HELP PLZ

jumpstylerzjumpstylerz Member
edited August 2009 in Spyware & Virus Removal
hey i hav been using my laptop for a long time and suddenly a couple days ago when i was playing on kongregate when a popup appears:
your system is at risk
texttexttextblahblahblah
please install this virus removal program
microsoft Winishield for vista
publisher: microsoft

i, in a panic installed it then dun som research on it found out it was a virus
i removed the program and tried to restart my laptop
it froze
started in safe mode
froze safe mode with cmd
froze
safe mode with network help
hooray
i ran all my virus spyware malware and free online scanners i usualy do and it comes up with a few viruses at a very high threat lvl i deleat them restart and run again it comes up clean i start my computor again suddenly there is msword.exe and oashdihasidhasuidhiasdhiashdiuasdhasd in my main users documents i deleted them but they came straight back wen i went to recycle bin i hit empty then went back to my documents and they were there again and in my windows folder there was over 200 files that looked alot like a virus or spyware ectect files like 976z9863ot a irus97 so i delete them then restart computor crahses on restart with the blue screen of death then i restart again its fine i am on it now running all my virus scanners and stuff again and i need help cause i hav school soon and this has all my school stuff on it
and there is also a file that i cant delete called _default that is a shortcut to MS-DOS program
please help me:eek3::eek3::eek3:
im running vista

Comments

  • edited August 2009
    Please note that all instructions given are customised for this computer only,
    the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.


    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly laechel.gif

    Some of the logs I request will be quite large, You may need to split them over a couple of replies.

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe






    Download and Run RSIT
    • Please download Random's System Information Tool by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open:
      • log.txt will be opened maximized.
      • info.txt will be opened minimized.
    • Please post the contents of both log.txt and info.txt.
      ( They can also be found in the C:\RSIT folder )


    Please Download GMER to your desktop

    Download GMER and extract it to your desktop.

    ***Please close any open programs ***

    Double-click gmer.exe. The program will begin to run.

    **Caution**
    These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst


    If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
    • Click Yes.
    • Once the scan is complete, you may receive another notice about rootkit activity.
    • Click OK.
    • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

    If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.
    • Click the Scan button and let the program do its work. GMER will produce a log.
    • Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.


    DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !




    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    Some of the logs I request will be quite large, You may need to split them over a couple of replies.
    • RSIT Logs
    • GMER Log
  • jumpstylerzjumpstylerz Member
    edited August 2009
    alllright ill post the logs also if u would like me to post a HiJack this and autoruns log i would be happy to


