virus-Need help

violet_aria

i have problems with my laptops.

can anybody please help me?

this is the hijack this log

Logfile of HijackThis v1.99.1
Scan saved at 11:58:30 AM, on 4/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\NAVW32.EXE
c:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
F:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_SG&c=64&bd=presario&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://securityresponse.symantec.com/avcenter/cgi-bin/virauto.cgi?vid=19184
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Katana

Please note that all instructions given are customised for this computer only,
the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

1. Please Read All Instructions Carefully
2. If you don't understand something, stop and ask! Don't keep going on.
3. Please do not run any other tools or scans whilst I am helping you
4. Failure to reply within 5 days will result in the topic being closed.
5. Please continue to respond until I give you the "All Clear"
   (Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

---

Download and Run RSIT

• Please download Random's System Information Tool by random/random from here and save it to your desktop.
• Double click on RSIT.exe to run RSIT.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open:
  
  • log.txt will be opened maximized.
  • info.txt will be opened minimized.
• Please post the contents of both log.txt and info.txt.

violet_aria

info.txt logfile of random's system information tool 1.06 2009-04-12 00:44:47

======Uninstall list======

-->C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
-->C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E47302B-8081-46D3-9FEA-BEB2E5F5C3EC}\Setup.exe" -l0x9 anything
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7 Wonders of the Ancient World-->"C:\Program Files\Oberon Media\7 Wonders of the Ancient World\Uninstall.exe" "C:\Program Files\Oberon Media\7 Wonders of the Ancient World\install.log"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0.5-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70500000002}
Bejeweled 2 Deluxe-->"C:\Program Files\Oberon Media\Bejeweled 2 Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Bejeweled 2 Deluxe\install.log"
BeTrapped!-->"C:\Program Files\Oberon Media\BeTrapped!\Uninstall.exe" "C:\Program Files\Oberon Media\BeTrapped!\install.log"
Bookworm Deluxe-->"C:\Program Files\Oberon Media\Bookworm Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Bookworm Deluxe\install.log"
Bricks of Atlantis-->"C:\Program Files\Oberon Media\Bricks of Atlantis\Uninstall.exe" "C:\Program Files\Oberon Media\Bricks of Atlantis\install.log"
Bricks of Egypt-->"C:\Program Files\Oberon Media\Bricks of Egypt\Uninstall.exe" "C:\Program Files\Oberon Media\Bricks of Egypt\install.log"
Cake Mania-->"C:\Program Files\Oberon Media\Cake Mania\Uninstall.exe" "C:\Program Files\Oberon Media\Cake Mania\install.log"
CC_ccProxyExt-->MsiExec.exe /I{2EBF25F1-F8A2-40EA-92BE-931C142A44E2}
ccCommon-->MsiExec.exe /I{1248C09A-BD6B-47F5-BF3F-CD2B700D9FCB}
ccPxyCore-->MsiExec.exe /I{30738666-9805-4926-A78F-91DA33B6C437}
Chicken Rush-->"C:\Program Files\Oberon Media\Chicken Rush\Uninstall.exe" "C:\Program Files\Oberon Media\Chicken Rush\install.log"
Chuzzle-->"C:\Program Files\Oberon Media\Chuzzle\Uninstall.exe" "C:\Program Files\Oberon Media\Chuzzle\install.log"
Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_HDAUDIO\HXFSETUP.EXE -U -Iwis30B2a.inf
Customer Experience Enhancement-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{23012310-3E05-46A5-88A9-C6CBCABCAC79} /l1033
DivX-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
Easy Internet Sign-up-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{8105684D-8CA6-440D-8F58-7E5FD67A499D} /l1033
ESET Online Scanner-->C:\WINDOWS\system32\OnlineScannerUninstaller.exe
Gem Shop-->"C:\Program Files\Oberon Media\Gem Shop\Uninstall.exe" "C:\Program Files\Oberon Media\Gem Shop\install.log"
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_wis30B2m\HXFSETUP.EXE -U -Iwis30B2m.INF
Hexic-->"C:\Program Files\Oberon Media\Hexic\Uninstall.exe" "C:\Program Files\Oberon Media\Hexic\install.log"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB896256)-->"C:\WINDOWS\$NtUninstallKB896256$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB909095)-->"C:\WINDOWS\$NtUninstallKB909095$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB910728)-->"C:\WINDOWS\$NtUninstallKB910728$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB912436)-->"C:\WINDOWS\$NtUninstallKB912436$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB914906)-->"C:\WINDOWS\$NtUninstallKB914906$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915326)-->"C:\WINDOWS\$NtUninstallKB915326$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB918005)-->"C:\WINDOWS\$NtUninstallKB918005$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
HP DVD Play 2.3-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.exe" -uninstall
HP Help and Support-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}\setup.exe" -l0x9 -removeonly
HP Imaging Device Functions 6.0-->C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Premier Software 6.0-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Quick Launch Buttons 6.10 A2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe" -l0x9 -removeonly uninst
HP Update-->MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
HP User Guides 0027-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{63A3856B-5C0E-4BC1-B508-629AE74B6BBA}\setup.exe" -l0x9 -removeonly
HP Wireless Assistant 2.00 G2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4302B2DD-D958-40E3-BAF3-B07FFE1978CE}\setup.exe" -l0x9 hpquninst
Insaniquarium Deluxe-->"C:\Program Files\Oberon Media\Insaniquarium Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Insaniquarium Deluxe\install.log"
Intel(R) Graphics Media Accelerator Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_27A6 PCI\VEN_8086&DEV_27A2
Intel(R) PRO Network Connections Drivers-->Prounstl.exe
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
Jewel of Atlantis-->"C:\Program Files\Oberon Media\Jewel of Atlantis\Uninstall.exe" "C:\Program Files\Oberon Media\Jewel of Atlantis\install.log"
Jewel Quest-->"C:\Program Files\Oberon Media\Jewel Quest\Uninstall.exe" "C:\Program Files\Oberon Media\Jewel Quest\install.log"
Jigsaw 365-->"C:\Program Files\Oberon Media\Jigsaw 365\Uninstall.exe" "C:\Program Files\Oberon Media\Jigsaw 365\install.log"
LiveUpdate 3.0 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Macromedia Flash Player 8-->MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Macromedia Shockwave Player-->MsiExec.exe /X{838A1BC9-95CA-4880-9BE3-2A7D23600A2B}
Magic Ball 2-->"C:\Program Files\Oberon Media\Magic Ball 2\Uninstall.exe" "C:\Program Files\Oberon Media\Magic Ball 2\install.log"
Magic Match-->"C:\Program Files\Oberon Media\Magic Match\Uninstall.exe" "C:\Program Files\Oberon Media\Magic Match\install.log"
Mahjong Match-->"C:\Program Files\Oberon Media\Mahjong Match\Uninstall.exe" "C:\Program Files\Oberon Media\Mahjong Match\install.log"
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Money-->C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Works-->MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
Mosiac - Tomb of Mystery-->"C:\Program Files\Oberon Media\Mosiac - Tomb of Mystery\Uninstall.exe" "C:\Program Files\Oberon Media\Mosiac - Tomb of Mystery\install.log"
Mozaki Blocks-->"C:\Program Files\Oberon Media\Mozaki Blocks\Uninstall.exe" "C:\Program Files\Oberon Media\Mozaki Blocks\install.log"
MSRedist-->MsiExec.exe /I{B7C61755-DB48-4003-948F-3D34DB8EAF69}
muvee autoProducer 5.0-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB09F05F-85C6-4205-B28D-5BF071D276C3}\setup.exe" -l0x9
Mystery Case Files - Huntsville-->"C:\Program Files\Oberon Media\Mystery Case Files - Huntsville\Uninstall.exe" "C:\Program Files\Oberon Media\Mystery Case Files - Huntsville\install.log"
NetWaiting-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
Norton AntiSpam-->MsiExec.exe /I{5677563D-0CB1-485F-9E18-C5025306BB3F}
Norton AntiVirus 2006-->MsiExec.exe /X{C6F5B6CF-609C-428E-876F-CA83176C021B}
Norton Internet Security 2006 (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{A93C9E60-29B6-49da-BA21-F70AC6AADE20}.exe" /X
Norton Internet Security-->MsiExec.exe /I{12E2B9E9-05B1-407d-B0FD-B5F350535125}
Norton Internet Security-->MsiExec.exe /I{449F3A9E-9903-4a0d-A209-08030D45A935}
Norton Internet Security-->MsiExec.exe /I{48185814-A224-447a-81DA-71BD20580E1B}
Norton Internet Security-->MsiExec.exe /I{A93C9E60-29B6-49da-BA21-F70AC6AADE20}
Norton Internet Security-->MsiExec.exe /I{AADFE0B9-F905-4d5f-A144-0ADB2EFA747B}
Norton Internet Security-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton Internet Security-->MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Norton Internet Security-->MsiExec.exe /I{FFB4DD53-28B7-4981-BFF0-9BD801F61095}
Norton Protection Center-->MsiExec.exe /I{82A5BF38-8461-4A5C-B2C9-24F5256D92A6}
Norton WMI Update-->MsiExec.exe /X{E85FA9A1-C241-4698-893B-DD99509B8DB0}
Norton WMI Update-->MsiExec.exe /X{F64306A5-4C32-41bb-B153-53986527FAB4}
Ocean Express-->"C:\Program Files\Oberon Media\Ocean Express\Uninstall.exe" "C:\Program Files\Oberon Media\Ocean Express\install.log"
Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
Pat Sajak’s Lucky Letters-->"C:\Program Files\Oberon Media\Pat Sajaks Lucky Letters\Uninstall.exe" "C:\Program Files\Oberon Media\Pat Sajaks Lucky Letters\install.log"
Poker Superstars 2-->"C:\Program Files\Oberon Media\Poker Superstars 2\Uninstall.exe" "C:\Program Files\Oberon Media\Poker Superstars 2\install.log"
Rainbow Web-->"C:\Program Files\Oberon Media\Rainbow Web\Uninstall.exe" "C:\Program Files\Oberon Media\Rainbow Web\install.log"
Ricochet Lost Worlds-->"C:\Program Files\Oberon Media\Ricochet Lost Worlds\Uninstall.exe" "C:\Program Files\Oberon Media\Ricochet Lost Worlds\install.log"
Security Update for Step By Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 9 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893066)-->"C:\WINDOWS\$NtUninstallKB893066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896422)-->"C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901190)-->"C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB903235)-->"C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe"
Security Update for Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB912919)-->"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913446)-->"C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Slingo-->"C:\Program Files\Oberon Media\Slingo\Uninstall.exe" "C:\Program Files\Oberon Media\Slingo\install.log"
Sonic Audio Module-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic Copy Module-->MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic Data Module-->MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
SPBBC-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Tiks Texas Hold em-->"C:\Program Files\Oberon Media\Tiks Texas Hold em\Uninstall.exe" "C:\Program Files\Oberon Media\Tiks Texas Hold em\install.log"
Update for Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update for Windows XP (KB896727)-->"C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Connect-->"C:\WINDOWS\$NtUninstallWMCSetup$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Hotfix - KB873333-->C:\WINDOWS\$NtUninstallKB873333$\spuninst\spuninst.exe
Windows XP Hotfix - KB884575-->C:\WINDOWS\$NtUninstallKB884575$\spuninst\spuninst.exe
Windows XP Hotfix - KB885250-->C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
Windows XP Hotfix - KB885464-->C:\WINDOWS\$NtUninstallKB885464$\spuninst\spuninst.exe
Windows XP Hotfix - KB885855-->C:\WINDOWS\$NtUninstallKB885855$\spuninst\spuninst.exe
Windows XP Hotfix - KB885884-->C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP Hotfix - KB888113-->C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
Windows XP Hotfix - KB888239-->C:\WINDOWS\$NtUninstallKB888239$\spuninst\spuninst.exe
Windows XP Hotfix - KB888402-->C:\WINDOWS\$NtUninstallKB888402$\spuninst\spuninst.exe
Windows XP Hotfix - KB889673-->C:\WINDOWS\$NtUninstallKB889673$\spuninst\spuninst.exe
Windows XP Hotfix - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Windows XP Hotfix - KB892559-->"C:\WINDOWS\$NtUninstallKB892559$\spuninst\spuninst.exe"
Wonderland - Secret Worlds-->"C:\Program Files\Oberon Media\Wonderland - Secret Worlds\Uninstall.exe" "C:\Program Files\Oberon Media\Wonderland - Secret Worlds\install.log"
Zuma Deluxe-->"C:\Program Files\Oberon Media\Zuma Deluxe\Uninstall.exe" "C:\Program Files\Oberon Media\Zuma Deluxe\install.log"

