Random error sounds, Windows Update taskbar icon seems glitchy

Unknown · March 2009

I have no idea whats going on.

I recently had some sort of bug that made popups appear, and I seem to have neutralized it with Malwarebytes' Anti-Malware.

Thanks for the help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:00 PM, on 3/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
G:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Synaptics\SynTP\SynTPEnh.exe
G:\Program Files\IDT\WDM\sttray.exe
G:\Program Files\Softwin\BitDefender10\bdmcon.exe
G:\Program Files\Softwin\BitDefender10\bdagent.exe
G:\Program Files\PowerISO\PWRISOVM.EXE
G:\WINDOWS\system32\RUNDLL32.EXE
G:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\Program Files\Java\jre6\bin\jusched.exe
G:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
G:\Program Files\Launchy\Launchy.exe
G:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\system32\PnkBstrA.exe
G:\WINDOWS\system32\STacSV.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
G:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\Program Files\mIRC\mirc.exe
G:\WINDOWS\system32\rundll32.exe
G:\Program Files\uTorrent\uTorrent.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Hamachi\hamachi.exe
G:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
G:\Program Files\Softwin\BitDefender10\vsserv.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - G:\Program Files\IEPro\iepro.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07506236-433B-4F41-9D02-11C16956B9C7} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPEnh] G:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BDMCon] "G:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "G:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "G:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Ad-Watch] G:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Launchy.lnk = G:\Program Files\Launchy\Launchy.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - G:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - G:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - G:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - G:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1214977620015
O17 - HKLM\System\CCS\Services\Tcpip\..\{77CA002F-9419-4E98-AB89-066C3CF87168}: NameServer = 68.94.156.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F966B089-B836-46B0-9225-D0CABC306A30}: NameServer = 68.94.156.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - G:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: hcwwew.dll
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - G:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Bonjour Service - Apple Inc. - G:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - G:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - G:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - G:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - G:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - G:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: npkcmsvc - Unknown owner - G:\Nexon\MapleStory\npkcmsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - G:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - G:\WINDOWS\system32\STacSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - G:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - G:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 11346 bytes

Katana · March 2009

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.

Duckys · March 2009

Logfile of random's system information tool 1.05 (written by random/random)
Run by Ducky at 2009-03-11 21:53:08
Microsoft Windows XP Professional Service Pack 3
System drive G: has 19 GB (19%) free of 100 GB
Total RAM: 3070 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:53:12 PM, on 3/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
G:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Synaptics\SynTP\SynTPEnh.exe
G:\Program Files\IDT\WDM\sttray.exe
G:\Program Files\Softwin\BitDefender10\bdmcon.exe
G:\Program Files\Softwin\BitDefender10\bdagent.exe
G:\Program Files\PowerISO\PWRISOVM.EXE
G:\WINDOWS\system32\RUNDLL32.EXE
G:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
G:\Program Files\iTunes\iTunesHelper.exe
G:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
G:\Program Files\Java\jre6\bin\jusched.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
G:\Program Files\Launchy\Launchy.exe
G:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
G:\Program Files\Bonjour\mDNSResponder.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\WINDOWS\system32\nvsvc32.exe
G:\WINDOWS\system32\PnkBstrA.exe
G:\WINDOWS\system32\STacSV.exe
G:\WINDOWS\system32\svchost.exe
G:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
G:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
G:\Program Files\iPod\bin\iPodService.exe
G:\Program Files\mIRC\mirc.exe
G:\WINDOWS\system32\rundll32.exe
G:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
G:\Program Files\Softwin\BitDefender10\vsserv.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\uTorrent\uTorrent.exe
G:\WINDOWS\System32\svchost.exe
G:\Documents and Settings\Ducky\Desktop\Downloads\RSIT.exe
G:\Program Files\Trend Micro\HijackThis\Ducky.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - G:\Program Files\IEPro\iepro.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07506236-433B-4F41-9D02-11C16956B9C7} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SynTPEnh] G:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [BDMCon] "G:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "G:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "G:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "G:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] G:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Launchy.lnk = G:\Program Files\Launchy\Launchy.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - G:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Grab and Drag - {000002a3-84fe-43f1-b958-f2c3ca804f1a} - G:\Program Files\IEPro\iepro.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - G:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - G:\Program Files\IEPro\iepro.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - G:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1214977620015
O17 - HKLM\System\CCS\Services\Tcpip\..\{77CA002F-9419-4E98-AB89-066C3CF87168}: NameServer = 68.94.156.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F966B089-B836-46B0-9225-D0CABC306A30}: NameServer = 68.94.156.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - G:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: hcwwew.dll
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Adobe Systems Incorporated - G:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
O23 - Service: Apple Mobile Device - Apple Inc. - G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - G:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Bonjour Service - Apple Inc. - G:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - G:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - G:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - G:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - G:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - G:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: npkcmsvc - Unknown owner - G:\Nexon\MapleStory\npkcmsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - G:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - G:\WINDOWS\system32\STacSV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - G:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - G:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 11399 bytes