    Logfile of random's system information tool 1.06 (written by random/random)
    Run by SCAN at 2009-08-12 22:44:22
    Microsoft® Windows Vista™ Home Basic
    System drive C: has 1 GB (3%) free of 33 GB
    Total RAM: 1014 MB (58% free)
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:44:23 PM, on 12/08/2009
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v8.00 (8.00.6001.18813)
    Boot mode: Safe mode with network support
    Running processes:
    C:\Windows\Explorer.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    D:\programs\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Users\SCAN\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GHNUK2TH\RSIT[1].exe
    D:\programs\Trend Micro\HijackThis\SCAN.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.au.acer.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.au.acer.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - *{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
    R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    O1 - Hosts: ::1 localhost
    O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (file missing)
    O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
    O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
    O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Users\sean school\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/CursorManiaInitialSetup1.0.1.1.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D85816A1-DCED-4B7C-8550-5181DAF61523}: NameServer = 85.255.112.173,85.255.112.122
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.173,85.255.112.122
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.173,85.255.112.122
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
    O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
    O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
    O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
    O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
    O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
    O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
    --
    End of file - 10926 bytes
    ======Scheduled tasks folder======
    C:\Windows\tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
    ======Registry dump======
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}]
    MyWebSearch Search Assistant BHO - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL [2009-03-08 61440]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}]
    mwsBar BHO - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL [2009-03-08 434271]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30 403824]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    AVG Security Toolbar BHO - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-06-26 1008896]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll [2008-07-02 654320]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-16 35840]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Windows\system32\eDStoolbar.dll []
    {07B18EA9-A523-4961-B6BB-170DE4475CCA} - My Web Search - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL [2009-03-08 434271]
    {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll [2009-06-26 1008896]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-07-12 1006264]
    "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-05-29 4472832]
    "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-10-24 815104]
    "Acer Tour"= []
    "PLFSet"=C:\Windows\PLFSet.dll [2007-04-25 45056]
    "IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2007-07-13 178712]
    "RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-03-15 71216]
    "LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-02-08 54832]
    "eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [2007-04-26 457216]
    "LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-06-15 850704]
    "eRecoveryService"= []
    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-05-16 148888]
    "AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-06-12 1948440]
    "MyWebSearch Plugin"=rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF []
    "My Web Search Bar Search Scope Monitor"=C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe [2009-03-08 24688]
    "MyWebSearch Email Plugin"=C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe [2009-03-08 32838]
    "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]
    "Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]
    "IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-02-11 141848]
    "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-02-11 166424]
    "Persistence"=C:\Windows\system32\igfxpers.exe [2008-02-11 133656]
    "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-05-26 413696]
    "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-07-13 292128]
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter []
    "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLS"="avgrsstx.dll"
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\Windows\system32\igfxdev.dll [2008-02-11 204800]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    ======File associations======
    .js - edit - C:\Windows\System32\Notepad.exe %1
    .js - open - C:\Windows\System32\WScript.exe "%1" %*
    .reg - open - "regedit.exe" "%1"
    ======List of files/folders created in the last 3 months======
    2009-12-14 14:22:33 ----A---- C:\Windows\system32\97079spambotzb45.dll
    2009-12-13 22:05:40 ----A---- C:\Windows\system32\5884haczto5l529.exe
    2009-12-11 11:26:38 ----A---- C:\Windows\system32\18061n9z-a-viru54f0.exe
    2009-12-03 19:30:09 ----A---- C:\Windows\system32\19952zot-5-vi9us3cc.dll
    2009-12-03 14:07:05 ----A---- C:\Windows\system32\350d5tzal399.exe
    2009-11-28 08:40:21 ----A---- C:\Windows\system32\5339a9dware2943z.exe
    2009-11-26 15:22:39 ----A---- C:\Windows\system32\349cs9zwa5e2560.exe
    2009-11-24 06:59:49 ----A---- C:\Windows\system32\32309tz5j76.exe
    2009-11-15 09:19:05 ----A---- C:\Windows\system32\6055threatz1969.dll
    2009-11-09 02:33:38 ----A---- C:\Windows\system32\39633tro5458z.dll
    2009-10-23 17:31:47 ----A---- C:\Windows\system32\5e4zbackdoor3911.dll
    2009-10-12 06:57:46 ----A---- C:\Windows\system32\25255zacktoo9293.dll