======Security center information======

AV: Norton Internet Security 2006
FW: Norton Internet Worm Protection (disabled)
FW: Norton Internet Security 2006

======System event log======

Computer Name: PC454518201285
Event Code: 20
Message: Installation Failure: Windows failed to install the following update with error 0x80070005: Security Update for Windows XP (KB956802).

Record Number: 135
Source Name: Windows Update Agent
Time Written: 20090410033003.000000+480
Event Type: error
User:

Computer Name: PC454518201285
Event Code: 4373
Message: Windows XP KB956802 installation failed.
Access is denied.


Record Number: 134
Source Name: NtServicePack
Time Written: 20090410033002.000000+480
Event Type: error
User: NT AUTHORITY\SYSTEM

Computer Name: PC454518201285
Event Code: 10010
Message: The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register with DCOM within the required timeout.

Record Number: 95
Source Name: DCOM
Time Written: 20090410025753.000000+480
Event Type: error
User: PC454518201285\nurul aria

Computer Name: PC454518201285
Event Code: 7000
Message: The IMAPI CD-Burning COM Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.


Record Number: 76
Source Name: Service Control Manager
Time Written: 20090410000506.000000+480
Event Type: error
User:

Computer Name: PC454518201285
Event Code: 7009
Message: Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

Record Number: 75
Source Name: Service Control Manager
Time Written: 20090410000506.000000+480
Event Type: error
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 8, GenuineIntel
"PROCESSOR_REVISION"=0e08
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=C:\Program Files\Common Files\Sonic Shared\Sonic Central\
"PCTYPE"=PRESARIO
"PLATFORM"=MCD

