,b4,7b,f9,f2,52,ea,4b,a0,83,a6,0d,e4,fd,cc,c0,f1,f4,af,b6,\
3b,f0,bd,f1,e4,4c,ea,77,ea,b3,d7,a9,85,81,13,5c,94,9a,bb,08,50,a6,b5,8f,a2,\
b1,8f,2f,cd,2d,d1,70,1d,06,af,36,2d,90,2c,de,84,3d,66,22,12,6c,09,33,ad,6f,\
27,6e,85,fd,cb,47,36,3e,23,cf,22,ce,a9,8c,73,89,6a,75,69,2e,c5,4b,00,76,8c,\
4f,4d,a6,b5,99,80,76,6f,f5,72,6f,03,fe,5a,5c,6b,11,cb,0c,3c,56,6e,fb,33,2c,\
5b,2a,bc,85,af,96,60,7b,1d,de,c1,ef,75,b5,fc,4c,a6,55,7f,2d,4f,e2,a0,a8,71,\
30,6c,03,8f,0d,8b,65,e9,86,be,73,95,39,35,af,e9,6e,0d,c6,37,39,9c,6f,71,c9,\
57,de,eb,62,4a,1f,bf,a3,ca,98,da,45,7e,e0,83,37,4c,e6,f9,54,11,77,a3,5b,ae,\
4b,e6,96,5d,46,d7,2b,b3,00,f0,c2,47,64,4d,ba,8a,dd,99,a2,91,0d,7e,15,53,37,\
39,0c,5d,28,51,ff,4a,b0,cf,7a,7b,b6,d7,5f,03,74,26,26,25,6f,63,a5,4e,e6,db,\
7b,9c,73,ba,26,d5,49,d5,c4,a3,99,f5,c2,35,b4,07,85,25,eb,05,4b,ee,3e,81,df,\
e0,e8,61,3f,24,f5,47,ae,eb,37,e2,5f,77,52,20,d7,3c,e5,4e,5e,a0,52,b5,79,74,\
05,be,b4,2d,5b,0b,3c,f5,52,52,8f,de,2c,88,97,50,34,02,f9,8a,79,f0,82,fb,c1,\
d2,c0,4b,30,f0,9d,bb,8b,d9,0b,74,fa,56,e7,75,6c,12,1b,a4,63,0e,74,fe,88,86,\
0a,24,4e,26,a8,bb,df,0c,62,33,34,29,94,29,9a,03,1d,44,bd,04,60,79,a0,8b,d5,\
7b,f6,b6,58,92,65,3f,11,33,fc,ca,fe,50,d5,c4,8e,ff,66,30,93,27,4b,39,99,ef,\
53,91,3e,20,13,4f,9b,66,41,bf,b7,1c,f4,9e,3a,d9,84,4c,44,7e,0c,05,f1,45,d2,\
e3,8e,7e,da,45,6b,7c,ca,8b,1b,91,56,7a,5d,9e,3e,ef,72,2a,df,43,94,23,86,32,\
01,73,dd,6f,af,7f,2d,df,de,c3,78,d1,94,35,91,67,a6,dc,69,7a,d0,fc,20,38,7e,\
f3,90,d6,ea,2f,8b,c0,eb,79,38,94,26,07,3b,28,10,0c,e7,ff,be,74,b5,9f,24,7e,\
5e,b9,cc,e9,07,37,24,ef,c7,9e,1b,af,e2,b2,27,f2,13,85,df,1d,b8,6d,90,ba,c3,\
65,30,8d,e2,9b,e1,4b,92,35,8d,73,ac,aa,bb,a0,8f,24,b2,47,15,77,79,49,10,5f,\
b7,1f,a2,31,da,36,96,d9,d1,89,80,e6,6e,03,46,08,84,5a,c0,6d,a2,e9,a0,6f,2a,\
0a,84,46,dd,31,42,bc,73,1c,b1,50,7b,8d,ea,b9,d5,97,0f,d5,41,16,90,48,25,31,\
e3,e0,1e,90,17,d0,7c,4e,f7,8f,cf,05,65,35,a6,0e,31,9f,d7,10,cf,bb,99,64,32,\
88,6d,63,ad,64,df,04,76,7b,d9,f0,aa,94,6e,9c,b2,14,9e,83,50,16,58,2f,b7,1e
"rkeysecu"=hex:3e,80,9e,c4,40,b4,90,83,87,8e,33,49,64,ac,f8,d9
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*NULL*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.