======Scheduled tasks folder======

G:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
G:\WINDOWS\tasks\AppleSoftwareUpdate.job
G:\WINDOWS\tasks\bjspzztx.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}]
IE7Pro BHO - G:\Program Files\IEPro\iepro.dll [2008-09-23 756840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - G:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07506236-433B-4F41-9D02-11C16956B9C7}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - G:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - G:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-10 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - G:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - G:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2004-12-14 225280]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=G:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-12-06 1024000]
"SysTrayApp"=G:\Program Files\IDT\WDM\sttray.exe [2007-09-14 405504]
"NvCplDaemon"=G:\WINDOWS\system32\NvCpl.dll [2008-06-17 13533184]
"nwiz"=nwiz.exe /install []
"BDMCon"=G:\Program Files\Softwin\BitDefender10\bdmcon.exe [2007-04-02 290816]
"BDAgent"=G:\Program Files\Softwin\BitDefender10\bdagent.exe [2007-03-26 69632]
"PWRISOVM.EXE"=G:\Program Files\PowerISO\PWRISOVM.EXE [2006-05-20 188416]
"NvMediaCenter"=G:\WINDOWS\system32\NvMcTray.dll [2008-06-17 86016]
"Adobe Reader Speed Launcher"=G:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"Adobe Version Cue CS2"=G:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe [2005-04-04 856064]
"Acrobat Assistant 7.0"=G:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe [2004-12-14 483328]
""= []
"AppleSyncNotifier"=G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-11-07 111936]
"QuickTime Task"=G:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
"iTunesHelper"=G:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"Ad-Watch"=G:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe [2009-03-06 515416]
"SunJavaUpdateSched"=G:\Program Files\Java\jre6\bin\jusched.exe [2009-03-10 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=G:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
G:\Program Files\Camera Assistant Software for Gateway\traybar.exe [2007-09-13 638976]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
G:\Program Files\Electronic Arts\EADM\Core.exe [2008-07-22 2772992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
G:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\G:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
G:\PROGRA~1\MICROS~3\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]

G:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Acrobat Speed Launcher.lnk - G:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
Adobe Gamma.lnk - G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Bluetooth.lnk - G:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
Launchy.lnk - G:\Program Files\Launchy\Launchy.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="hcwwew.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
G:\WINDOWS\system32\WgaLogon.dll [2008-09-06 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"G:\Program Files\IEPro\MiniDM.exe"="G:\Program Files\IEPro\MiniDM.exe:*:Enabled:MiniDM"
"G:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="G:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32"
"G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="G:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"G:\WINDOWS\system32\PnkBstrA.exe"="G:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"G:\WINDOWS\system32\PnkBstrB.exe"="G:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"G:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe"="G:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe:*:Enabled:Adobe Version Cue CS2"
"G:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe"="G:\Program Files\Microsoft Games\Gears of War\Binaries\WarGame-G4WLive.exe:*:Enabled:Gears of War"
"G:\Program Files\Electronic Arts\EADM\Core.exe"="G:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager"
"G:\Program Files\Starcraft\StarCraft.exe"="G:\Program Files\Starcraft\StarCraft.exe:*:Enabled:Starcraft"
"G:\Program Files\uTorrent\uTorrent.exe"="G:\Program Files\uTorrent\uTorrent.exe:*:Enabled:ÂµTorrent"
"G:\Program Files\Hamachi\hamachi.exe"="G:\Program Files\Hamachi\hamachi.exe:*:Enabled:Hamachi Client"
"G:\Program Files\UnrealTournament\System\UnrealTournament.exe"="G:\Program Files\UnrealTournament\System\UnrealTournament.exe:*:Enabled:UnrealTournament"
"G:\Program Files\Skype\Phone\Skype.exe"="G:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"G:\Program Files\iTunes\iTunes.exe"="G:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"G:\Program Files\mIRC\mirc.exe"="G:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"G:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe"="G:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"G:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe"="G:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM)"
"G:\Program Files\Bonjour\mDNSResponder.exe"="G:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"G:\Documents and Settings\Ducky\Desktop\SRO_New_Full-Client_Downloader.exe"="G:\Documents and Settings\Ducky\Desktop\SRO_New_Full-Client_Downloader.exe:*:Enabled:Full-Client Downloader"
"G:\Program Files\Java\jre6\bin\java.exe"="G:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary"
"G:\Program Files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe"="G:\Program Files\Steam\steamapps\common\peggle extreme\PeggleExtreme.exe:*:Enabled:Peggle Extreme"
"G:\Program Files\Mozilla Firefox\firefox.exe"="G:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-03-11 21:53:08 ----D---- G:\rsit
2009-03-11 18:59:37 ----HDC---- G:\WINDOWS\$NtUninstallKB960225$
2009-03-11 18:59:33 ----HDC---- G:\WINDOWS\$NtUninstallKB958690$
2009-03-11 18:59:15 ----HDC---- G:\WINDOWS\$NtUninstallKB959772_WM11$
2009-03-10 07:33:48 ----A---- G:\WINDOWS\system32\javaws.exe
2009-03-10 07:33:48 ----A---- G:\WINDOWS\system32\javaw.exe
2009-03-10 07:33:48 ----A---- G:\WINDOWS\system32\java.exe
2009-03-07 19:19:50 ----D---- G:\Program Files\Trend Micro
2009-03-04 16:04:15 ----N---- G:\WINDOWS\system32\pxsfs.dll
2009-03-04 16:04:15 ----N---- G:\WINDOWS\system32\pxinsa64.exe
2009-03-04 16:04:15 ----N---- G:\WINDOWS\system32\pxcpya64.exe
2009-03-04 16:04:15 ----N---- G:\WINDOWS\system32\pxafs.dll
2009-03-04 16:04:12 ----D---- G:\Program Files\Winamp
2009-03-04 16:04:12 ----D---- G:\Documents and Settings\Ducky\Application Data\Winamp
2009-03-03 21:15:55 ----A---- G:\WINDOWS\system32\unrar.dll
2009-03-03 21:15:54 ----A---- G:\WINDOWS\system32\yv12vfw.dll
2009-03-03 21:15:53 ----A---- G:\WINDOWS\system32\xvidvfw.dll
2009-03-03 21:15:53 ----A---- G:\WINDOWS\system32\xvidcore.dll
2009-03-03 21:15:53 ----A---- G:\WINDOWS\system32\qt-dx331.dll
2009-03-03 21:15:53 ----A---- G:\WINDOWS\system32\dpl100.dll
2009-03-03 21:15:52 ----A---- G:\WINDOWS\system32\ff_vfw.dll.manifest
2009-03-03 21:15:52 ----A---- G:\WINDOWS\system32\ff_vfw.dll
2009-03-03 21:15:52 ----A---- G:\WINDOWS\system32\divx.dll
2009-03-03 21:15:51 ----D---- G:\Program Files\K-Lite Codec Pack
2009-03-03 21:15:51 ----A---- G:\WINDOWS\system32\pthreadGC2.dll
2009-03-03 20:12:29 ----D---- G:\Program Files\ICCup
2009-03-01 02:47:34 ----D---- G:\Documents and Settings\Ducky\Application Data\GRETECH
2009-03-01 02:47:28 ----D---- G:\Program Files\GRETECH
2009-02-28 16:55:05 ----D---- G:\Program Files\VideoLAN
2009-02-28 00:26:14 ----D---- G:\Program Files\Steam
2009-02-27 14:43:23 ----D---- G:\Program Files\Peggle Nights Deluxe
2009-02-25 23:43:21 ----D---- G:\Documents and Settings\All Users\Application Data\Trymedia
2009-02-25 23:41:52 ----D---- G:\Program Files\Peggle
2009-02-25 23:41:52 ----D---- G:\Program Files\BFG
2009-02-25 18:53:52 ----HDC---- G:\WINDOWS\$NtUninstallKB967715$
2009-02-24 13:27:51 ----HD---- G:\WINDOWS\system32\GroupPolicy
2009-02-23 17:39:40 ----A---- G:\WINDOWS\system32\msexcr.ini
2009-02-16 20:53:39 ----A---- G:\WINDOWS\ipuninst.exe
2009-02-16 20:44:43 ----D---- G:\Program Files\Interplay
2009-02-12 22:10:46 ----D---- G:\Documents and Settings\Ducky\Application Data\Opera
2009-02-12 21:19:40 ----D---- G:\Program Files\Audacity