---

EOF

---

violet_aria

Logfile of random's system information tool 1.06 (written by random/random)
Run by nurul aria at 2009-04-12 00:43:59
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 26 GB (38%) free of 68 GB
Total RAM: 502 MB (20% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:40 AM, on 4/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\nurul aria.PC454518201285.001\Desktop\RSIT.exe
C:\Program Files\trend micro\nurul aria.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_SG&c=64&bd=presario&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://securityresponse.symantec.com/avcenter/cgi-bin/virauto.cgi?vid=19184
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9795 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - nurul aria.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-11 184423]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
CNavExtBho Class - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-05-23 140912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2006-12-15 1191424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{C4069E3A-68F1-403E-B40E-20066696354B} - Norton AntiVirus - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-05-23 140912]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2006-12-15 1191424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"=C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [2006-05-04 458752]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [2005-11-11 36975]
"High Definition Audio Property Page Shortcut"=C:\WINDOWS\system32\CHDAudPropShortcut.exe [2006-06-23 61952]
"ccApp"=c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2005-09-17 52848]
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe [2006-03-23 94208]
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe [2006-03-23 77824]
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe [2006-03-23 118784]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-06-17 794713]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2006-07-11 102400]
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-16 49152]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2006-06-19 163840]
"Cpqset"=C:\Program Files\HPQ\Default Settings\cpqset.exe [2006-01-26 40960]
"RecGuard"=C:\Windows\SMINST\RecGuard.exe [2005-10-11 1187840]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]
"IMEKRMIG6.1"=C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE [2004-08-04 44032]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2004-08-04 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2006-03-23 139264]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2009-04-12 00:44:15 ----D---- C:\Program Files\trend micro
2009-04-12 00:43:59 ----D---- C:\rsit
2009-04-11 22:04:20 ----D---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\AdobeUM
2009-04-11 18:07:23 ----D---- C:\Program Files\Panda Security
2009-04-11 18:07:21 ----D---- C:\WINDOWS\LastGood
2009-04-11 12:04:49 ----D---- C:\Program Files\EsetOnlineScanner
2009-04-10 09:46:22 ----D---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\Adobe
2009-04-10 08:23:07 ----A---- C:\WINDOWS\system32\msonpmon.dll
2009-04-10 08:02:45 ----D---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\Mozilla
2009-04-10 03:29:15 ----N---- C:\WINDOWS\system32\tzchange.exe
2009-04-10 03:22:20 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-04-10 03:08:32 ----A---- C:\WINDOWS\system32\SET14D4.tmp
2009-04-10 03:07:41 ----A---- C:\WINDOWS\system32\SET14B1.tmp
2009-04-10 03:07:40 ----A---- C:\WINDOWS\system32\SET14B3.tmp
2009-04-10 03:07:40 ----A---- C:\WINDOWS\system32\SET14B2.tmp
2009-04-10 03:07:19 ----A---- C:\WINDOWS\system32\SET1495.tmp
2009-04-10 03:07:12 ----A---- C:\WINDOWS\system32\SET1482.tmp
2009-04-10 03:07:01 ----A---- C:\WINDOWS\system32\SET146F.tmp
2009-04-10 03:03:28 ----D---- C:\WINDOWS\system32\PreInstall
2009-04-10 00:06:59 ----A---- C:\WINDOWS\system32\SET1500.tmp
2009-04-09 23:23:04 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-04-09 22:29:59 ----ASH---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\desktop.ini
2009-04-09 22:29:56 ----SD---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\Microsoft
2009-04-09 22:29:56 ----D---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\Symantec
2009-04-09 22:29:56 ----D---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\Macromedia
2009-04-09 22:29:56 ----D---- C:\Documents and Settings\nurul aria.PC454518201285.001\Application Data\Identities
2009-04-09 22:21:30 ----A---- C:\WINDOWS\system32\uniime.dll
2009-04-09 22:21:26 ----A---- C:\WINDOWS\system32\Thawbrkr.dll
2009-04-09 22:21:26 ----A---- C:\WINDOWS\system32\imjp81k.dll
2009-04-09 22:21:25 ----A---- C:\WINDOWS\system32\kbdusa.dll
2009-04-09 22:21:25 ----A---- C:\WINDOWS\system32\ftlx041e.dll
2009-04-09 22:21:25 ----A---- C:\WINDOWS\system32\c_iscii.dll
2009-04-09 22:21:24 ----A---- C:\WINDOWS\system32\korwbrkr.dll
2009-04-09 22:21:24 ----A---- C:\WINDOWS\system32\chtbrkr.dll
2009-04-09 22:21:24 ----A---- C:\WINDOWS\system32\chsbrkr.dll
2009-04-09 22:21:23 ----A---- C:\WINDOWS\system32\msir3jp.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdnecNT.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdnecAT.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdnec95.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdlk41j.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdlk41a.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdkor.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdjpn.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdibm02.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbdax2.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbd106n.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbd106.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbd103.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbd101c.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbd101a.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\kbd101.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\f3ahvoas.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\c_is2022.dll
2009-04-09 22:21:21 ----A---- C:\WINDOWS\system32\c_g18030.dll
2009-04-09 22:21:18 ----A---- C:\WINDOWS\system32\kbd101b.dll
2009-04-07 03:30:20 ----D---- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2009-04-03 22:04:03 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-04-03 22:04:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-04-01 21:21:31 ----D---- C:\Documents and Settings\All Users\Application Data\ESET
2009-03-31 09:16:18 ----D---- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
2009-03-31 09:13:38 ----D---- C:\Program Files\Common Files\SPSS
2009-03-31 09:13:38 ----D---- C:\Documents and Settings\All Users\Application Data\SPSS
2009-03-31 09:13:37 ----D---- C:\Program Files\SPSSInc
2009-03-29 10:09:07 ----D---- C:\Program Files\Audacity
2009-03-24 21:24:58 ----D---- C:\Program Files\PS
2009-03-24 21:23:55 ----N---- C:\WINDOWS\Setup1.exe
2009-03-24 21:20:26 ----A---- C:\WINDOWS\ST6UNST.EXE
2009-03-20 17:28:56 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-03-19 19:07:35 ----A---- C:\WINDOWS\ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt
2009-03-18 08:52:26 ----HDC---- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-03-18 08:52:03 ----D---- C:\Program Files\Lavasoft
2009-03-16 21:23:16 ----A---- C:\WINDOWS\bdagent.INI
2009-03-16 20:53:21 ----D---- C:\Program Files\AskBarDis
2009-03-16 20:37:08 ----D---- C:\Binaries
2009-03-16 20:36:02 ----D---- C:\Program Files\BitDefender
2009-03-16 20:36:02 ----D---- C:\Documents and Settings\All Users\Application Data\BitDefender
2009-03-16 20:33:16 ----D---- C:\Program Files\Common Files\BitDefender