---

DLLs Loaded Under Running Processes

---

- - - - - - - > 'winlogon.exe'(1516)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
- - - - - - - > 'lsass.exe'(1572)
c:\windows\system32\relog_ap.dll
.

---

Other Running Processes

---

.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\windows\system32\bgsvcgen.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTSVCCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\progra~1\TRENDM~1\INTERN~1\PcCtlCom.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\system32\PAStiSvc.exe
c:\windows\wanmpsvc.exe
c:\progra~1\TRENDM~1\INTERN~1\pccguide.exe
c:\windows\system32\rundll32.exe
c:\docume~1\NEBULA~1\LOCALS~1\temp\clclean.0001
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2009-01-09 21:23:56 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-10 02:22:37
ComboFix2.txt 2009-01-09 00:55:49
ComboFix3.txt 2009-01-08 01:37:02
Pre-Run: 49,946,300,416 bytes free
Post-Run: 49,979,703,296 bytes free
423

Katana

I've just realised why the fix wasn't working, the forum software was adding an extra space to the line

OTMoveIt
Please download OTMoveIt3 by OldTimer and save it to your desktop

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below. ( Make sure you include :Processes )

:Processes
:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39f8f5c6-abd5-11db-987d-0019b951ad92}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{785e543a-de16-11db-98fc-0019b951ad92}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a74271e8-1e6f-11dc-99ab-0019b951ad92}]
File:

• Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

• - Close ALL open windows (especially Internet Explorer!)-
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Are there any problems left now ?

vulcansage

I pasted as you said and then closed everything. Very quickly I saw the results pop into the window on the right, but when I tried to click on the program OTMoveIT3 locked up (not responding) I let it sit for a minute or two, it seemed like there was nothing happening. I took a screen capture and saved it to a USB drive. Should I reboot/repeat?

[SCREENCAPTURE]
http://i73.photobucket.com/albums/i240/nebulagirl/blog/oldtimer.jpg

vulcansage

I am leaving the app open, it still says not responding. Does this step perhaps take a long time, even though it appears it is finished?

Katana

You can close it or reboot now.


Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Please delete RSIT.exe and C:\RSIT (entire folder)
You can also delete any logs we have produced, and empty your Recycle bin.


Uninstall Combofix

• This will clear your System Volume Information restore points and remove all the infected files that were quarantined
• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
  
  • 

Uninstall OTMoveIt

• Open OTMoveIt Click Cleanup,
• When a box pops up click YES.

---

---

The following is some info to help you stay safe and clean.


You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware is

not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
[*]Spybot - Search & Destroy <<< A must have program

• It includes host protection and registry protection
• A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

[*] MalwareBytes Anti-malware <<< A New and effective program
[*]a-squared Free <<< A good "realtime" or "on demand" scanner
[*]superantispyware <<< A good "realtime" or "on demand" scanner



Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place. Each does a different job, so you can have more than one
• Winpatrol
  • An excellent startup manager and then some !!
  • Notifies you if programs are added to startup
  • Allows delayed startup
  • A must have addition
• SpywareBlaster 4.0
  • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
• SpywareGuard 2.2
  • SpywareGuard provides real-time protection against spyware.
  • Not required if you have other "realtime" antispyware or Winpatrol
• ZonedOut
  • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
• MVPS HOSTS
  • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
  • For information on how to download and install, please read this tutorial by WinHelp2002.
  • Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
     
     • Change the Download signed ActiveX controls to Prompt
     • Change the Download unsigned ActiveX controls to Disable
     • Change the Initialise and script ActiveX controls not marked as safe to Disable
     • Change the Installation of desktop items to Prompt
     • Change the Launching programs and files in an IFRAME to Prompt
     • Change the Navigate sub-frames across different domains to Prompt
     • When all these settings have been made, click on the OK button.
     • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.