    2009-10-09 09:33:27 ----A---- C:\Windows\system32\6646sp5mbot6z9.exe
    2009-09-28 21:54:20 ----A---- C:\Windows\system32\76zf5teal30869.dll
    2009-09-27 08:54:51 ----A---- C:\Windows\system32\2z119w9r5583.dll
    2009-09-26 17:25:38 ----A---- C:\Windows\system32\z16055roj62d9.dll
    2009-09-25 05:21:22 ----A---- C:\Windows\system32\515aad9ware142z.exe
    2009-09-23 09:11:29 ----A---- C:\Windows\system32\z1958not-a9v5rus548.dll
    2009-09-22 16:29:42 ----A---- C:\Windows\system32\699espywa5ez8679.dll
    2009-09-15 17:27:26 ----A---- C:\Windows\system32\26985parsez820.dll
    2009-09-07 11:48:11 ----A---- C:\Windows\system32\4efa9a5kdoor5z.exe
    2009-09-06 16:39:32 ----A---- C:\Windows\system32\c93spywaze2965.dll
    2009-08-24 06:46:26 ----A---- C:\Windows\system32\15fzpyware929.exe
    2009-08-17 23:05:21 ----A---- C:\Windows\system32\16b8spars52939z.dll
    2009-08-16 09:42:28 ----A---- C:\Windows\system32\6a3a9zwnl5ader1746.exe
    2009-08-14 13:12:02 ----A---- C:\Windows\system32\1006wo9m7e5z.dll
    2009-08-13 05:28:50 ----A---- C:\Windows\system32\99991zorm5d5.dll
    2009-08-12 22:44:22 ----D---- C:\rsit
    2009-08-10 23:20:06 ----D---- C:\Users\SCAN\AppData\Roaming\WinRAR
    2009-08-10 22:54:14 ----D---- C:\Users\SCAN\AppData\Roaming\Macromedia
    2009-08-10 22:52:54 ----D---- C:\Users\SCAN\AppData\Roaming\Identities
    2009-08-10 22:51:10 ----SD---- C:\Users\SCAN\AppData\Roaming\Microsoft
    2009-08-10 17:56:50 ----A---- C:\Windows\system32\6579sparse928z.exe
    2009-08-09 23:30:22 ----D---- C:\Program Files\Windows Live Safety Center
    2009-08-09 23:18:10 ----D---- C:\Windows\BDOSCAN8
    2009-08-09 13:11:26 ----A---- C:\Windows\system32\avgrep.txt
    2009-08-09 03:55:47 ----D---- C:\Program Files\Common Files\PC Tools
    2009-08-09 03:55:43 ----D---- C:\ProgramData\PC Tools
    2009-08-09 03:55:43 ----D---- C:\Program Files\Spyware Doctor
    2009-08-09 03:29:14 ----A---- C:\Windows\ntbtlog.txt
    2009-08-09 03:26:10 ----A---- C:\Windows\system32\z59spywar51879.dll
    2009-08-09 03:26:10 ----A---- C:\Windows\system32\9z5th9e5798.dll
    2009-08-09 03:26:10 ----A---- C:\Windows\system32\11927hzckt95l29.exe
    2009-08-09 03:26:09 ----A---- C:\Windows\system32\6591thi9f2z98.dll
    2009-08-09 03:26:06 ----A---- C:\Windows\system32\589downloadzr415.exe
    2009-08-09 03:26:05 ----A---- C:\Windows\system32\1969addware1z165.dll
    2009-08-09 03:26:02 ----A---- C:\Windows\system32\5081spywzr91953.exe
    2009-08-09 03:25:55 ----A---- C:\Windows\system32\5bf0vz91544.dll
    2009-08-09 03:25:52 ----A---- C:\Windows\system32\19357spamboz85.dll
    2009-08-09 03:25:50 ----A---- C:\Windows\system32\6d9aspywaz53061.dll
    2009-08-09 03:25:49 ----A---- C:\Windows\system32\4164zi95781.exe
    2009-08-09 03:25:49 ----A---- C:\Windows\system32\23d4az5ware3916.exe
    2009-08-09 03:25:46 ----A---- C:\Windows\system32\7f90stzal539.exe
    2009-08-09 03:25:46 ----A---- C:\Windows\system32\56c9bzc5door2162.dll
    2009-08-09 03:25:45 ----A---- C:\Windows\system32\15616w9rm4z5.dll
    2009-08-09 03:25:45 ----A---- C:\Windows\system32\139299orm5z2.exe
    2009-08-09 03:25:32 ----A---- C:\Windows\system32\237459cktool4az.exe
    2009-08-09 03:25:31 ----A---- C:\Windows\system32\2998sp95z5.dll
    2009-08-09 03:25:31 ----A---- C:\Windows\system32\139685ot-a-vizus785.exe
    2009-08-09 03:25:28 ----A---- C:\Windows\system32\5aa3azdw5re579.dll
    2009-08-09 03:25:16 ----A---- C:\Windows\system32\19139sp5290z.dll
    2009-08-09 03:25:11 ----A---- C:\Windows\system32\3cb89hreat153z6.exe
    2009-08-09 03:25:10 ----A---- C:\Windows\system32\4640notz5-vi9us525.exe
    2009-08-09 03:25:09 ----A---- C:\Windows\system32\z8337t5o92bb.dll
    2009-08-08 22:19:05 ----A---- C:\Program Files\Uninstall.exe
    2009-08-07 13:42:32 ----D---- C:\Temp
    2009-08-07 11:19:27 ----A---- C:\Windows\system32\2z986sp5106.exe
    2009-08-07 07:17:15 ----A---- C:\Windows\system32\GEARAspi.dll
    2009-08-07 07:16:51 ----D---- C:\Program Files\iPod
    2009-08-07 07:16:10 ----D---- C:\ProgramData\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-08-07 07:16:10 ----D---- C:\Program Files\iTunes
    2009-08-07 07:12:07 ----D---- C:\Program Files\QuickTime
    2009-08-01 10:41:48 ----A---- C:\Windows\system32\29b1backzo5r3156.dll
    2009-07-31 01:11:37 ----A---- C:\Windows\system32\igxpun.exe
    2009-07-31 01:11:32 ----A---- C:\Windows\system32\difxapi.dll
    2009-07-31 01:07:43 ----D---- C:\Program Files\Microsoft Silverlight
    2009-07-31 01:03:20 ----A---- C:\Windows\system32\occache.dll
    2009-07-31 01:03:19 ----A---- C:\Windows\system32\jsproxy.dll
    2009-07-31 01:03:18 ----A---- C:\Windows\system32\iepeers.dll
    2009-07-31 01:03:17 ----A---- C:\Windows\system32\msfeedsbs.dll
    2009-07-31 01:03:17 ----A---- C:\Windows\system32\msfeeds.dll
    2009-07-31 01:03:16 ----A---- C:\Windows\system32\ieui.dll
    2009-07-31 01:03:16 ----A---- C:\Windows\system32\iesetup.dll
    2009-07-31 01:03:15 ----A---- C:\Windows\system32\wininet.dll
    2009-07-31 01:03:15 ----A---- C:\Windows\system32\iernonce.dll
    2009-07-31 01:03:14 ----A---- C:\Windows\system32\msfeedssync.exe
    2009-07-31 01:03:14 ----A---- C:\Windows\system32\ie4uinit.exe
    2009-07-31 01:03:13 ----A---- C:\Windows\system32\iertutil.dll
    2009-07-31 01:03:12 ----A---- C:\Windows\system32\ieUnatt.exe
    2009-07-31 01:03:12 ----A---- C:\Windows\system32\iedkcs32.dll
    2009-07-31 01:03:11 ----A---- C:\Windows\system32\urlmon.dll
    2009-07-31 01:03:11 ----A---- C:\Windows\system32\iesysprep.dll
    2009-07-31 01:03:07 ----A---- C:\Windows\system32\ieframe.dll
    2009-07-31 01:03:05 ----A---- C:\Windows\system32\mshtml.dll
    2009-07-31 00:59:44 ----A---- C:\Windows\system32\mshtmled.dll
    2009-07-31 00:59:44 ----A---- C:\Windows\system32\icardie.dll
    2009-07-31 00:59:43 ----A---- C:\Windows\system32\mshtmler.dll
    2009-07-31 00:59:43 ----A---- C:\Windows\system32\admparse.dll
    2009-07-31 00:59:42 ----A---- C:\Windows\system32\msls31.dll
    2009-07-31 00:59:42 ----A---- C:\Windows\system32\ieakeng.dll
    2009-07-31 00:59:42 ----A---- C:\Windows\system32\corpol.dll
    2009-07-31 00:59:41 ----A---- C:\Windows\system32\imgutil.dll
    2009-07-31 00:59:41 ----A---- C:\Windows\system32\dxtrans.dll