======List of files/folders modified in the last 1 months======

2009-04-12 00:44:34 ----D---- C:\WINDOWS\Prefetch
2009-04-12 00:44:21 ----D---- C:\Program Files\Common Files\Symantec Shared
2009-04-12 00:44:15 ----RD---- C:\Program Files
2009-04-12 00:36:09 ----D---- C:\WINDOWS\Temp
2009-04-11 22:36:56 ----D---- C:\WINDOWS
2009-04-11 18:11:55 ----D---- C:\WINDOWS\system32\drivers
2009-04-11 18:07:23 ----HD---- C:\WINDOWS\inf
2009-04-11 18:06:01 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-04-11 18:05:59 ----D---- C:\WINDOWS\system32\CatRoot2
2009-04-11 17:15:25 ----D---- C:\Program Files\Mozilla Firefox
2009-04-11 17:13:48 ----A---- C:\hpqp.ini
2009-04-11 17:13:40 ----A---- C:\XP_TV.ini
2009-04-11 15:11:41 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-04-11 12:46:06 ----D---- C:\WINDOWS\system32
2009-04-11 11:56:47 ----RSHD---- C:\WINDOWS\system32\dllcache
2009-04-11 09:50:38 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-04-11 09:50:34 ----SHD---- C:\WINDOWS\Installer
2009-04-11 09:49:05 ----SHD---- C:\Config.Msi
2009-04-11 09:48:57 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-04-11 09:47:55 ----A---- C:\WINDOWS\imsins.BAK
2009-04-11 09:46:23 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-04-11 09:44:12 ----D---- C:\Program Files\Messenger
2009-04-11 09:43:50 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-04-11 09:40:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-04-11 09:39:05 ----HDC---- C:\WINDOWS\$NtUninstallKB923723$
2009-04-11 09:37:57 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-04-11 09:37:01 ----D---- C:\Program Files\Internet Explorer
2009-04-11 09:36:45 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2009-04-11 09:36:43 ----D---- C:\WINDOWS\system32\CatRoot
2009-04-11 09:35:00 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-04-11 09:33:38 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-04-11 09:32:24 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-04-11 09:30:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$
2009-04-10 13:10:56 ----RD---- C:\WINDOWS\Web
2009-04-10 13:10:55 ----D---- C:\WINDOWS\twain_32
2009-04-10 13:10:46 ----D---- C:\WINDOWS\system32\wbem
2009-04-10 13:10:40 ----D---- C:\WINDOWS\system32\usmt
2009-04-10 13:10:40 ----D---- C:\WINDOWS\system32\URTTemp
2009-04-10 13:10:36 ----D---- C:\WINDOWS\system32\spool
2009-04-10 13:10:34 ----D---- C:\WINDOWS\system32\Setup
2009-04-10 13:10:32 ----D---- C:\WINDOWS\system32\Restore
2009-04-10 13:10:32 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-04-10 13:10:24 ----D---- C:\WINDOWS\system32\ras
2009-04-10 13:10:14 ----D---- C:\WINDOWS\system32\npp
2009-04-10 13:10:12 ----D---- C:\WINDOWS\system32\mui
2009-04-10 13:10:06 ----D---- C:\WINDOWS\system32\MsDtc
2009-04-10 13:10:04 ----SD---- C:\WINDOWS\system32\Microsoft
2009-04-10 13:10:03 ----D---- C:\WINDOWS\system32\Macromed
2009-04-10 13:09:51 ----D---- C:\WINDOWS\system32\IME
2009-04-10 13:09:49 ----D---- C:\WINDOWS\system32\icsxml
2009-04-10 13:09:49 ----D---- C:\WINDOWS\system32\ias
2009-04-10 13:09:42 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-04-10 13:09:25 ----D---- C:\WINDOWS\system32\DirectX
2009-04-10 13:09:14 ----D---- C:\WINDOWS\system32\Com
2009-04-10 13:09:08 ----D---- C:\WINDOWS\system32\1033
2009-04-10 13:09:08 ----D---- C:\WINDOWS\system
2009-04-10 13:09:08 ----D---- C:\WINDOWS\srchasst
2009-04-10 13:09:06 ----D---- C:\WINDOWS\SMINST
2009-04-10 13:09:02 ----D---- C:\WINDOWS\repair
2009-04-10 13:08:46 ----D---- C:\WINDOWS\PeerNet
2009-04-10 13:08:06 ----RD---- C:\WINDOWS\Offline Web Pages
2009-04-10 13:08:06 ----D---- C:\WINDOWS\msagent
2009-04-10 13:07:56 ----D---- C:\WINDOWS\Media
2009-04-10 13:07:13 ----D---- C:\WINDOWS\ime
2009-04-10 13:06:26 ----D---- C:\WINDOWS\Debug
2009-04-10 13:06:26 ----D---- C:\WINDOWS\Cursors
2009-04-10 13:06:24 ----D---- C:\WINDOWS\CREATOR
2009-04-10 13:06:09 ----RSD---- C:\WINDOWS\assembly
2009-04-10 13:06:09 ----D---- C:\WINDOWS\AppPatch
2009-04-10 13:06:06 ----HDC---- C:\WINDOWS\$NtUninstallKB918005$
2009-04-10 13:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB915326$
2009-04-10 13:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB914906$
2009-04-10 13:06:05 ----HDC---- C:\WINDOWS\$NtUninstallKB913580$
2009-04-10 13:06:04 ----HDC---- C:\WINDOWS\$NtUninstallKB912436$
2009-04-10 13:06:04 ----HD---- C:\WINDOWS\$NtUninstallKB913446$
2009-04-10 13:06:04 ----HD---- C:\WINDOWS\$NtUninstallKB912919$
2009-04-10 13:06:04 ----HD---- C:\WINDOWS\$NtUninstallKB911927$
2009-04-10 13:06:03 ----HD---- C:\WINDOWS\$NtUninstallKB911565$
2009-04-10 13:06:03 ----HD---- C:\WINDOWS\$NtUninstallKB911564$
2009-04-10 13:06:03 ----HD---- C:\WINDOWS\$NtUninstallKB910728$
2009-04-10 13:06:02 ----HDC---- C:\WINDOWS\$NtUninstallKB909095$
2009-04-10 13:06:00 ----HD---- C:\WINDOWS\$NtUninstallKB908519$
2009-04-10 13:05:59 ----HD---- C:\WINDOWS\$NtUninstallKB904706$
2009-04-10 13:05:59 ----HD---- C:\WINDOWS\$NtUninstallKB903235$
2009-04-10 13:05:59 ----HD---- C:\WINDOWS\$NtUninstallKB901214$
2009-04-10 13:05:59 ----HD---- C:\WINDOWS\$NtUninstallKB896727$
2009-04-10 13:05:58 ----HD---- C:\WINDOWS\$NtUninstallKB896423$
2009-04-10 13:05:58 ----HD---- C:\WINDOWS\$NtUninstallKB896422$
2009-04-10 13:05:58 ----HD---- C:\WINDOWS\$NtUninstallKB896358$
2009-04-10 13:05:57 ----HDC---- C:\WINDOWS\$NtUninstallKB896256$
2009-04-10 13:05:57 ----HD---- C:\WINDOWS\$NtUninstallKB894391$
2009-04-10 13:05:56 ----HDC---- C:\WINDOWS\$NtUninstallKB892559$
2009-04-10 13:05:56 ----HD---- C:\WINDOWS\$NtUninstallKB893066$
2009-04-10 13:05:56 ----HD---- C:\WINDOWS\$NtUninstallKB891781$
2009-04-10 13:05:55 ----HDC---- C:\WINDOWS\$NtUninstallKB888402$
2009-04-10 13:05:55 ----HDC---- C:\WINDOWS\$NtUninstallKB888239$
2009-04-10 13:05:55 ----HD---- C:\WINDOWS\$NtUninstallKB888113$
2009-04-10 13:05:54 ----HDC---- C:\WINDOWS\$NtUninstallKB885464$
2009-04-10 13:05:54 ----HDC---- C:\WINDOWS\$NtUninstallKB884575$
2009-04-10 13:05:54 ----HD---- C:\WINDOWS\$NtUninstallKB887472$
2009-04-10 13:05:54 ----HD---- C:\WINDOWS\$NtUninstallKB886185$
2009-04-10 13:05:54 ----HD---- C:\WINDOWS\$NtUninstallKB885250$
2009-04-10 13:05:53 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-04-10 13:05:53 ----HD---- C:\WINDOWS\$NtUninstallKB873333$
2009-04-10 12:57:49 ----D---- C:\Program Files\Windows NT
2009-04-10 12:57:48 ----D---- C:\Program Files\Windows Media Player
2009-04-10 12:57:47 ----D---- C:\Program Files\Windows Media Connect 2
2009-04-10 12:56:51 ----D---- C:\Program Files\Outlook Express
2009-04-10 12:56:48 ----D---- C:\Program Files\Online Services
2009-04-10 12:56:04 ----D---- C:\Program Files\Oberon Media
2009-04-10 12:53:56 ----D---- C:\Program Files\NetWaiting
2009-04-10 12:53:54 ----D---- C:\Program Files\NetMeeting
2009-04-10 12:53:33 ----D---- C:\Program Files\Movie Maker
2009-04-10 12:52:49 ----D---- C:\Program Files\Microsoft Money 2005
2009-04-10 12:50:41 ----D---- C:\Program Files\Google
2009-04-10 12:50:41 ----D---- C:\Program Files\DivX
2009-04-10 12:50:41 ----D---- C:\Program Files\CONEXANT
2009-04-10 12:50:40 ----D---- C:\Program Files\Common Files\System
2009-04-10 12:50:11 ----D---- C:\Program Files\Common Files\SureThing Shared
2009-04-10 12:50:11 ----D---- C:\Program Files\Common Files\Sonic Shared
2009-04-10 12:50:06 ----D---- C:\Program Files\Common Files\Services
2009-04-10 12:50:06 ----D---- C:\Program Files\Common Files\Oberon Media
2009-04-10 12:49:35 ----D---- C:\Program Files\Common Files\LightScribe
2009-04-10 12:48:35 ----D---- C:\I386
2009-04-10 12:46:28 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2009-04-10 12:46:24 ----D---- C:\Documents and Settings\All Users\Application Data\Sonic
2009-04-10 11:48:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-04-10 08:22:43 ----D---- C:\WINDOWS\system32\config
2009-04-10 08:21:17 ----D---- C:\Program Files\Microsoft Works
2009-04-10 08:21:08 ----D---- C:\WINDOWS\WinSxS
2009-04-10 08:19:52 ----RSD---- C:\WINDOWS\Fonts
2009-04-10 08:14:46 ----A---- C:\WINDOWS\win.ini
2009-04-10 03:34:47 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-04-10 03:34:22 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-04-10 03:34:17 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-04-10 03:33:54 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-04-10 03:33:43 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-04-10 03:33:30 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-04-10 03:33:21 ----HDC---- C:\WINDOWS\$NtUninstallKB923689$
2009-04-10 03:32:49 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-04-10 03:32:34 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-04-10 03:32:14 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-04-10 03:31:48 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-04-10 03:31:35 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-04-10 03:31:21 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-04-10 03:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-04-10 03:30:38 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-04-10 03:30:25 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-04-10 03:30:14 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-04-10 03:30:00 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-04-10 03:29:50 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-04-10 03:29:16 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP10$
2009-04-10 03:03:03 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-04-10 00:04:23 ----SD---- C:\WINDOWS\Tasks
2009-04-10 00:03:02 ----D---- C:\Program Files\Norton Internet Security
2009-04-09 23:36:47 ----D---- C:\Program Files\Symantec
2009-04-09 23:36:36 ----D---- C:\Program Files\Common Files
2009-04-09 23:23:19 ----D---- C:\WINDOWS\SoftwareDistribution
2009-04-09 23:23:18 ----D---- C:\WINDOWS\Help
2009-04-09 22:37:31 ----D---- C:\WINDOWS\security
2009-04-09 22:34:27 ----HD---- C:\system.sav
2009-04-09 22:34:27 ----D---- C:\SWSetup
2009-04-09 22:31:45 ----A---- C:\WINDOWS\OEWABLog.txt
2009-04-09 22:31:36 ----D---- C:\hp
2009-04-09 22:29:54 ----D---- C:\Documents and Settings
2009-04-09 22:28:25 ----A---- C:\WINDOWS\setuplog.txt
2009-04-09 22:28:22 ----SHD---- C:\System Volume Information
2009-04-09 22:28:05 ----D---- C:\WINDOWS\system32\oobe
2009-04-09 22:28:00 ----RASH---- C:\boot.ini
2009-04-09 22:27:03 ----D---- C:\WINDOWS\Registration
2009-04-09 22:21:34 ----A---- C:\WINDOWS\system.ini
2009-04-09 22:20:29 ----D---- C:\Program Files\HPQ
2009-04-05 08:23:25 ----SHD---- C:\RECYCLER
2009-04-04 20:38:57 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2009-04-01 21:21:31 ----D---- C:\Program Files\ESET
2009-03-22 08:25:58 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-03-18 09:41:13 ----D---- C:\Program Files\Apple Software Update