If you are still using IE6 then either update, or get one of the following.

• FireFox
  • With many addons available that make customization easy this is a very popular choice
  • NoScript and AdBlockPlus addons are essential
• Opera
  • Another popular alternative
• Netscape
  • Another popular alternative
  • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page. Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware. It is a good idea to empty the Temporary Internet Files folder on a regular basis. Tracking Cookies are files that websites use to monitor which sites you visit and how often. A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted. CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords Both of these can be cleaned manually, but a quicker option is to use a program
• ATF Cleaner
  • Free and very simple to use
• CCleaner
  • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

vulcansage

My internet explorer settings were already set as you suggested except
Change the Navigate sub-frames across different domains was set to disable..I put it on
prompt...but disable was probably safer.
I removed RSIT and since I did the OTMoveIt before I did the ComboFix. (sorry that I
didn't follow the order as written ) The OTMoveIt asked me to reboot and when I did,
ComboFix was gone from my desktop. Here is the CleanUP log from OTMoveIt..did that remove
all quarantined items?
========================================
File/Folder avenger.zip not found.
File/Folder avenger.exe not found.
File/Folder Avenger not found.
File/Folder avenger.txt not found.
File/Folder bfu.zip not found.
File/Folder BFU not found.
C:\WINDOWS\subs folder deleted successfully.
C:\Qoobox\Quarantine\Registry_backups folder deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32 folder deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS folder deleted successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Nebulagirl\Application Data folder deleted
successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Nebulagirl folder deleted successfully.
C:\Qoobox\Quarantine\C\Documents and Settings folder deleted successfully.
C:\Qoobox\Quarantine\C folder deleted successfully.
C:\Qoobox\Quarantine folder deleted successfully.
C:\Qoobox\BackEnv folder deleted successfully.
C:\Qoobox folder deleted successfully.
catchme service deleted successfully.
Service not present: gmer.
File delete failed. C:\Documents and Settings\Nebulagirl\Desktop\OTMoveIt3.exe scheduled
to be deleted on reboot.
File delete failed. C:\Documents and Settings\Nebulagirl\Desktop\OTMoveIt3.exe scheduled
to be deleted on reboot.
C:\_OTMoveIt\MovedFiles\01102009_114328 folder deleted successfully.
C:\_OTMoveIt\MovedFiles folder deleted successfully.
C:\_OTMoveIt folder deleted successfully.
File delete failed. C:\Documents and Settings\Nebulagirl\Desktop\OTMoveIt3.exe scheduled
========================================
While instituting the new security measures, The secunia scan found this..even though I
ran JavaRA it shows an old version. Is this because the version 1.5.x isn't in a version
subfolder and JavaRA didnt find it? How can I remedy this?
Also...a weird thing Although I am on Explorer 7 this entry occurred as a
[RED X] on the secunia scan. A while back someone recommended I do a procedure related to
windows updates where this C:\WINDOWS\SD_OLD\ was created. I don't really recall why I
did it.
[I have Pasted data from the Secunia online scan further below]

I feel very optimistic about the new security measures I am implementing. I want to get
everything in good secure shape Thanks for looking into these last few items.
Question:
If I run spybot S&D, should I allow teatimer to run now? I am also running winpatrol.
Things seem to be running well, and I can tell my overall performance..startup and
shutdown times are improved. I am excited about being able to get rid of startup items
that I don't want running!! Your sword is sharp Katana! Thank you for your help, I will
be forever grateful! Tell me here or in a PM where I can make a donation to this site.
Sincerely
Vulcansage (Neb)

===============secunia scan==========================
[RED X]
Sun Java JRE 1.5.x / 5.x 5.0.60.5
This installation of Sun Java JRE 1.5.x / 5.x is insecure and potentially exposes your
system to security threats!
The detected version installed on your system is 5.0.60.5, however, the latest patched
version released by the vendor, fixing one or more vulnerabilities, is 5.0.170.2.
Update Instructions:
Download