    2009-07-31 00:59:41 ----A---- C:\Windows\system32\dxtmsft.dll
    2009-07-31 00:59:39 ----A---- C:\Windows\system32\msrating.dll
    2009-07-31 00:59:39 ----A---- C:\Windows\system32\licmgr10.dll
    2009-07-31 00:59:39 ----A---- C:\Windows\system32\inseng.dll
    2009-07-31 00:59:39 ----A---- C:\Windows\system32\ieaksie.dll
    2009-07-31 00:59:38 ----A---- C:\Windows\system32\webcheck.dll
    2009-07-31 00:59:37 ----A---- C:\Windows\system32\WinFXDocObj.exe
    2009-07-31 00:59:37 ----A---- C:\Windows\system32\wextract.exe
    2009-07-31 00:59:37 ----A---- C:\Windows\system32\mstime.dll
    2009-07-31 00:59:37 ----A---- C:\Windows\system32\ieakui.dll
    2009-07-31 00:59:36 ----A---- C:\Windows\system32\pngfilt.dll
    2009-07-31 00:59:36 ----A---- C:\Windows\system32\advpack.dll
    2009-07-31 00:59:35 ----A---- C:\Windows\system32\ieapfltr.dll
    2009-07-31 00:59:34 ----A---- C:\Windows\system32\vbscript.dll
    2009-07-31 00:59:34 ----A---- C:\Windows\system32\url.dll
    2009-07-31 00:59:34 ----A---- C:\Windows\system32\jscript.dll
    2009-07-31 00:59:30 ----A---- C:\Windows\system32\mshta.exe
    2009-07-31 00:59:29 ----A---- C:\Windows\system32\iexpress.exe
    2009-07-31 00:59:28 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
    2009-07-31 00:59:27 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
    2009-07-31 00:59:27 ----A---- C:\Windows\system32\PDMSetup.exe
    2009-07-17 08:03:28 ----A---- C:\Windows\system32\t2embed.dll
    2009-07-17 08:03:28 ----A---- C:\Windows\system32\fontsub.dll
    2009-07-17 08:03:27 ----A---- C:\Windows\system32\lpk.dll
    2009-07-17 08:03:27 ----A---- C:\Windows\system32\dciman32.dll
    2009-07-17 08:03:27 ----A---- C:\Windows\system32\atmlib.dll
    2009-07-17 08:03:27 ----A---- C:\Windows\system32\atmfd.dll
    2009-07-14 17:08:46 ----A---- C:\Windows\system32\z90w5rm219.dll
    2009-07-07 21:54:17 ----A---- C:\Windows\system32\4151spam9zt436.exe
    2009-06-23 00:05:49 ----D---- C:\Program Files\Vstplugins
    2009-06-16 13:35:35 ----A---- C:\Windows\system32\759sparsz2149.exe
    2009-06-12 08:26:15 ----D---- C:\ProgramData\AVG Security Toolbar
    2009-06-12 07:00:09 ----A---- C:\Windows\system32\localspl.dll
    2009-06-12 07:00:04 ----A---- C:\Windows\system32\rpcrt4.dll
    2009-06-05 23:56:25 ----D---- C:\Fussion-Nekro
    2009-05-27 13:21:33 ----A---- C:\Homer Soundboard.exe
    2009-05-27 13:21:33 ----A---- C:\cartman Soundboard.exe
    2009-05-25 13:40:51 ----A---- C:\gta cheats.txt
    2009-05-22 09:55:02 ----A---- C:\Windows\system32\20903s5y3z7.dll
    2009-05-17 13:32:21 ----D---- C:\Program Files\Microsoft
    2009-05-17 13:31:12 ----D---- C:\Program Files\Windows Live SkyDrive
    2009-05-17 13:24:54 ----D---- C:\Program Files\Common Files\Windows Live
    2009-05-16 12:48:20 ----A---- C:\Windows\system32\deploytk.dll
    2009-05-16 12:48:19 ----A---- C:\Windows\system32\javaws.exe
    2009-05-16 12:48:16 ----A---- C:\Windows\system32\javaw.exe
    2009-05-16 12:48:15 ----A---- C:\Windows\system32\java.exe
    2009-05-16 09:46:16 ----A---- C:\Windows\system32\4568s9azse7585.exe
    2009-05-15 11:43:20 ----D---- C:\Halo CE
    2009-05-13 21:21:13 ----A---- C:\Windows\system32\2809spzwa592731.dll
    ======List of files/folders modified in the last 3 months======
    2009-08-12 20:44:57 ----D---- C:\Windows\tracing
    2009-08-11 01:49:50 ----HD---- C:\$AVG8.VAULT$
    2009-08-11 01:48:49 ----D---- C:\Windows\Temp
    2009-08-11 01:23:01 ----D---- C:\Windows\.jagex_cache_32
    2009-08-11 01:10:28 ----AD---- C:\ProgramData\TEMP
    2009-08-11 00:18:20 ----SHD---- C:\Windows\Installer
    2009-08-11 00:18:20 ----HD---- C:\Config.msi
    2009-08-11 00:01:03 ----D---- C:\Windows
    2009-08-10 23:40:07 ----D---- C:\Windows\system32\drivers
    2009-08-10 23:35:22 ----D---- C:\Program Files\Mozilla Firefox
    2009-08-10 22:53:31 ----SHD---- C:\$RECYCLE.BIN
    2009-08-10 22:51:09 ----RD---- C:\Users
    2009-08-10 12:18:31 ----D---- C:\Windows\Minidump
    2009-08-10 11:00:45 ----D---- C:\Program Files\Image-Line
    2009-08-10 10:59:07 ----RD---- C:\Program Files
    2009-08-10 10:58:33 ----HD---- C:\Program Files\InstallShield Installation Information
    2009-08-10 10:56:07 ----D---- C:\Program Files\Yahoo!
    2009-08-10 06:43:52 ----D---- C:\Program Files\Microsoft Games
    2009-08-09 23:30:22 ----SD---- C:\Windows\Downloaded Program Files
    2009-08-09 23:27:51 ----D---- C:\Program Files\Common Files
    2009-08-09 14:21:06 ----D---- C:\Windows\System32
    2009-08-09 12:51:08 ----D---- C:\Windows\system32\Tasks
    2009-08-09 12:50:54 ----D---- C:\Windows\Tasks
    2009-08-09 03:55:43 ----HD---- C:\ProgramData
    2009-08-08 23:15:31 ----SHD---- C:\System Volume Information
    2009-08-08 22:02:03 ----D---- C:\Windows\Prefetch
    2009-08-08 21:58:19 ----D---- C:\Windows\system32\catroot2
    2009-08-07 07:17:18 ----D---- C:\Windows\system32\catroot
    2009-08-07 07:17:14 ----DC---- C:\Windows\system32\DRVSTORE
    2009-08-07 07:16:50 ----D---- C:\Program Files\Common Files\Apple
    2009-08-07 07:05:04 ----D---- C:\Windows\inf
    2009-08-06 13:22:51 ----A---- C:\Windows\system32\PerfStringBackup.TMP
    2009-07-31 10:23:13 ----D---- C:\Windows\rescache
    2009-07-31 09:06:55 ----D---- C:\Windows\system32\migration
    2009-07-31 09:06:55 ----D---- C:\Windows\AppPatch
    2009-07-31 09:06:52 ----D---- C:\Program Files\Internet Explorer
    2009-07-31 09:06:47 ----D---- C:\Windows\system32\en-US
    2009-07-31 09:06:47 ----D---- C:\Windows\PolicyDefinitions
    2009-07-31 01:38:08 ----D---- C:\Windows\Microsoft.NET
    2009-07-31 01:09:19 ----D---- C:\Windows\winsxs
    2009-07-31 01:06:43 ----D---- C:\Program Files\Common Files\microsoft shared
    2009-07-28 09:05:54 ----D---- C:\Windows\system32\WDI
    2009-07-18 11:02:01 ----D---- C:\Program Files\Bonjour
    2009-07-17 16:07:52 ----D---- C:\Program Files\Windows Mail
    2009-07-17 16:07:44 ----D---- C:\ProgramData\Microsoft Help
    2009-07-08 01:10:56 ----A---- C:\Windows\system32\MRT.exe
    2009-06-19 13:17:58 ----D---- C:\ProgramData\Adobe
    2009-06-19 13:17:46 ----D---- C:\Program Files\Common Files\Adobe
    2009-06-15 08:28:37 ----D---- C:\Windows\system32\Macromed
    2009-05-30 14:15:23 ----D---- C:\Program Files\Launch Manager