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eabfiltr;eabfiltr; C:\WINDOWS\system32\DRIVERS\eabfiltr.sys [2005-09-19 7808]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-28 36096]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R1 SAVRTPEL;SAVRTPEL; \??\c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-01 189320]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-04 8832]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2006-02-15 12672]
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-05 60800]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-04-29 429184]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-11-03 157696]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 HBtnKey;HBtnKey; C:\WINDOWS\system32\DRIVERS\cpqbttn.sys [2005-09-19 9344]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDAud.sys [2006-06-23 581120]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-08-23 1035008]
R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys [2005-08-23 201600]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2006-03-23 1166972]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090410.003\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20090410.003\NavEx15.Sys []
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-05 61824]
R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840]
R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-11-01 308992]
R3 SAVRT;SAVRT; \??\c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-05 67584]
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-01 12680]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-01 98184]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-01 31624]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\idsdefs\20090404.001\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-01 28040]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-01 23944]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-06-17 193120]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2006-04-19 30080]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-05 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2006-04-19 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-08-23 718464]
S3 eabusb;eabusb; C:\WINDOWS\system32\DRIVERS\eabusb.sys [2005-09-19 5760]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2004-08-04 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2004-08-04 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2004-08-04 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2004-08-04 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2004-08-04 41088]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2004-08-04 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-07-25 100032]
R2 ccEvtMgr;Symantec Event Manager; c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2005-09-17 192112]
R2 ccProxy;Symantec Network Proxy; c:\Program Files\Common Files\Symantec Shared\ccProxy.exe [2005-09-17 202352]
R2 ccSetMgr;Symantec Settings Manager; c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2005-09-17 169584]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-05-18 49152]
R2 navapsvc;Norton AntiVirus Auto-Protect Service; c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe [2007-05-23 139888]
R2 SNDSrvc;Symantec Network Drivers Service; c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2007-10-01 214408]
R2 SPBBCSvc;Symantec SPBBCSvc; c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2005-09-16 1160800]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe [2009-04-09 1251720]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R3 NSCService;Norton Protection Center Service; c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE [2006-12-15 750720]
S3 AddFiltr;AddFiltr; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe [2006-06-12 126976]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-16 32768]
S3 ccISPwdSvc;Symantec Internet Security Password Validation; c:\Program Files\Norton Internet Security\ccPwdSvc.exe [2007-01-16 72328]
S3 comHost;COM Host; c:\Program Files\Norton Internet Security\comHost.exe [2007-01-16 45696]
S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-07-25 2119360]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SAVScan;Symantec AVScan; c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe [2005-08-27 198368]
S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

---

EOF

---

Katana

There is nothing dramatic showing there, what sort of problems are you having ?

violet_aria

i think my laptop still infected by viruses. because the documents in my laptop were recovered even though i had formatted it. for your information, i use original window and to do formatting, i had been taught to press F11.

Katana

violet_aria wrote:

i had been taught to press F11.

That sounds like a recovery partition, and you may have performed a Repair install rather than a reformat.



Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan << LINK

• Click the Scan Now button
• Follow the prompts to install the Active X if necessary
• Go and make a cup of tea/coffee/beverage of your choice and watch some TV
• When the scan is finished, a report will be generated
• Next to Scan Details click the small export to notepad button and save the report to your desktop.
• Please post the report in your reply.

violet_aria

Katana wrote:

That sounds like a recovery partition, and you may have performed a Repair install rather than a reformat.



Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan << LINK

• Click the Scan Now button
• Follow the prompts to install the Active X if necessary
• Go and make a cup of tea/coffee/beverage of your choice and watch some TV
• When the scan is finished, a report will be generated
• Next to Scan Details click the small export to notepad button and save the report to your desktop.
• Please post the report in your reply.

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-04-14 11:24:57
PROTECTIONS: 1
MALWARE: 12
SUSPECTS: 2
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Norton Internet Security 2006 2006 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\nurul aria.PC454518201285.001\Cookies\nurul [email]aria@atdmt[1].txt[/email]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\syikin\Cookies\syikin@com[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\syikin\Cookies\syikin@xiti[1].txt
00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\syikin\Cookies\syikin@azjmp[2].txt
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\nurul aria.PC454518201285.001\Cookies\nurul [email]aria@ad.yieldmanager[1].txt[/email]
00168059 Cookie/Mp3s Hits TrackingCookie No 0 Yes No C:\Documents and Settings\syikin\Cookies\syikin@www.mp3shits[1].txt
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\nurul aria.PC454518201285.001\Cookies\nurul [email]aria@apmebf[1].txt[/email]
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\nurul aria.PC454518201285.001\Cookies\nurul [email]aria@serving-sys[2].txt[/email]
00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\nurul aria.PC454518201285.001\Cookies\nurul [email]aria@bs.serving-sys[1].txt[/email]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\syikin\Cookies\syikin@atwola[1].txt
00447834 Adware/Lop Adware No 0 Yes No C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\07540CF5.dll
00447834 Adware/Lop Adware No 0 Yes No C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5107766C.scr
05347863 Trj/Lineage.BZE Virus/Trojan No 1 Yes No D:\System Volume Information\_restore{1368902D-6A36-4B35-812D-DDC763090AC0}\RP8\A0005514.CMD
;===================================================================================================================================================================================
SUSPECTS
Sent Location ]
;===================================================================================================================================================================================
No C:\Program Files\Oberon Media\Bricks of Atlantis\BricksOfAtlantis.exe ]
No C:\Program Files\Oberon Media\Hexic\Hexic.exe ]
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description ]
;===================================================================================================================================================================================
184380 MEDIUM MS08-002 ]
184379 MEDIUM MS08-001 ]
182048 HIGH MS07-069 ]
182046 HIGH MS07-067 ]
182043 HIGH MS07-064 ]
179553 HIGH MS07-061 ]
176382 HIGH MS07-057 ]
176383 HIGH MS07-058 ]
170911 HIGH MS07-050 ]
170907 HIGH MS07-046 ]
170906 HIGH MS07-045 ]
170904 HIGH MS07-043 ]
164915 HIGH MS07-035 ]
164913 HIGH MS07-033 ]
164911 HIGH MS07-031 ]
160623 HIGH MS07-027 ]
157262 HIGH MS07-022 ]
157261 HIGH MS07-021 ]
157260 HIGH MS07-020 ]
157259 HIGH MS07-019 ]
156477 HIGH MS07-017 ]
150253 HIGH MS07-016 ]
150249 HIGH MS07-013 ]
150248 HIGH MS07-012 ]
150247 HIGH MS07-011 ]
150243 HIGH MS07-008 ]
150242 HIGH MS07-007 ]
150241 MEDIUM MS07-006 ]
141034 HIGH MS06-076 ]
141033 MEDIUM MS06-075 ]
141030 HIGH MS06-072 ]
137571 HIGH MS06-070 ]
137568 HIGH MS06-067 ]
133387 MEDIUM MS06-065 ]
133386 MEDIUM MS06-064 ]
133385 MEDIUM MS06-063 ]
133379 HIGH MS06-057 ]
131654 HIGH MS06-055 ]
129977 MEDIUM MS06-053 ]
129976 MEDIUM MS06-052 ]
126093 HIGH MS06-051 ]
126092 MEDIUM MS06-050 ]
126087 HIGH MS06-046 ]
126086 MEDIUM MS06-045 ]
126083 HIGH MS06-042 ]
126082 HIGH MS06-041 ]
126081 HIGH MS06-040 ]
123421 HIGH MS06-036 ]
123420 HIGH MS06-035 ]
120825 MEDIUM MS06-032 ]
120823 MEDIUM MS06-030 ]
120818 HIGH MS06-025 ]
120815 HIGH MS06-022 ]
120814 HIGH MS06-021 ]
114666 HIGH MS06-015 ]
114664 HIGH MS06-013 ]
96574 HIGH MS05-053 ]
93454 MEDIUM MS05-049 ]
;===================================================================================================================================================================================

Katana

There is no visible infection, let's check for hidden infections



Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

• You must download it to and run it from your Desktop
  
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  
• Double click combofix.exe & follow the prompts.
  