Installed on Your System in:
C:\Program Files\Java\jre1.5.0_06\bin\java.exe

---

[GREEN CHECK]
Sun Java JRE 1.6.x / 6.x 6.0.110.3
Sun Java JRE 1.6.x / 6.x is up-to-date. The detected version installed on your system is
6.0.110.3, which either corresponds to or is newer than the latest secure version
released by the vendor.
Installed on Your System in:
C:\Program Files\Java\jre6\bin\java.exe
=========================================
[RED X]
Sun Java JRE 1.5.x / 5.x 5.0.60.5
This installation of Sun Java JRE 1.5.x / 5.x is insecure and potentially exposes your
system to security threats!
The detected version installed on your system is 5.0.60.5, however, the latest patched
version released by the vendor, fixing one or more vulnerabilities, is 5.0.170.2.
Update Instructions:
Download
Installed on Your System in:
C:\i386\java.exe

---

[GREEN CHECK]
Sun Java JRE 1.6.x / 6.x 6.0.110.3
Sun Java JRE 1.6.x / 6.x is up-to-date. The detected version installed on your system is
6.0.110.3, which either corresponds to or is newer than the latest secure version
released by the vendor.
Installed on Your System in:
C:\WINDOWS\system32\java.exe
==============================================
Microsoft Internet Explorer 6.x 6.00.2900.5512
This installation of Microsoft Internet Explorer 6.x is insecure and potentially exposes
your system to security threats!
Your system does not have all security related patches from Microsoft installed. Please
see list below for details about the missing patches.
Update Instructions:
Download via Microsoft Windows Update.
Missing KB Articles:
KB958215
KB956390
KB956390
KB953838
KB950759
KB950759
KB947864
KB944533
KB942615
KB939653
KB939653
KB939653
KB937143
KB933566
KB931768
KB928090
KB958215
KB956390
KB956390
KB953838
KB950759
KB950759
KB947864
KB944533
KB942615
KB939653
KB939653
KB939653
KB937143
KB933566
KB931768
Installed on Your System in:
C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\iexplore.exe
===============================================

vulcansage

Oh.. I installed the winpatrol, and am getting used to it. It barks and something pops up, like when you are installing a program. But it barks and barks when I am just surfing and says "scotty is reviewing IE helpers" are these attacks? It barks incessantly and I can't seem to determine why.

Thank you

Katana

1) ComboFix was gone from my desktop.
2) did that remove all quarantined items?
3) If I run spybot S&D, should I allow teatimer to run now? I am also running winpatrol.
4) Tell me here or in a PM where I can make a donation to this site.

1) no problem, you can just redownload Combofix and then uninstall it properly

Download a copy from one of the links below
ComboFix.exe 1
ComboFix.exe 2
ComboFix.exe 3

Uninstall ComboFix using these instructions:

Click the Windows 'Start' button > Select 'Run' - then copy/paste the following bolded text into the run box & click OK.

"%userprofile%\desktop\combofix.exe" /killall


2)It removed all the files and backups that we have found during the cleanup.

3)You don't need TeaTimer and Winpatrol running at the same time.

4)The help here is completely free

5) Regarding Secunia and the IE problems it found, you would be better to update to SP3 and IE7 to cure those.


OTMoveIt
Please download OTMoveIt3 by OldTimer and save it to your desktop

• Double-click OTMoveIt3.exe to run it.
• Copy the lines in the codebox below. ( Make sure you include :Processes )

:Processes
:Files
C:\Program Files\Java\jre1.5.0_06

• Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

• - Close ALL open windows (especially Internet Explorer!)-
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.
• Close OTMoveIt3

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

vulcansage wrote:

I installed the winpatrol~ It barks and something pops up, But it barks and barks when I am just surfing and says "scotty is reviewing IE helpers" are these attacks?

Have a look here http://www.winpatrol.com/bho.html and see if that explains things

vulcansage

Oo is it still ok to do all this...I did install SP3 today

Katana

That's fine, you can still follow the instructions above