    2009-05-20 08:43:01 ----A---- C:\Windows\system32\avgrsstx.dll
    2009-05-17 13:29:21 ----D---- C:\Program Files\Windows Live
    2009-05-16 12:46:52 ----D---- C:\Program Files\Java
    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-20 534016]
    R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2007-06-15 21264]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
    R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2007-07-12 6144]
    R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2006-10-24 179896]
    R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-03-19 11264]
    S1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2008-07-02 335752]
    S1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2009-06-17 27784]
    S2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B}; \??\C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-03 13560]
    S2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2007-03-03 76584]
    S2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2006-11-02 95744]
    S2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-20 12672]
    S2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-29 8192]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936]
    S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-20 534016]
    S3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-03-19 14208]
    S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
    S3 FANTOM;LEGO MINDSTORMS NXT Driver; C:\Windows\system32\DRIVERS\fantom.sys [2006-03-10 39424]
    S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
    S3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-12-23 985600]
    S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
    S3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-12-23 207360]
    S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 2302976]
    S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-05-31 1780576]
    S3 MSIRCOMM;Microsoft IR Communications Driver; C:\Windows\system32\DRIVERS\MSIRCOMM.sys [2006-11-02 24064]
    S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
    S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
    S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
    S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
    S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-11-02 1781760]
    S3 NSCIRDA;NSC Infrared Device Driver; C:\Windows\system32\DRIVERS\nscirda.sys [2006-11-02 30720]
    S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm60x32.sys [2006-11-02 429056]
    S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2007-11-17 82432]
    S3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2007-02-08 1729152]
    S3 tifm21;tifm21; C:\Windows\system32\drivers\tifm21.sys [2007-05-02 290816]
    S3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2006-11-02 14848]
    S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-11-07 32000]
    S3 usbaudio;USB Audio Driver (WDM); C:\Windows\system32\drivers\usbaudio.sys [2006-11-02 71552]
    S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
    S3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-12-23 659968]
    S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
    S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
    S2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-07-09 144712]
    S2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-05-20 298776]
    S2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service; C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [2008-01-11 30312]
    S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
    S2 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
    S2 eDataSecurity Service;eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [2007-04-26 457512]
    S2 eLockService;eLock Service; C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe [2007-04-24 24576]
    S2 eNet Service;eNet Service; C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-06-14 135168]
    S2 eRecoveryService;eRecovery Service; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [2007-07-04 53248]
    S2 eSettingsService;eSettings Service; C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-29 24576]
    S2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2007-07-13 354840]
    S2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2006-11-02 22016]
    S2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-18 61440]
    S2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2006-11-25 107008]
    S2 MyWebSearchService;My Web Search Service; C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe [2009-03-08 28762]
    S2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2006-11-02 22016]
    S2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-04-03 272024]
    S2 SQLBrowser;SQL Server Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]
    S2 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]
    S2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2006-11-02 22016]
    S2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-03-30 1533808]
    S2 WMIService;ePower Service; C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-14 167936]
    S2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-11-29 386560]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-07-02 137200]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
    S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-07-13 542496]
    S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-11-24 29263712]
    S3 npggsvc;nProtect GameGuard Service; C:\Windows\system32\GameMon.des [2009-03-10 2793784]
    S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-27 145184]
    S3 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]
    S3 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-01-21 1095560]
    S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-28 316664]
    S3 usprserv;User Privilege Service; C:\Windows\System32\svchost.exe [2006-11-02 22016]
    S4 CaCCProvSP;CaCCProvSP; C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe []
    S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]
    EOF
  • jumpstylerzjumpstylerz Member
    edited August 2009
    heres info.txt