======List of files/folders modified in the last 1 months======

2009-03-11 21:52:41 ----D---- G:\Documents and Settings\Ducky\Application Data\uTorrent
2009-03-11 21:37:49 ----D---- G:\Program Files\Starcraft
2009-03-11 21:32:24 ----D---- G:\Program Files\Mozilla Firefox
2009-03-11 20:54:24 ----D---- G:\WINDOWS\Temp
2009-03-11 19:43:55 ----D---- G:\WINDOWS\system32
2009-03-11 19:43:55 ----A---- G:\WINDOWS\system32\PerfStringBackup.INI
2009-03-11 19:41:33 ----D---- G:\Documents and Settings\Ducky\Application Data\mIRC
2009-03-11 19:41:21 ----D---- G:\Program Files\mIRC
2009-03-11 19:39:21 ----D---- G:\WINDOWS
2009-03-11 19:37:48 ----A---- G:\WINDOWS\SchedLgU.Txt
2009-03-11 19:26:08 ----D---- G:\Documents and Settings\Ducky\Application Data\Hamachi
2009-03-11 19:00:12 ----SHD---- G:\WINDOWS\Installer
2009-03-11 18:59:40 ----HD---- G:\WINDOWS\inf
2009-03-11 18:59:39 ----RSHDC---- G:\WINDOWS\system32\dllcache
2009-03-11 18:59:36 ----A---- G:\WINDOWS\imsins.BAK
2009-03-11 12:37:00 ----HD---- G:\WINDOWS\$hf_mig$
2009-03-11 12:36:55 ----D---- G:\WINDOWS\system32\CatRoot2
2009-03-10 21:44:03 ----D---- G:\Program Files\uTorrent
2009-03-10 07:58:47 ----SD---- G:\Documents and Settings\Ducky\Application Data\Microsoft
2009-03-10 07:33:35 ----A---- G:\WINDOWS\system32\deploytk.dll
2009-03-09 20:22:18 ----D---- G:\WINDOWS\network diagnostic
2009-03-09 14:27:55 ----D---- G:\WINDOWS\Prefetch
2009-03-07 19:19:50 ----RD---- G:\Program Files
2009-03-06 17:03:05 ----D---- G:\WINDOWS\system32\drivers
2009-03-06 17:03:03 ----DC---- G:\WINDOWS\system32\DRVSTORE
2009-03-06 17:02:44 ----A---- G:\WINDOWS\system32\lsdelete.exe
2009-02-28 23:31:20 ----D---- G:\Program Files\Malwarebytes' Anti-Malware
2009-02-25 19:26:57 ----D---- G:\Program Files\Microsoft Silverlight
2009-02-14 22:15:07 ----D---- G:\Maple
2009-02-12 22:10:47 ----A---- G:\WINDOWS\win.ini
2009-02-12 21:18:45 ----D---- G:\Documents and Settings\Ducky\Application Data\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; G:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352]
R1 SCDEmu;SCDEmu; G:\WINDOWS\system32\drivers\SCDEmu.sys [2006-05-20 30588]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; G:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R3 AgereSoftModem;Agere Systems Soft Modem; G:\WINDOWS\system32\DRIVERS\AGRSM.sys [2007-10-30 1201632]
R3 Arp1394;1394 ARP Client Protocol; G:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 btaudio;Bluetooth Audio Device; G:\WINDOWS\system32\drivers\btaudio.sys [2008-07-01 539432]
R3 BTDriver;Bluetooth Virtual Communications Driver; G:\WINDOWS\system32\DRIVERS\btport.sys [2008-07-01 37424]
R3 BTKRNL;Bluetooth Bus Enumerator; G:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-07-01 879496]
R3 BTWDNDIS;Bluetooth LAN Access Server; G:\WINDOWS\system32\DRIVERS\btwdndis.sys [2008-07-01 156392]
R3 btwhid;btwhid; G:\WINDOWS\system32\DRIVERS\btwhid.sys [2008-07-01 55352]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; G:\WINDOWS\System32\Drivers\btwusb.sys [2008-07-01 74656]
R3 CmBatt;Microsoft AC Adapter Driver; G:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; G:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 hamachi;Hamachi Network Interface; G:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-11-23 25280]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; G:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 mouhid;Mouse HID Driver; G:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NETw4x32;Intel(R) Wireless WiFi Link Adapter Driver for Windows XP 32 Bit; G:\WINDOWS\system32\DRIVERS\NETw4x32.sys [2007-02-25 2203520]
R3 NIC1394;1394 Net Driver; G:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; G:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-06-17 6010752]
R3 pfc;Padus ASPI Shell; G:\WINDOWS\system32\drivers\pfc.sys [2005-11-02 10368]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; G:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-05-07 106368]
R3 STHDA;IDT High Definition Audio CODEC; G:\WINDOWS\system32\drivers\sthda.sys [2007-09-14 1248056]
R3 SynTP;Synaptics TouchPad Driver; G:\WINDOWS\system32\DRIVERS\SynTP.sys [2007-12-06 220032]
R3 usbccgp;Microsoft USB Generic Parent Driver; G:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; G:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; G:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbstor;USB Mass Storage Driver; G:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; G:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 usbvideo;Gateway USB 2.0 Webcam; G:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 UVCFTR;UVCFTR; G:\WINDOWS\System32\Drivers\UVCFTR_S.SYS [2007-09-11 11264]
S2 npkcrypt;npkcrypt; \??\G:\Nexon\MapleStory\npkcrypt.sys []
S3 bdfdll;bdfdll; \??\G:\Program Files\Softwin\BitDefender10\bdfdll.sys []
S3 BDFsDrv;BDFsDrv; \??\G:\Program Files\Softwin\BitDefender10\bdfsdrv.sys []
S3 BDRsDrv;BDRsDrv; \??\G:\Program Files\Softwin\BitDefender10\bdrsdrv.sys []
S3 CCDECODE;Closed Caption Decoder; G:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HidUsb;Microsoft HID Class Driver; G:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; G:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; G:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; G:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 Profos;Profos; \??\G:\Program Files\Softwin\BitDefender10\profos.sys []
S3 SLIP;BDA Slip De-Framer; G:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; G:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 Trufos;Trufos; \??\G:\Program Files\Softwin\BitDefender10\trufos.sys []
S3 WSTCODEC;World Standard Teletext Codec; G:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; G:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; G:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; G:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; G:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 bdss;BitDefender Scan Server; G:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe [2007-01-19 81920]
R2 Bonjour Service;Bonjour Service; G:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 btwdins;Bluetooth Service; G:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2007-09-11 264800]
R2 JavaQuickStarterService;Java Quick Starter; G:\Program Files\Java\jre6\bin\jqs.exe [2009-03-10 152984]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; G:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
R2 LIVESRV;BitDefender Desktop Update Service; G:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe [2008-08-08 278528]
R2 MDM;Machine Debug Manager; G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVSvc;NVIDIA Display Driver Service; G:\WINDOWS\system32\nvsvc32.exe [2008-06-17 159812]
R2 PnkBstrA;PnkBstrA; G:\WINDOWS\system32\PnkBstrA.exe [2008-07-03 66872]
R2 STacSV;Audio Service; G:\WINDOWS\system32\STacSV.exe [2007-09-14 204800]
R2 VSSERV;BitDefender Virus Shield; G:\Program Files\Softwin\BitDefender10\vsserv.exe [2007-10-24 462848]
R2 XCOMM;BitDefender Communicator; G:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe [2006-11-09 86016]
R3 iPod Service;iPod Service; G:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S2 npkcmsvc;npkcmsvc; G:\Nexon\MapleStory\npkcmsvc.exe []
S3 Adobe LM Service;Adobe LM Service; G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-09-08 72704]
S3 Adobe Version Cue CS2;Adobe Version Cue CS2; G:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe [2005-04-04 163840]
S3 aspnet_state;ASP.NET State Service; G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; G:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; G:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 ose;Office Source Engine; G:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usprserv;User Privilege Service; G:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; G:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; G:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; G:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