• When finished, it will produce a log. Please save that log to post in your next reply
  
• Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

violet_aria

Katana wrote:

There is no visible infection, let's check for hidden infections



Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

• You must download it to and run it from your Desktop
• Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
• Double click combofix.exe & follow the prompts.
• When finished, it will produce a log. Please save that log to post in your next reply
• Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

ComboFix 09-04-14.09 - nurul aria 04/14/2009 23:42.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.502.139 [GMT 8:00]
Running from: c:\documents and settings\nurul aria.PC454518201285.001\Desktop\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning enabled* (Updated)
FW: Norton Internet Security 2006 *disabled*
FW: Norton Internet Worm Protection *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\heap41a
c:\heap41a\drivelist.txt
c:\heap41a\Icon.ico
c:\heap41a\std.txt
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013
c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini
c:\windows\system32\_000037_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-14 15:37 . 2006-03-02 15:42 73728 ----a-w C:\pv.exe
2009-04-13 23:29 . 2009-04-13 23:29

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.001\Local Settings\Application Data\Yahoo
2009-04-12 10:30 . 2009-04-12 10:30

---

d

---

w c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-11 16:43 . 2009-04-11 16:44

---

d

---

w C:\rsit
2009-04-11 14:04 . 2009-04-11 14:04

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.001\Application Data\AdobeUM
2009-04-11 10:07 . 2008-06-19 08:24 28544 ----a-w c:\windows\system32\drivers\pavboot.sys
2009-04-11 03:56 . 2004-08-03 15:08 26496 ----a-w c:\windows\system32\dllcache\usbstor.sys
2009-04-10 03:25 . 2001-08-17 05:48 12160 ----a-w c:\windows\system32\drivers\mouhid.sys
2009-04-10 03:25 . 2001-08-17 05:48 12160 ----a-w c:\windows\system32\dllcache\mouhid.sys
2009-04-10 03:24 . 2001-08-17 06:02 9600 ----a-w c:\windows\system32\drivers\hidusb.sys
2009-04-10 03:24 . 2001-08-17 06:02 9600 ----a-w c:\windows\system32\dllcache\hidusb.sys
2009-04-10 01:46 . 2009-04-10 01:46

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.001\Local Settings\Application Data\Adobe
2009-04-10 00:23 . 2006-10-26 11:56 32592 ----a-w c:\windows\system32\msonpmon.dll
2009-04-10 00:13 . 2009-04-10 00:13

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.001\Local Settings\Application Data\Microsoft Help
2009-04-10 00:02 . 2009-04-10 00:02

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.001\Local Settings\Application Data\Mozilla
2009-04-09 19:28 . 2008-05-07 05:18 1287680

---

w c:\windows\system32\dllcache\quartz.dll
2009-04-09 19:28 . 2008-12-05 07:12 144896

---

w c:\windows\system32\dllcache\schannel.dll
2009-04-09 19:28 . 2008-08-14 09:57 2185984

---

w c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-09 19:28 . 2008-08-14 09:18 2020864

---

w c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-09 19:28 . 2008-08-14 09:55 2142720

---

w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-09 19:28 . 2008-08-14 09:18 2062976

---

w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-04-09 19:28 . 2008-12-12 17:33 3060224

---

w c:\windows\system32\dllcache\mshtml.dll
2009-04-09 19:22 . 2009-04-09 19:28

---

d

---

w c:\windows\system32\CatRoot_bak
2009-04-09 19:11 . 2008-05-08 12:28 202752

---

w c:\windows\system32\dllcache\rmcast.sys
2009-04-09 19:10 . 2008-10-24 11:10 453632

---

w c:\windows\system32\dllcache\mrxsmb.sys
2009-04-09 19:09 . 2008-12-11 11:57 333184

---

w c:\windows\system32\dllcache\srv.sys
2009-04-09 19:09 . 2008-05-01 14:30 331776

---

w c:\windows\system32\dllcache\msadce.dll
2009-04-09 19:08 . 2008-07-03 13:16 8454656 ----a-w c:\windows\system32\SET14D4.tmp
2009-04-09 19:08 . 2008-07-03 13:16 8454656

---

w c:\windows\system32\dllcache\shell32.dll
2009-04-09 19:08 . 2008-04-11 18:50 683520

---

w c:\windows\system32\dllcache\inetcomm.dll
2009-04-09 19:08 . 2009-02-09 10:19 1846272

---

w c:\windows\system32\dllcache\win32k.sys
2009-04-09 19:06 . 2007-12-18 14:40 417792

---

w c:\windows\system32\dllcache\vbscript.dll
2009-04-09 19:06 . 2007-12-18 14:40 450560

---

w c:\windows\system32\dllcache\jscript.dll
2009-04-09 16:07 . 2008-06-13 13:10 272128

---

w c:\windows\system32\drivers\bthport.sys
2009-04-09 16:07 . 2008-06-13 13:10 272128

---

w c:\windows\system32\dllcache\bthport.sys
2009-04-09 16:06 . 2008-07-07 20:32 253952 ----a-w c:\windows\system32\SET1500.tmp
2009-04-09 16:06 . 2008-07-07 20:32 253952

---

w c:\windows\system32\dllcache\es.dll
2009-04-09 14:31 . 2009-04-11 23:57

---

d-s---w c:\documents and settings\nurul aria.PC454518201285.001\Temporary Internet Files
2009-04-09 14:31 . 2009-04-09 14:31

---

d-s---w c:\documents and settings\nurul aria.PC454518201285.001\History
2009-04-09 14:21 . 2004-08-04 13:00 21504 ----a-w c:\windows\system32\CINTLGNT.IME
2009-04-06 17:37 . 2009-04-06 17:37

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Application Data\AdobeUM
2009-04-06 13:05 . 2009-04-06 13:05

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\.spss
2009-04-06 12:53 . 2009-04-06 12:53 0 ----a-w C:\law.sp
2009-04-05 15:18 . 2009-04-05 15:18

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Application Data\CyberLink
2009-04-05 15:18 . 2009-04-05 15:18

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Local Settings\Application Data\QuickPlay
2009-04-05 15:18 . 2009-04-05 15:18

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Application Data\HP
2009-04-05 09:36 . 2009-04-05 09:36

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Local Settings\Application Data\Adobe
2009-04-04 23:31 . 2009-04-04 23:31

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Local Settings\Application Data\Microsoft Help
2009-04-04 18:52 . 2009-04-04 18:52

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.000\Local Settings\Application Data\Mozilla
2009-04-04 13:48 . 2009-04-04 23:46

---

d-s---w c:\documents and settings\nurul aria.PC454518201285.000\Temporary Internet Files
2009-04-04 13:48 . 2009-04-04 13:48

---

d-s---w c:\documents and settings\nurul aria.PC454518201285.000\History
2009-04-03 14:04 . 2009-04-03 14:04

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Application Data\Malwarebytes
2009-04-03 14:04 . 2009-04-03 14:04

---

d

---

w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-01 13:21 . 2009-04-01 13:21

---

d

---

w c:\documents and settings\All Users\Application Data\ESET
2009-03-31 01:16 . 2009-03-31 01:16

---

d

---

w c:\documents and settings\All Users\Application Data\SafeNet Sentinel
2009-03-31 01:13 . 2009-03-31 01:13

---

d

---

w c:\documents and settings\All Users\Application Data\SPSS
2009-03-28 06:29 . 2009-03-29 01:12