    info.txt logfile of random's system information tool 1.06 2009-08-12 22:44:28
    ======Uninstall list======
    2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL
    2MOONS-->MsiExec.exe /I{688E07FE-9832-4FB9-8666-FB198D86ADC6}
    Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}\setup.exe -runfromtemp -l0x0009 -removeonly -u
    Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{AA047D7C-5E7C-4878-B75C-77589151B563}\setup.exe -runfromtemp -l0x0009 -removeonly
    Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
    Acer eLock Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}\setup.exe" -l0x9 -removeonly
    Acer Empowering Technology-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x9 -removeonly
    Acer eNet Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C06554A1-2C1E-4D20-B613-EE62C79927CC}\setup.exe" -l0x9 -removeonly
    Acer ePower Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\setup.exe" -l0x9 -removeonly
    Acer ePresentation Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BF839132-BD43-4056-ACBF-4377F4A88E2A}\setup.exe" -l0x9 -removeonly
    Acer eSettings Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CE65A9A0-9686-45C6-9098-3C9543A412F0}\setup.exe" -l0x9 -removeonly
    Acer GridVista-->C:\Windows\UnInst32.exe GridV.UNI
    Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x9 -removeonly
    Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
    Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x9 -removeonly
    Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
    Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 8.1.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
    Apple Mobile Device Support-->MsiExec.exe /I{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    ASIO4ALL-->C:\Program Files\ASIO4ALL v2\uninstall.exe
    AVG Free 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
    Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
    Business Contact Manager for Outlook 2007 SP2-->"C:\Program Files\Microsoft Small Business\Business Contact Manager\SetupBootstrap\Setup.exe" /remove {B32C4059-6E7A-41EF-AD20-56DF1872B923}
    Business Contact Manager for Outlook 2007 SP2-->MsiExec.exe /X{B32C4059-6E7A-41EF-AD20-56DF1872B923}
    Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
    Deckadance-->C:\Program Files\VstPlugins\Deckadance\uninstall.exe
    FL Studio 8-->C:\Program Files\Image-Line\FL Studio 8\uninstall.exe
    HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118\UIU32m.exe -U -Ic:\Release\Foxconn\51338\AcrZUn32z.inf
    HijackThis 2.0.2-->"D:\programs\Trend Micro\HijackThis\HijackThis.exe" /uninstall
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
    Intel(R) Graphics Media Accelerator Driver-->C:\Windows\system32\igxpun.exe -uninstall
    Intel(R) Matrix Storage Manager-->C:\Windows\System32\Imsmudlg.exe
    iTunes-->MsiExec.exe /I{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}
    J2SE Runtime Environment 5.0 Update 12-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150120}
    Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
    Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
    Launch Manager-->C:\Windows\UnInst32.exe LManager.UNI
    LimeWire 4.16.6-->"C:\Program Files\LimeWire\uninstall.exe"
    Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
    Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A40409-6000-11D3-8CFE-0150048383C9}
    Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
    Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
    Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
    Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
    Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
    Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
    Microsoft Office Live Add-in 1.4-->MsiExec.exe /I{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}
    Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
    Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
    Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
    Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}
    Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
    Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
    Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
    Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
    Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
    Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
    Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
    Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
    Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
    Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
    Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)-->MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}
    Microsoft SQL Server 2005-->"C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove
    Microsoft SQL Server Native Client-->MsiExec.exe /I{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}
    Microsoft SQL Server Setup Support Files (English)-->MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}
    Microsoft SQL Server VSS Writer-->MsiExec.exe /I{56B4002F-671C-49F4-984C-C760FE3806B5}
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
    Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
    Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
    MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
    MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    My Web Search (Cursor Mania)-->rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsbar.dll,O
    NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly
    NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1033 CDM7
    NTI Shadow-->"C:\Program Files\InstallShield Installation Information\{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}\setup.exe" -removeonly
    NTI Shadow-->C:\Program Files\InstallShield Installation Information\{6F7EA6CA-79F4-44A0-A370-8E82BB16534A}\setup.exe -runfromtemp -l0x0409
    OGA Notifier 1.7.0105.35.0-->MsiExec.exe /I{B148AB4B-C8FA-474B-B981-F2943C5B5BCD}
    Pando Media Booster-->C:\Program Files\Pando Networks\Media Booster\uninst.exe
    Pivot Stickfigure Animator-->MsiExec.exe /I{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D}
    PoiZone-->C:\Program Files\Image-Line\PoiZone\uninstall.exe
    PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
    QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
    reFX Nexus 1.3.8-->"C:\Program Files\Refc_nexus\Refx nexus\unins000.exe"
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
    Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
    Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
    Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
    Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
    Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
    Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
    Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
    Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
    Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
    Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
    Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
    StepMania CVS 4.0 (remove only)-->"d:\Programs\StepMania CVS\uninstall.exe"
    Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
    Texas Instruments PCIxx21/x515/xx12 drivers.-->C:\Program Files\InstallShield Installation Information\{BE1826A9-7EEE-492A-B3BC-DEF3DFAE37EE}\setup.exe -runfromtemp -l0x0409
    Toxic Biohazard-->C:\Program Files\Image-Line\Toxic Biohazard\uninstall.exe
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
    Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
    Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
    Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
    Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
    Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
    Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
    Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
    Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
    Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
    Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
    Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
    Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
    Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
    Update for Outlook 2007 Junk Email Filter (kb971933)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {53C200F4-3B4B-49A5-8539-2C61F1A88CA2}
    Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
    Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
    Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
    Windows Live Essentials-->MsiExec.exe /I{C6CA8874-5F22-4AF0-9BE3-016BF299C536}
    Windows Live ID Sign-in Assistant-->MsiExec.exe /X{10A44844-4465-456E-8C97-80BDD4F68845}
    Windows Live Messenger-->MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C}
    Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
    Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
    Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
    WinRAR archiver-->D:\programs\WinRAR\uninstall.exe
    =====HijackThis Backups=====
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll [2009-08-10]
    O13 - Gopher Prefix: [2009-08-10]
    ======Security center information======
    AV: AVG Anti-Virus Free
    AS: Spyware Doctor
    AS: AVG Anti-Virus Free (disabled)
    AS: Windows Defender (disabled)
    ======System event log======
    Computer Name: school-laptop
    Event Code: 10005
    Message: DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server:
    {DD522ACC-F821-461A-A407-50B198B896DC}
    Record Number: 116700
    Source Name: Microsoft-Windows-DistributedCOM
    Time Written: 20090812123648.000000-000
    Event Type: Error
    User:
    Computer Name: school-laptop
    Event Code: 10005
    Message: DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server:
    {1BE1F766-5536-11D1-B726-00C04FB926AF}
    Record Number: 116701
    Source Name: Microsoft-Windows-DistributedCOM
    Time Written: 20090812123657.000000-000
    Event Type: Error
    User:
    Computer Name: school-laptop
    Event Code: 10005
    Message: DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server:
    {9E175B6D-F52A-11D8-B9A5-505054503030}
    Record Number: 116703
    Source Name: Microsoft-Windows-DistributedCOM
    Time Written: 20090812123701.000000-000
    Event Type: Error
    User:
    Computer Name: school-laptop
    Event Code: 7001
    Message: The Computer Browser service depends on the Server service which failed to start because of the following error:
    The dependency service or group failed to start.
    Record Number: 116720
    Source Name: Service Control Manager
    Time Written: 20090812123736.000000-000
    Event Type: Error
    User:
    Computer Name: school-laptop
    Event Code: 7026
    Message: The following boot-start or system-start driver(s) failed to load:
    AvgLdx86
    AvgMfx86
    spldr
    Wanarpv6
    Record Number: 116729
    Source Name: Service Control Manager
    Time Written: 20090812123736.000000-000
    Event Type: Error
    User:
    =====Application event log=====
    Computer Name: school-laptop
    Event Code: 6000
    Message: The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.
    Record Number: 34679
    Source Name: Microsoft-Windows-Winlogon
    Time Written: 20090812123336.000000-000
    Event Type: Warning
    User:
    Computer Name: school-laptop
    Event Code: 6000
    Message: The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.
    Record Number: 34682
    Source Name: Microsoft-Windows-Winlogon
    Time Written: 20090812123337.000000-000
    Event Type: Warning
    User:
    Computer Name: school-laptop
    Event Code: 6000
    Message: The winlogon notification subscriber <GPClient> was unavailable to handle a notification event.
    Record Number: 34688
    Source Name: Microsoft-Windows-Winlogon
    Time Written: 20090812123628.000000-000
    Event Type: Warning
    User:
    Computer Name: school-laptop
    Event Code: 4609
    Message: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043c from line 45 of d:\vista_gdr\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.
    Record Number: 34692
    Source Name: Microsoft-Windows-EventSystem
    Time Written: 20090812123657.000000-000
    Event Type: Error
    User:
    Computer Name: school-laptop
    Event Code: 4609
    Message: The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043c from line 45 of d:\vista_gdr\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.
    Record Number: 34694
    Source Name: Microsoft-Windows-EventSystem
    Time Written: 20090812124042.000000-000
    Event Type: Error
    User:
    =====Security event log=====
    Computer Name: school-laptop
    Event Code: 5032
    Message: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
    Error Code: 2
    Record Number: 34783
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090812123620.880690-000
    Event Type: Audit Failure
    User:
    Computer Name: school-laptop
    Event Code: 5032
    Message: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.
    Error Code: 2
    Record Number: 34784
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090812123620.880690-000
    Event Type: Audit Failure
    User:
    Computer Name: school-laptop
    Event Code: 4648
    Message: A logon was attempted using explicit credentials.
    Subject:
    Security ID: S-1-5-18
    Account Name: SCHOOL-LAPTOP$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Account Whose Credentials Were Used:
    Account Name: SCAN
    Account Domain: school-laptop
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Target Server:
    Target Server Name: localhost
    Additional Information: localhost
    Process Information:
    Process ID: 0x1d4
    Process Name: C:\Windows\System32\winlogon.exe
    Network Information:
    Network Address: 127.0.0.1
    Port: 0
    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
    Record Number: 34785
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090812123628.030920-000
    Event Type: Audit Success
    User:
    Computer Name: school-laptop
    Event Code: 4624
    Message: An account was successfully logged on.
    Subject:
    Security ID: S-1-5-18
    Account Name: SCHOOL-LAPTOP$
    Account Domain: WORKGROUP
    Logon ID: 0x3e7
    Logon Type: 2
    New Logon:
    Security ID: S-1-5-21-2109549730-1632380510-1684906914-1007
    Account Name: SCAN
    Account Domain: school-laptop
    Logon ID: 0x1de85
    Logon GUID: {00000000-0000-0000-0000-000000000000}
    Process Information:
    Process ID: 0x1d4
    Process Name: C:\Windows\System32\winlogon.exe
    Network Information:
    Workstation Name: SCHOOL-LAPTOP
    Source Network Address: 127.0.0.1
    Source Port: 0
    Detailed Authentication Information:
    Logon Process: User32
    Authentication Package: Negotiate
    Transited Services: -
    Package Name (NTLM only): -
    Key Length: 0
    This event is generated when a logon session is created. It is generated on the computer that was accessed.
    The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
    The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
    The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
    The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
    The authentication information fields provide detailed information about this specific logon request.
    - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
    Record Number: 34786
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090812123628.030920-000
    Event Type: Audit Success
    User:
    Computer Name: school-laptop
    Event Code: 4672
    Message: Special privileges assigned to new logon.
    Subject:
    Security ID: S-1-5-21-2109549730-1632380510-1684906914-1007
    Account Name: SCAN
    Account Domain: school-laptop
    Logon ID: 0x1de85
    Privileges: SeSecurityPrivilege
    SeBackupPrivilege
    SeRestorePrivilege
    SeTakeOwnershipPrivilege
    SeDebugPrivilege
    SeSystemEnvironmentPrivilege
    SeLoadDriverPrivilege
    SeImpersonatePrivilege
    Record Number: 34787
    Source Name: Microsoft-Windows-Security-Auditing
    Time Written: 20090812123628.030920-000
    Event Type: Audit Success
    User:
    ======Environment variables======
    "ComSpec"=%SystemRoot%\system32\cmd.exe
    "FP_NO_HOST_CHECK"=NO
    "OS"=Windows_NT
    "Path"=%CommonProgramFiles%\Microsoft Shared\Windows Live;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Microsoft SQL Server\90\Tools\binn\;C:\Program Files\QuickTime\QTSystem\
    "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    "PROCESSOR_ARCHITECTURE"=x86
    "TEMP"=%SystemRoot%\TEMP
    "TMP"=%SystemRoot%\TEMP
    "USERNAME"=SYSTEM
    "windir"=%SystemRoot%
    "PROCESSOR_LEVEL"=6
    "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 22 Stepping 1, GenuineIntel
    "PROCESSOR_REVISION"=1601
    "NUMBER_OF_PROCESSORS"=1
    "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
    "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
    "SAFEBOOT_OPTION"=NETWORK
    EOF
    ill post the gmer log soon
  • jumpstylerzjumpstylerz Member
    edited August 2009
    i cant get gmer to work it keeps crashing wenever i use it
  • edited August 2009
    Information