EOF

Duckys · March 2009

info.txt logfile of random's system information tool 1.05 2009-03-11 21:53:13

======Uninstall list======

-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
-->msiexec /i {46548E80-0409-0000-7E8A-45000F855001}
-->msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
-->msiexec /I{7F4C8163-F259-49A0-A018-2857A90578BC}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 G:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->G:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Ad-Aware-->"G:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->G:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}\Ad-AwareAE.exe
Adobe After Effects 7.0-->msiexec /I {DD362256-A7A2-4524-9457-213DDC2AFC2A}
Adobe AIR-->G:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Audition 2.0-->msiexec /I {01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}
Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-6884-0000-0000-000000000103}
Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5102}
Adobe Creative Suite 2-->G:\PROGRA~1\INSTAL~1\{0134A~1\setup.exe /relaunched/rootloc=i:\/lang=0409
Adobe Flash Player ActiveX-->G:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->G:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 2.0-->MsiExec.exe /I{8FFC924C-ED06-44CB-8867-3CA778ECE903}
Adobe Premiere Pro 2.0-->msiexec /I {FA17A726-B229-4116-B793-A2AB1A4EAE2E}
Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1437-443D-B06E-79A00FE45110}
Adobe SVG Viewer 3.0-->G:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fG:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Agere Systems HDA Modem-->agrsmdel
AMIP (remove only)-->"G:\Program Files\Winamp\Plugins\amip_uninstall.exe"
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Audacity 1.2.6-->"G:\Program Files\Audacity\unins000.exe"
BitDefender Free Edition v10-->MsiExec.exe /I{CEFC581D-BEAE-4F75-989E-BD931970D8AD}
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Call of Duty(R) - World at War(TM)-->G:\Program Files\InstallShield Installation Information\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch-->G:\Program Files\InstallShield Installation Information\{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM)-->G:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0409
Camera Assistant Software for Gateway-->G:\Program Files\InstallShield Installation Information\{39098402-3F7A-4257-A4AE-FC1181D1B40B}\setup.exe -runfromtemp -l0x0009
CCleaner (remove only)-->"G:\Program Files\CCleaner\uninst.exe"
Critical Update for Windows Media Player 11 (KB959772)-->"G:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Crysis WARHEAD(R)-->"G:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}\SETUP.EXE" REMOVE=TRUE MODIFY=FALSE
Crysis WARHEAD(R)-->G:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}\SETUP.exe
Crysis(R)-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
EA Download Manager-->G:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{EF7E931D-DC84-471B-8DB6-A83358095474} /l1033
Fallout-->G:\WINDOWS\ipuninst.exe -fG:\Program Files\Interplay\Fallout\uninst.log
Gears of War-->G:\Program Files\InstallShield Installation Information\{1170D24F-42B7-40CF-AA1B-6395CE562354}\Setup.exe -runfromtemp -l0x0409
GOM Player-->"G:\Program Files\GRETECH\GomPlayer\Uninstall.exe"
Hamachi 1.0.3.0-->G:\Program Files\Hamachi\uninstall.exe
HijackThis 2.0.2-->"G:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"G:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"G:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"G:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
ICCup Launcher-->"G:\Program Files\ICCup\Launcher\unins000.exe"
IE7Pro-->G:\Program Files\IEPro\uninst.exe
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
Java DB 10.4.1.3-->MsiExec.exe /X{998D6972-F58E-479D-9248-8F179E55AE38}
Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Development Kit 6 Update 11-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160110}
K-Lite Codec Pack 4.7.0 (Full)-->"G:\Program Files\K-Lite Codec Pack\unins000.exe"
Launchy 2.1.2-->"G:\Program Files\Launchy\unins000.exe"
Malwarebytes' Anti-Malware-->"G:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MapleStory-->MsiExec.exe /I{3062D9D0-0EF0-4F0D-9575-26013FF60FC9}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"G:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "G:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5-->G:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft Compression Client Pack 1.0 for Windows XP-->"G:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{20DEB77C-21D6-4D22-BB47-233E47613D57}
Microsoft Internationalized Domain Names Mitigation APIs-->"G:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"G:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office FrontPage 2003-->MsiExec.exe /I{90170409-6000-11D3-8CFE-0150048383C9}
Microsoft Office OneNote 2003-->MsiExec.exe /I{90A10409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Project Professional 2003-->MsiExec.exe /I{903B0409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Visio Professional 2003-->MsiExec.exe /I{90510409-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"G:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
mIRC-->G:\Program Files\mIRC\uninstall.exe _?=G:\Program Files\mIRC
MobileMe Control Panel-->MsiExec.exe /I{924EB80F-C2BB-4B9F-8412-88BBA937393F}
Mozilla Firefox (3.0.7)-->G:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