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Application Data\Audacity
2009-03-24 13:27 . 2009-03-24 13:27

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Application Data\AdobeUM
2009-03-24 13:23 . 2009-03-24 13:23 249856

---

w c:\windows\Setup1.exe
2009-03-24 13:23 . 2009-03-24 13:25 503 ----a-w c:\windows\ST6UNST.001
2009-03-24 13:20 . 2009-03-24 13:23 73216 ----a-w c:\windows\ST6UNST.EXE
2009-03-24 13:20 . 2009-03-24 13:20 256 ----a-w c:\windows\ST6UNST.000
2009-03-22 01:07 . 2009-03-22 01:07

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Local Settings\Application Data\Microsoft Help
2009-03-22 00:28 . 2009-03-22 00:28

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Local Settings\Application Data\Yahoo
2009-03-22 00:25 . 2009-03-22 00:25

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Application Data\Yahoo!
2009-03-20 09:25 . 2008-08-14 09:51 138368 ----a-w c:\windows\system32\drivers\afd.sys
2009-03-20 07:11 . 2009-03-20 07:12

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Local Settings\Application Data\Adobe
2009-03-20 06:21 . 2009-03-28 12:37

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Application Data\Winamp
2009-03-19 11:19 . 2009-03-19 11:19

---

d

---

w c:\documents and settings\nurul aria.PC454518201285\Local Settings\Application Data\Mozilla
2009-03-19 11:11 . 2009-03-22 01:35

---

d-s---w c:\documents and settings\nurul aria.PC454518201285\Temporary Internet Files
2009-03-19 11:11 . 2009-03-19 11:11

---

d-s---w c:\documents and settings\nurul aria.PC454518201285\History
2009-03-18 00:52 . 2009-03-18 00:52

---

dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-03-16 13:23 . 2009-03-19 09:42 121 ----a-w c:\windows\bdagent.INI
2009-03-16 12:37 . 2009-03-16 12:37

---

d

---

w c:\documents and settings\nurul aria\Application Data\BitDefender
2009-03-16 12:37 . 2009-03-16 12:37

---

d

---

w C:\Binaries
2009-03-16 12:36 . 2009-03-16 12:43

---

d

---

w c:\documents and settings\All Users\Application Data\BitDefender

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 14:53 . 2006-12-15 14:21 313 ----a-w C:\hpqp.ini
2009-04-14 14:52 . 2006-12-15 14:21 40 ----a-w C:\XP_TV.ini
2009-04-14 05:48 . 2009-04-09 14:29 109248 ----a-w c:\documents and settings\nurul aria.PC454518201285.001\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-14 05:23 . 2007-08-26 10:26

---

d

---

w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-04-13 23:30 . 2006-12-15 14:00

---

d

---

w c:\program files\Common Files\Symantec Shared
2009-04-12 10:50 . 2006-12-15 14:26

---

d

---

w c:\program files\Google
2009-04-11 16:44 . 2009-04-11 16:44

---

d

---

w c:\program files\trend micro
2009-04-11 10:07 . 2009-04-11 10:07

---

d

---

w c:\program files\Panda Security
2009-04-11 06:11 . 2009-04-11 04:04

---

d

---

w c:\program files\EsetOnlineScanner
2009-04-10 04:57 . 2006-12-15 14:30

---

d

---

w c:\program files\Windows Media Connect 2
2009-04-10 04:56 . 2006-12-15 14:32

---

d

---

w c:\program files\Oberon Media
2009-04-10 04:53 . 2006-12-15 14:15

---

d

---

w c:\program files\NetWaiting
2009-04-10 04:52 . 2006-12-15 14:16

---

d

---

w c:\program files\Microsoft Money 2005
2009-04-10 04:50 . 2006-12-15 14:29

---

d

---

w c:\program files\DivX
2009-04-10 04:50 . 2006-12-15 14:00

---

d

---

w c:\program files\CONEXANT
2009-04-10 04:50 . 2006-12-16 05:49

---

d

---

w c:\program files\Common Files\SureThing Shared
2009-04-10 04:50 . 2006-12-16 05:49

---

d

---

w c:\program files\Common Files\Sonic Shared
2009-04-10 04:50 . 2006-12-15 14:33

---

d

---

w c:\program files\Common Files\Oberon Media
2009-04-10 04:49 . 2006-12-15 14:47

---

d

---

w c:\program files\Common Files\LightScribe
2009-04-10 04:46 . 2009-04-09 14:29

---

d

---

w c:\documents and settings\nurul aria.PC454518201285.001\Application Data\Symantec
2009-04-10 04:46 . 2006-12-15 14:00

---

d

---

w c:\documents and settings\All Users\Application Data\Symantec
2009-04-10 04:46 . 2006-12-16 05:49

---

d

---

w c:\documents and settings\All Users\Application Data\Sonic
2009-04-10 00:21 . 2006-12-15 14:16

---

d

---

w c:\program files\Microsoft Works
2009-04-09 16:03 . 2006-12-15 14:02

---

d

---

w c:\program files\Norton Internet Security
2009-04-09 15:36 . 2006-12-15 14:01

---

d

---

w c:\program files\Symantec
2009-04-09 14:32 . 2009-04-09 14:29 152 ----a-w c:\documents and settings\nurul aria.PC454518201285.001\Local Settings\Application Data\fusioncache.dat
2009-04-09 14:30 . 2006-12-15 14:12 1786 --sha-r c:\windows\system32\drivers\103C_HP_NTBK_Presario V3000 (RQ122PA#UUF)_YN_0Pres_Q2CE6501PRD_E433343372_46_I30B2_SWistron_V61.44_BF.13_T061117_WXH2_L409_M503_J80_7Intel_8T2050_91.6_#061215_N14E44311_(RQ122PA#UUF)_XMOBILE_CN10_Z_2F.13_G808627A2.MRK
2009-04-09 14:20 . 2006-12-16 05:49

---

d

---

w c:\program files\HPQ
2009-04-06 19:30 . 2009-04-06 19:30

---

d

---

w c:\program files\Microsoft CAPICOM 2.1.0.2
2009-04-05 09:25 . 2009-04-04 13:47 109248 ----a-w c:\documents and settings\nurul aria.PC454518201285.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-04 13:49 . 2009-04-04 13:47 152 ----a-w c:\documents and settings\nurul aria.PC454518201285.000\Local Settings\Application Data\fusioncache.dat
2009-04-04 12:38 . 2007-09-27 03:57

---

d

---

w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-03 14:04 . 2009-04-03 14:04

---

d

---

w c:\program files\Malwarebytes' Anti-Malware
2009-04-01 13:21 . 2007-10-20 10:21

---

d

---

w c:\program files\ESET
2009-03-31 02:56 . 2009-03-19 11:10 109760 ----a-w c:\documents and settings\nurul aria.PC454518201285\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-31 01:13 . 2009-03-31 01:13

---

d

---

w c:\program files\Common Files\SPSS
2009-03-31 01:13 . 2009-03-31 01:13

---

d

---

w c:\program files\SPSSInc
2009-03-29 02:09 . 2009-03-29 02:09

---

d

---

w c:\program files\Audacity
2009-03-24 13:24 . 2009-03-24 13:24

---

d

---

w c:\program files\PS
2009-03-22 00:25 . 2009-01-09 15:13

---

d

---

w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-03-19 11:12 . 2009-03-19 11:10 148 ----a-w c:\documents and settings\nurul aria.PC454518201285\Local Settings\Application Data\fusioncache.dat
2009-03-18 01:41 . 2008-11-17 12:59

---

d

---

w c:\program files\Apple Software Update
2009-03-18 00:52 . 2009-03-18 00:52

---

d

---

w c:\program files\Lavasoft
2009-03-16 12:53 . 2009-03-16 12:53

---

d

---

w c:\program files\AskBarDis
2009-03-16 12:36 . 2009-03-16 12:36

---

d

---

w c:\program files\BitDefender
2009-03-16 12:36 . 2009-03-16 12:33

---

d

---

w c:\program files\Common Files\BitDefender
2009-03-05 17:42 . 2009-03-05 17:42

---

d

---

w c:\documents and settings\nurul aria\Application Data\Apple Computer
2009-03-05 17:41 . 2008-11-17 13:01