    IMPORTANT
    I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    LimeWire 4.16.6
    I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Also available here.

    My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
    Please note: you must NOT use any P2P whilst we are cleaning your machine.



    Step 1


    Malwarebytes' Anti-Malware

    Please download Malwarebytes' Anti-Malware to your desktop.

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to
      • Update Malwarebytes' Anti-Malware
      • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected.
    • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If requested, please reboot
      • If you accidently close it, the log file is saved here and will be named like this:
      • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt




    Step 2


    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply
    • Re-enable all the programs that were disabled during the running of ComboFix..



    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
    For instructions on how to disable your security programs, please see this topic
    How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs



    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    Some of the logs I request will be quite large, You may need to split them over a couple of replies.
    • MalwareBytes Log
    • Combofix Log
    • How are things running now ?








    Additional Notes



    Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

    Adobe Reader is a large program and uses unnecessary space.
    If you prefer a smaller program you can get Foxit 3.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended

    There is a newer version of Adobe Acrobat Reader available.
    • Please go to this link Adobe Acrobat Reader Download Link
    • Click Download
    • On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
    • Click the Continue button
    • Click Run, and click Run again
    • Next click the Install Now button and follow the on screen prompts




    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

    Please download Java SE Runtime Environment (JRE) . ( don't install it yet )
    • Scroll down to where it says "Java SE Runtime Environment (JRE)".
    • Click the "Download" button to the right.
      • Platform = Windows
      • Language = Multi Language
    • Check the box that says: "Accept License Agreement".
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.


    Now download JavaRa and unzip it to your desktop.

    ***Please close any instances of Internet Explorer (or other web browser) before continuing!***

    • Double-click on JavaRa.exe to start the program.
    • From the drop-down menu, choose English and click on Select.
    • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
    • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
    • A logfile will pop up. Please save it to a convenient location.


    Now install the Java SE Runtime Environment (JRE) package you downloaded
    (it comes with a toolbar pre-selected, so make sure you uncheck the box)

    You can delete JavaRa (zip and exe)
Sign In or Register to comment.