NVIDIA Drivers-->G:\WINDOWS\system32\nvuninst.exe UninstallGUI
Peggle (remove only)-->G:\Program Files\Peggle\Uninstall.exe
Peggle Extreme-->"G:\Program Files\Steam\steam.exe" steam://uninstall/3483
Peggle Nights Deluxe 1.00-->G:\Program Files\Peggle Nights Deluxe\Uninstall.exe
PowerISO-->"G:\Program Files\PowerISO\uninstall.exe"
PunkBuster Services-->G:\WINDOWS\system32\pbsvc.exe -u
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->G:\Program Files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\setup.exe -runfromtemp -l0x0009 -removeonly
Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"G:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)-->"G:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)-->"G:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)-->"G:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)-->"G:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)-->"G:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB961260)-->"G:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"G:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"G:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"G:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->G:\WINDOWS\system32\MacroMed\Flash\genuinst.exe G:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"G:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"G:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"G:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"G:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"G:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"G:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"G:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"G:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"G:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"G:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"G:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"G:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)-->"G:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"G:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"G:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"G:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"G:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"G:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"G:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"G:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"G:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"G:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"G:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)-->"G:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"G:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"G:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Silkroad-->G:\Program Files\Silkroad\Remove.Exe
Skypeâ„¢ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Starcraft-->G:\WINDOWS\SCunin.exe G:\WINDOWS\SCunin.dat
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Suite Specific-->MsiExec.exe /I{C49DAA9C-5BA8-459A-8244-E57B69DF0F04}
Super DVD Copy (remove only)-->"G:\Program Files\Super DVD Copy\sdc-uninst.exe"
Synaptics Pointing Device Driver-->rundll32.exe "G:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Requirements Lab-->G:\Program Files\SystemRequirementsLab\Uninstall.exe
TextPad 5-->MsiExec.exe /X{B6EC7388-E277-4A5B-8C8F-71067A41BA64}
Tribes 2-->G:\PROGRA~1\Tribes2\UNWISE.EXE G:\PROGRA~1\Tribes2\INSTALL.LOG
Update for Windows XP (KB942763)-->"G:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)-->"G:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"G:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"G:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"G:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->G:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
WIDCOMM Bluetooth Software-->MsiExec.exe /X{84814E6B-2581-46EC-926A-823BD1C670F6}
Winamp-->"G:\Program Files\Winamp\UninstWA.exe"
Windows Driver Package - Intel (NETw4x32) net (02/25/2007 11.1.0.86)-->G:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u G:\WINDOWS\system32\DRVSTORE\netw4x32_6BCDD85873491234C1BCE1A995B7FEDD88433F15\netw4x32.inf
Windows Driver Package - Intel (w29n51) net (02/08/2007 9.0.4.33)-->G:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u G:\WINDOWS\system32\DRVSTORE\w29n51_3219C3E9682004CC6857361A4203A8986CCEB210\w29n51.inf
Windows Driver Package - Intel net (02/25/2007 11.1.0.86)-->G:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u G:\WINDOWS\system32\DRVSTORE\netw4k32_1BDC0713EC2AE134FC858C6F7F20C87410E6BA5C\netw4k32.inf
Windows Driver Package - Intel net (02/25/2007 11.1.0.86)-->G:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst32.EXE /u G:\WINDOWS\system32\DRVSTORE\netw4x64_4222030BCE046C58A302D849F8E5584EF0C7D11B\netw4x64.inf
Windows Internet Explorer 7-->"G:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"G:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"G:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"G:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"G:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"G:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->G:\Program Files\WinRAR\uninstall.exe

======Security center information======

AV: Bitdefender Antivirus

System event log

Computer Name: DUCKY-5A0BFB3AD
Event Code: 7036
Message: The BitDefender Virus Shield service entered the stopped state.