---

d

---

w c:\program files\iTunes
2009-03-05 17:40 . 2009-03-05 17:40

---

d

---

w c:\program files\Bonjour
2009-03-05 17:39 . 2008-11-17 12:59

---

d

---

w c:\program files\QuickTime
2009-03-03 17:32 . 2009-03-03 17:32

---

d

---

w c:\program files\Movie Converter V3
2009-02-09 10:19 . 2004-08-04 21:00 1846272 ----a-w c:\windows\system32\win32k.sys
2009-01-10 16:03 . 2009-01-09 12:00 122552 ----a-w c:\documents and settings\nurul aria\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-09 12:03 . 2009-01-09 12:00 133 ----a-w c:\documents and settings\nurul aria\Local Settings\Application Data\fusioncache.dat
2007-05-16 02:09 . 2007-03-24 08:49 82024 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-03-24 08:49 . 2007-03-24 08:49 128 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\fusioncache.dat
2008-12-16 09:2008-10-30 09:34 52:16 . c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-18 4363504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 36975]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 52848]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 794713]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-01-26 40960]
"RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-06-23 61952]

c:\documents and settings\nurul aria\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-10-7 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-25 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R2 gupdate1c9bb59b9fa3bbc;Google Update Service (gupdate1c9bb59b9fa3bbc);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-12 133104]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-03-16 101936]


--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2009-04-14 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-12 10:30]

2009-04-09 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - nurul aria.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2005-10-07 04:13]
.
.

---

Supplementary Scan

---

.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=64&bd=presario&pf=laptop
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://securityresponse.symantec.com/avcenter/cgi-bin/virauto.cgi?vid=19184
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 23:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ???@V????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: ~,10time:~,-3
ComboFix-quarantined-files.txt 2009-04-14 15:46

Pre-Run: 26,977,968,128 bytes free
Post-Run: 29,179,650,048 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

254 --- E O F --- 2009-04-13 16:00

Katana

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download Java SE Runtime Environment (JRE) . ( don't install it yet )

• Scroll down to where it says "Java SE Runtime Environment (JRE)".
• Click the "Download" button to the right.
• • Platform = Windows
  • Language = Multi Language
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

Now download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location.

Now install the Java SE Runtime Environment (JRE) package you downloaded
(it comes with a toolbar pre-selected, so make sure you uncheck the box)

You can delete JavaRa (zip and exe)



Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Adobe Reader is a large program and uses unnecessary space.
If you prefer a smaller program you can get Foxit 3.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended

There is a newer version of Adobe Acrobat Reader available.

• Please go to this link Adobe Acrobat Reader Download Link
• Click Download
• On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
• Click the Continue button
• Click Run, and click Run again
• Next click the Install Now button and follow the on screen prompts

---

---

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Please delete RSIT.exe and C:\RSIT (entire folder)
You can also delete any logs we have produced, and empty your Recycle bin.


Uninstall Combofix

• This will clear your System Volume Information restore points and remove all the infected files that were quarantined
• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
  
  • 

---

---

The following is some info to help you stay safe and clean.


You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware is

not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
[*]Spybot - Search & Destroy <<< A must have program

• It includes host protection and registry protection
• A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

[*] MalwareBytes Anti-malware <<< A New and effective program
[*]a-squared Free <<< A good "realtime" or "on demand" scanner
[*]superantispyware <<< A good "realtime" or "on demand" scanner



Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place. Each does a different job, so you can have more than one
• Winpatrol
  • An excellent startup manager and then some !!
  • Notifies you if programs are added to startup
  • Allows delayed startup
  • A must have addition
• SpywareBlaster 4.0
  • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
• SpywareGuard 2.2
  • SpywareGuard provides real-time protection against spyware.
  • Not required if you have other "realtime" antispyware or Winpatrol
• ZonedOut
  • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
• MVPS HOSTS
  • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
  • For information on how to download and install, please read this tutorial by WinHelp2002.
  • Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
     
     • Change the Download signed ActiveX controls to Prompt
     • Change the Download unsigned ActiveX controls to Disable
     • Change the Initialise and script ActiveX controls not marked as safe to Disable
     • Change the Installation of desktop items to Prompt
     • Change the Launching programs and files in an IFRAME to Prompt
     • Change the Navigate sub-frames across different domains to Prompt
     • When all these settings have been made, click on the OK button.
     • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.

If you are still using IE6 then either update, or get one of the following.

• FireFox
  • With many addons available that make customization easy this is a very popular choice
  • NoScript and AdBlockPlus addons are essential
• Opera
  • Another popular alternative
• Netscape
  • Another popular alternative
  • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page. Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware. It is a good idea to empty the Temporary Internet Files folder on a regular basis. Tracking Cookies are files that websites use to monitor which sites you visit and how often. A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted. CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords Both of these can be cleaned manually, but a quicker option is to use a program
• ATF Cleaner
  • Free and very simple to use
• CCleaner
  • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

violet_aria

Katana wrote:

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download Java SE Runtime Environment (JRE) . ( don't install it yet )

• Scroll down to where it says "Java SE Runtime Environment (JRE)".
• Click the "Download" button to the right.
• • Platform = Windows
  • Language = Multi Language
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

Now download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location.

Now install the Java SE Runtime Environment (JRE) package you downloaded
(it comes with a toolbar pre-selected, so make sure you uncheck the box)

You can delete JavaRa (zip and exe)



Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Adobe Reader is a large program and uses unnecessary space.
If you prefer a smaller program you can get Foxit 3.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended

There is a newer version of Adobe Acrobat Reader available.

• Please go to this link Adobe Acrobat Reader Download Link
• Click Download
• On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
• Click the Continue button
• Click Run, and click Run again
• Next click the Install Now button and follow the on screen prompts

---

---

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Please delete RSIT.exe and C:\RSIT (entire folder)
You can also delete any logs we have produced, and empty your Recycle bin.


Uninstall Combofix

• This will clear your System Volume Information restore points and remove all the infected files that were quarantined
• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
  • 

---

---

The following is some info to help you stay safe and clean.


You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

• AntiSpyware is not the same thing as Antivirus.
  Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
  You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
  Most of the programs in this list have a free (for Home Users ) and paid versions,
  it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
• Spybot - Search & Destroy <<< A must have program
  • It includes host protection and registry protection
  • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
• MalwareBytes Anti-malware <<< A New and effective program
• a-squared Free <<< A good "realtime" or "on demand" scanner
• superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

• These programs don't detect malware, they help stop it getting on your machine in the first place.
  Each does a different job, so you can have more than one
• Winpatrol
  • An excellent startup manager and then some !!
  • Notifies you if programs are added to startup
  • Allows delayed startup
  • A must have addition
• SpywareBlaster 4.0
  • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
• SpywareGuard 2.2
  • SpywareGuard provides real-time protection against spyware.
  • Not required if you have other "realtime" antispyware or Winpatrol
• ZonedOut
  • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
• MVPS HOSTS
  • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
  • For information on how to download and install, please read this tutorial by WinHelp2002.
  • Not required if you are using other host file protections

Internet Browsers

• Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
  Using a different web browser can help stop malware getting on your machine.
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
       • Change the Download signed ActiveX controls to Prompt
       • Change the Download unsigned ActiveX controls to Disable
       • Change the Initialise and script ActiveX controls not marked as safe to Disable
       • Change the Installation of desktop items to Prompt
       • Change the Launching programs and files in an IFRAME to Prompt
       • Change the Navigate sub-frames across different domains to Prompt
       • When all these settings have been made, click on the OK button.
       • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    5. Next press the Apply button and then the OK to exit the Internet Properties page.
  
  If you are still using IE6 then either update, or get one of the following.
  • FireFox
    • With many addons available that make customization easy this is a very popular choice
    • NoScript and AdBlockPlus addons are essential
  • Opera
    • Another popular alternative
  • Netscape
    • Another popular alternative
    • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

• Temporary Internet Files are mainly the files that are downloaded when you open a web page.
  Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
  It is a good idea to empty the Temporary Internet Files folder on a regular basis.
  
  Tracking Cookies are files that websites use to monitor which sites you visit and how often.
  A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
  CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords
  
  Both of these can be cleaned manually, but a quicker option is to use a program
• ATF Cleaner
  • Free and very simple to use
• CCleaner
  • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

thank you..i think may laptop is free from virus now. Norton do not detect any viruses yesterday.:thumbup thanks:)