Record Number: 27079
Source Name: Service Control Manager
Time Written: 20090227210153.000000-480
Event Type: information
User:

Computer Name: DUCKY-5A0BFB3AD
Event Code: 7036
Message: The Universal Plug and Play Device Host service entered the running state.

Record Number: 27078
Source Name: Service Control Manager
Time Written: 20090227205446.000000-480
Event Type: information
User:

Computer Name: DUCKY-5A0BFB3AD
Event Code: 7035
Message: The Universal Plug and Play Device Host service was successfully sent a start control.

Record Number: 27077
Source Name: Service Control Manager
Time Written: 20090227205446.000000-480
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: DUCKY-5A0BFB3AD
Event Code: 7000
Message: The BDRsDrv service failed to start due to the following error:
The system cannot find the file specified.

Record Number: 27076
Source Name: Service Control Manager
Time Written: 20090227200201.000000-480
Event Type: error
User:

Computer Name: DUCKY-5A0BFB3AD
Event Code: 7000
Message: The BDFsDrv service failed to start due to the following error:
The system cannot find the file specified.

Record Number: 27075
Source Name: Service Control Manager
Time Written: 20090227200201.000000-480
Event Type: error
User:

Application event log

Computer Name: DUCKY-5A0BFB3AD
Event Code: 1005
Message: The Windows Installer initiated a system restart to complete or continue the configuration of 'Microsoft Office Professional Edition 2003'.

Record Number: 491
Source Name: MsiInstaller
Time Written: 20080713113300.000000-420
Event Type: information
User: DUCKY-5A0BFB3AD\Ducky

Computer Name: DUCKY-5A0BFB3AD
Event Code: 11728
Message: Product: Microsoft Office Professional Edition 2003 -- Configuration completed successfully.

Record Number: 490
Source Name: MsiInstaller
Time Written: 20080713113300.000000-420
Event Type: information
User: DUCKY-5A0BFB3AD\Ducky

Computer Name: DUCKY-5A0BFB3AD
Event Code: 1022
Message: Product: Microsoft Office Professional Edition 2003 - Update 'Office 2003 Service Pack 3 (SP3): MAINSP3' installed successfully.

Record Number: 489
Source Name: MsiInstaller
Time Written: 20080713113300.000000-420
Event Type: information
User: DUCKY-5A0BFB3AD\Ducky

Computer Name: DUCKY-5A0BFB3AD
Event Code: 1025
Message: Product: Microsoft Office Professional Edition 2003. The file G:\Program Files\Microsoft Office\OFFICE11\AUTHZAX.DLL is being held in use by the following process Name: firefox , Id 1616.

Record Number: 488
Source Name: MsiInstaller
Time Written: 20080713113145.000000-420
Event Type: information
User: DUCKY-5A0BFB3AD\Ducky

Computer Name: DUCKY-5A0BFB3AD
Event Code: 1005
Message: The Windows Installer initiated a system restart to complete or continue the configuration of 'Microsoft Office FrontPage 2003'.

Record Number: 487
Source Name: MsiInstaller
Time Written: 20080713113107.000000-420
Event Type: information
User: DUCKY-5A0BFB3AD\Ducky

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\system32\WBEM;G:\Program Files\Common Files\Adobe\AGL;G:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;G:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=G:\Program Files\Java\jre6\lib\ext\QTJava.zip

EOF

Katana · March 2009

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

uTorrent
I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Also available here.

My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
Please note: you must NOT use any P2P whilst we are cleaning your machine.

Malwarebytes' Anti-Malware

Start MalwareBytes AntiMalware
- Update Malwarebytes' Anti-Malware
- Select the Update tab
- Click Update
When the update is complete, select the Scanner tab
Select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply
Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Duckys · March 2009

Malwarebytes' Anti-Malware 1.34
Database version: 1841
Windows 5.1.2600 Service Pack 3

3/12/2009 3:54:59 PM
mbam-log-2009-03-12 (15-54-58).txt

Scan type: Full Scan (D:\|G:\|)
Objects scanned: 173852
Time elapsed: 39 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Duckys · March 2009

ComboFix 09-03-10.03 - Ducky 2009-03-12 16:09:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2354 [GMT -7:00]
Running from: g:\documents and settings\Ducky\Desktop\Downloads\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\Autorun.inf
g:\windows\system32\pthreadGC2.dll
g:\windows\system32\PVuutBeg.ini
g:\windows\system32\PVuutBeg.ini2
g:\windows\system32\vxcxkppi.ini
g:\windows\Tasks\bjspzztx.job

.
((((((((((((((((((((((((( Files Created from 2009-02-12 to 2009-03-12 )))))))))))))))))))))))))))))))
.

2009-03-11 21:53 . 2009-03-11 21:53 <DIR> d

G:\rsit
2009-03-07 19:19 . 2009-03-07 19:19 <DIR> d

g:\program files\Trend Micro
2009-03-04 16:04 . 2009-03-04 16:04 <DIR> d

g:\program files\Winamp
2009-03-04 16:04 . 2009-03-04 16:25 <DIR> d

g:\documents and settings\Ducky\Application Data\Winamp
2009-03-04 16:04 . 2008-08-20 10:58 129,520

g:\windows\system32\pxafs.dll
2009-03-04 16:04 . 2008-08-20 10:58 9,200

g:\windows\system32\drivers\cdralw2k.sys
2009-03-04 16:04 . 2008-08-20 10:58 9,072

g:\windows\system32\drivers\cdr4_xp.sys
2009-03-03 21:15 . 2009-03-03 21:16 <DIR> d

g:\program files\K-Lite Codec Pack
2009-03-03 21:15 . 2008-11-06 09:37 3,596,288 --a

g:\windows\system32\qt-dx331.dll
2009-03-03 21:15 . 2008-09-24 11:41 839,680 --a

g:\windows\system32\lameACM.acm
2009-03-03 21:15 . 2008-12-07 11:08 795,648 --a

g:\windows\system32\xvidcore.dll
2009-03-03 21:15 . 2008-11-06 09:33 684,032 --a

g:\windows\system32\divx.dll
2009-03-03 21:15 . 2004-01-25 09:18 217,088 --a

g:\windows\system32\yv12vfw.dll
2009-03-03 21:15 . 2008-09-16 12:23 168,448 --a

g:\windows\system32\unrar.dll
2009-03-03 21:15 . 2008-12-07 11:08 130,048 --a

g:\windows\system32\xvidvfw.dll
2009-03-03 21:15 . 2007-09-20 17:52 118,784 --a

g:\windows\system32\ac3acm.acm
2009-03-03 21:15 . 2008-12-10 17:33 86,016 --a

g:\windows\system32\dpl100.dll
2009-03-03 21:15 . 2009-02-09 11:56 67,584 --a

g:\windows\system32\ff_vfw.dll
2009-03-03 21:15 . 2007-07-10 09:10 547 --a

g:\windows\system32\ff_vfw.dll.manifest
2009-03-03 21:15 . 2008-10-03 05:30 414 --a

g:\windows\system32\lame_acm.xml
2009-03-03 20:12 . 2009-03-03 20:12 <DIR> d

g:\program files\ICCup
2009-03-01 02:47 . 2009-03-01 02:47 <DIR> d

g:\program files\GRETECH
2009-03-01 02:47 . 2009-03-01 02:47 <DIR> d

g:\documents and settings\Ducky\Application Data\GRETECH
2009-02-28 16:55 . 2009-02-28 16:55 <DIR> d

g:\program files\VideoLAN
2009-02-28 00:26 . 2009-02-28 10:05 <DIR> d

g:\program files\Steam
2009-02-27 14:43 . 2009-03-11 23:42 <DIR> d

g:\program files\Peggle Nights Deluxe
2009-02-25 23:43 . 2009-02-25 23:43 <DIR> d

g:\documents and settings\All Users\Application Data\Trymedia
2009-02-25 23:41 . 2009-02-25 23:43 <DIR> d

g:\program files\Peggle
2009-02-25 23:41 . 2009-02-25 23:41 <DIR> d

g:\program files\BFG
2009-02-25 22:46 . 2009-03-11 23:42 61 --a

g:\windows\popcinfot.dat
2009-02-25 22:46 . 2009-02-25 22:46 0 --a

g:\windows\popcreg.dat
2009-02-24 13:27 . 2009-02-24 13:27 <DIR> d--h

g:\windows\system32\GroupPolicy
2009-02-23 17:39 . 2009-02-23 17:39 5,646 --a

g:\windows\system32\msexcr.ini
2009-02-16 20:53 . 2009-02-16 20:53 52,224 --a

g:\windows\ipuninst.exe
2009-02-16 20:44 . 2009-02-16 20:44 <DIR> d

g:\program files\Interplay
2009-02-12 21:19 . 2009-02-12 21:19 <DIR> d

g:\program files\Audacity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-12 23:06 81,984 ----a-w g:\windows\system32\bdod.bin
2009-03-12 23:06

d

w g:\program files\Common Files\Softwin
2009-03-12 21:05

d

w g:\program files\Starcraft
2009-03-12 19:25

d

w g:\program files\mIRC
2009-03-12 19:25

d

w g:\documents and settings\Ducky\Application Data\mIRC
2009-03-12 06:39

d

w g:\documents and settings\Ducky\Application Data\uTorrent
2009-03-12 02:26

d

w g:\documents and settings\Ducky\Application Data\Hamachi
2009-03-11 04:44

d

w g:\program files\uTorrent
2009-03-10 14:33 410,984 ----a-w g:\windows\system32\deploytk.dll
2009-03-07 00:02 64,160 ----a-w g:\windows\system32\drivers\Lbd.sys
2009-03-07 00:02 15,688 ----a-w g:\windows\system32\lsdelete.exe
2009-03-01 06:31

d

w g:\program files\Malwarebytes' Anti-Malware
2009-02-26 02:26

d

w g:\program files\Microsoft Silverlight
2009-02-11 18:19 38,496 ----a-w g:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 18:19 15,504 ----a-w g:\windows\system32\drivers\mbam.sys
2009-02-11 04:11

d

w g:\program files\ElcomSoft
2009-02-11 04:04

d

w g:\program files\Passware
2009-02-10 00:23

d

w g:\program files\Project64
2009-02-09 11:13 1,846,784 ----a-w g:\windows\system32\win32k.sys
2009-01-31 08:24

d

w g:\program files\Silkroad
2009-01-31 01:08

d

w g:\documents and settings\Ducky\Application Data\Malwarebytes
2009-01-31 01:08

d

w g:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-30 23:53

dc-h--w g:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-30 23:53

d

w g:\program files\Lavasoft
2009-01-30 23:53

d

w g:\documents and settings\All Users\Application Data\Lavasoft
2009-01-30 00:19 34 ----a-w g:\documents and settings\Ducky\jagex_runescape_preferences.dat
2009-01-24 02:11

d

w g:\documents and settings\Ducky\Application Data\Helios
2009-01-24 02:10

d

w g:\program files\Sun
2009-01-24 02:10

d

w g:\program files\Java
2009-01-24 02:07

d

w g:\program files\TextPad 5
2008-12-20 23:15 826,368 ----a-w g:\windows\system32\wininet.dll
2008-12-12 19:18 87,336 ----a-w g:\windows\system32\dns-sd.exe
2008-12-12 19:11 61,440 ----a-w g:\windows\system32\dnssd.dll
2008-07-04 05:45 22,328 ----a-w g:\documents and settings\Ducky\Application Data\PnkBstrK.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="g:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="g:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1024000]
"SysTrayApp"="g:\program files\IDT\WDM\sttray.exe" [2007-09-14 405504]
"NvCplDaemon"="g:\windows\system32\NvCpl.dll" [2008-06-17 13533184]
"PWRISOVM.EXE"="g:\program files\PowerISO\PWRISOVM.EXE" [2006-05-20 188416]
"NvMediaCenter"="g:\windows\system32\NvMcTray.dll" [2008-06-17 86016]
"Adobe Reader Speed Launcher"="g:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Adobe Version Cue CS2"="g:\program files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe" [2005-04-04 856064]
"Acrobat Assistant 7.0"="g:\program files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"AppleSyncNotifier"="g:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="g:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="g:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Ad-Watch"="g:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-06 515416]
"SunJavaUpdateSched"="g:\program files\Java\jre6\bin\jusched.exe" [2009-03-10 148888]
"nwiz"="nwiz.exe" [2008-06-25 g:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 g:\windows\system32\narrator.exe]

g:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - g:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-09-08 25214]
Adobe Gamma.lnk - g:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
Bluetooth.lnk - g:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-11 576104]
Launchy.lnk - g:\program files\Launchy\Launchy.exe [2008-07-30 286720]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=hcwwew.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\G:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
path=g:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office OneNote 2003 Quick Launch.lnk
backup=g:\windows\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
--a

2007-09-13 14:09 638976 g:\program files\Camera Assistant Software for Gateway\traybar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
--a

2008-07-22 12:34 2772992 g:\program files\Electronic Arts\EADM\Core.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-13 17:12 1695232 g:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"g:\\Program Files\\IEPro\\MiniDM.exe"=
"g:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"g:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"g:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"g:\\WINDOWS\\system32\\PnkBstrA.exe"=
"g:\\WINDOWS\\system32\\PnkBstrB.exe"=
"g:\\Program Files\\Adobe\\Adobe Version Cue CS2\\bin\\VersionCueCS2.exe"=
"g:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=
"g:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"g:\\Program Files\\Starcraft\\StarCraft.exe"=
"g:\\Program Files\\uTorrent\\uTorrent.exe"=
"g:\\Program Files\\Hamachi\\hamachi.exe"=
"g:\\Program Files\\UnrealTournament\\System\\UnrealTournament.exe"=
"g:\\Program Files\\Skype\\Phone\\Skype.exe"=
"g:\\Program Files\\iTunes\\iTunes.exe"=
"g:\\Program Files\\mIRC\\mirc.exe"=
"g:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"g:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"g:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"g:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"g:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=
"g:\\Program Files\\Mozilla Firefox\\firefox.exe"=

R0 Lbd;Lbd;g:\windows\system32\drivers\Lbd.sys [2009-01-30 64160]
R0 Si3531;SiI-3531 SATA Controller;g:\windows\system32\drivers\Si3531.sys [2007-06-01 210736]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]
.
Contents of the 'Scheduled Tasks' folder

2009-03-09 g:\windows\Tasks\Ad-Aware Update (Weekly).job
- g:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-06 17:01]

2009-03-09 g:\windows\Tasks\AppleSoftwareUpdate.job
- g:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{07506236-433B-4F41-9D02-11C16956B9C7} - (no file)

.

Supplementary Scan

.
uInternet Settings,ProxyOverride = *.local
IE: Convert link target to Adobe PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - g:\program files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - g:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - g:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{000002a3-84fe-43f1-b958-f2c3ca804f1a} - {CD275D4E-791A-4993-9D4D-6A071EDD2709} - g:\program files\IEPro\iepro.dll
TCP: {77CA002F-9419-4E98-AB89-066C3CF87168} = 68.94.156.1
TCP: {F966B089-B836-46B0-9225-D0CABC306A30} = 68.94.156.1
FF - ProfilePath - g:\documents and settings\Ducky\Application Data\Mozilla\Firefox\Profiles\h00meeng.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-12 16:10:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

LOCKED REGISTRY KEYS

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\hâ€“â‚¬|Ã¿Ã¿Ã¿Ã¿Â¤â€¢â‚¬|Ã¹â€¢A~*]
"5E7CEC10DF0760D4F8DAFB12FDC06CCD"="02:\\Software\\Adobe\\FeatureSubscriptions\\DVAAdobeDocMeta\\{01CEC7E5-70FD-4D06-8FAD-BF21DF0CC6DC}\\Registered"
.
Completion time: 2009-03-12 16:11:45
ComboFix-quarantined-files.txt 2009-03-12 23:11:43

Pre-Run: 20,066,500,608 bytes free
Post-Run: 20,237,557,760 bytes free

211 --- E O F --- 2009-03-12 02:00:12

Katana · March 2009

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
g:\windows\system32\msexcr.ini
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components]
RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h-?|ËœËœËœËœÃ?|â€”A~*]
ADS::

Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

How are things running now ?

Duckys · March 2009

ComboFix 09-03-10.03 - Ducky 2009-03-13 5:50:39.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2489 [GMT -7:00]
Running from: g:\documents and settings\Ducky\Desktop\Downloads\ComboFix.exe
Command switches used :: g:\documents and settings\Ducky\Desktop\Downloads\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
g:\windows\system32\msexcr.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

g:\windows\system32\msexcr.ini

.
((((((((((((((((((((((((( Files Created from 2009-02-13 to 2009-03-13 )))))))))))))))))))))))))))))))
.

2009-03-11 21:53 . 2009-03-11 21:53 <DIR> d