Go Back   Cyber Tech Help Support Forums > Operating Systems > Older Windows Versions > Windows Vista

Notices

Windows Vista Problem solving for the Windows Vista Operating System. Please remember to state which edition of Vista you are using - Home Basic, Home Premium, Business, Ultimate etc. and whether you are using the 32-bit or 64-bit version if you know.

Reply
 
Topic Tools
  #31  
Old April 14th, 2008, 12:09 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
Ok, when i went into safe mode i got a message saying windows explorer has stopped working and needs to close, it would not load the desktop.
Before your reply I copied and pasted these files from a working copy of Vista premium (my friends PC), this did not work either.
I am consisering doing a fresh installation of Vista to solve this, i have an upgrade disc that my friend has but my own version is OEM. The upgrade disc will not allow me to enter my OEM product key. Any ideas, i'm going mad!
Reply With Quote
  #32  
Old April 15th, 2008, 02:51 AM
AnnMarie's Avatar
AnnMarie AnnMarie is offline
CTH Subscriber
 
Join Date: Oct 2001
O/S: Windows Vista 32-bit
Location: New Zealand
Posts: 59,810
Quote:
i have an upgrade disc that my friend has but my own version is OEM. The upgrade disc will not allow me to enter my OEM product key. Any ideas, i'm going mad!
Yesterday 02:19 PM
You cant do this. You have to use the Recovery disks that were provided by the Manufacturer.
Reply With Quote
  #33  
Old April 15th, 2008, 06:52 AM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
Yes i thought this,unfortunately they didn't supply one, instead it came with instructions on how to create one. Foolishly i did not do this.
Is it possible to return a pc to Xp after a Vista upgrade? I still have the Xp disc. If so i can retrurn my friends pc to Xp (it's kinda mine anyway) and then use the Vista upgrade disc and product key that came with it to reinstall Vista on my own machine.
Reply With Quote
  #34  
Old April 15th, 2008, 07:26 AM
AnnMarie's Avatar
AnnMarie AnnMarie is offline
CTH Subscriber
 
Join Date: Oct 2001
O/S: Windows Vista 32-bit
Location: New Zealand
Posts: 59,810
Hmmm, you have a program installed called Smart Restore. Why dont you give Packard Bell a call and see if you can access this using your keyboard when you reboot.
Reply With Quote
  #35  
Old April 15th, 2008, 08:15 AM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
Oh my god i've done it!!!! I thought i'd just try booting from the Vista Upgrade disc and that allowed me to do a System restore. Please keep this forum open for me as i think i've got the Pop Up problems etc again and may need to refer to it.
MANY MANY THANKS FOR ALL YOUR HELP!!!!
Reply With Quote
  #36  
Old April 15th, 2008, 11:55 PM
AnnMarie's Avatar
AnnMarie AnnMarie is offline
CTH Subscriber
 
Join Date: Oct 2001
O/S: Windows Vista 32-bit
Location: New Zealand
Posts: 59,810
Ok, post back when you are ready. Now is the time to make your Recovery disks and learn about Smart Restore.
Reply With Quote
  #37  
Old April 16th, 2008, 07:37 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
Check this out for me please.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:25:10, on 16/04/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe
C:\Program Files\Common Files\aol\1183532771\ee\aolsoftware.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\UberIcon\UberIcon Manager.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\sw g.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [ZPLED] C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn.exe" /m=0
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZKfox000
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing)
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://www.gaydar.co.uk
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxbc_device - - C:\Windows\system32\lxbccoms.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 11600 bytes
Reply With Quote
  #38  
Old April 16th, 2008, 07:38 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
The Eset scanner was unable to remove 3 threats from MyWebSearch, it says the files are locked.
Reply With Quote
  #39  
Old April 16th, 2008, 11:11 PM
AnnMarie's Avatar
AnnMarie AnnMarie is offline
CTH Subscriber
 
Join Date: Oct 2001
O/S: Windows Vista 32-bit
Location: New Zealand
Posts: 59,810
Uninstall ComboFix. To do this, click on the Start button and type cmd.exe in the Start Search box. Rightclick on it and choose "Run as Administrator". Copy and paste the below string after the prompt>.

ComboFix /u

and hit Enter.

Download a fresh copy and run it. Post a new log and also tell me what problems you still have please.
Reply With Quote
  #40  
Old April 17th, 2008, 07:33 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
I did the above and it gave me the following

'Combofix' is not recognized as an internal or external command, operable program or batch file.

I deleted it from my Desktop and reinstalled.
I think all is ok unless you can spot anything.

ComboFix 08-04-16.5 - Simes 2008-04-17 18:59:43.4 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.328 [GMT 1:00]
Running from: C:\Users\Simes\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 )))))))))))))))))))))))))))))))
.

2008-04-16 18:38 . 2008-02-29 08:11 988,216 --a------ C:\Windows\System32\winload.exe
2008-04-16 18:38 . 2008-02-29 08:11 927,288 --a------ C:\Windows\System32\winresume.exe
2008-04-16 18:38 . 2008-02-22 06:05 615,992 --a------ C:\Windows\System32\ci.dll
2008-04-16 18:38 . 2008-02-29 07:53 378,368 --a------ C:\Windows\System32\srcore.dll
2008-04-16 18:38 . 2008-02-29 05:12 318,464 --a------ C:\Windows\System32\rstrui.exe
2008-04-16 18:38 . 2008-02-29 07:53 46,592 --a------ C:\Windows\System32\setbcdlocale.dll
2008-04-16 18:38 . 2008-02-29 07:53 40,960 --a------ C:\Windows\System32\srclient.dll
2008-04-16 18:38 . 2008-02-29 08:14 19,000 --a------ C:\Windows\System32\kd1394.dll
2008-04-16 18:38 . 2008-02-29 05:12 14,848 --a------ C:\Windows\System32\srdelayed.exe
2008-04-16 18:38 . 2008-02-29 07:35 6,656 --a------ C:\Windows\System32\kbd106n.dll
2008-04-16 18:24 . 2008-04-16 18:24 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-15 15:53 . 2008-04-15 15:53 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-04-15 15:51 . 2008-04-15 15:51 <DIR> d----c--- C:\Windows\System32\DRVSTORE
2008-04-15 15:51 . 2007-09-17 15:53 21,632 --a------ C:\Windows\System32\drivers\pccsmcfd.sys
2008-04-15 15:50 . 2008-04-15 15:51 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-04-15 08:43 . 2008-02-29 05:21 2,032,128 --a------ C:\Windows\System32\win32k.sys
2008-04-15 08:43 . 2008-02-22 05:57 295,936 --a------ C:\Windows\System32\gdi32.dll
2008-04-15 08:42 . 2008-02-22 03:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-15 08:42 . 2008-02-22 06:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-04-15 08:34 . 2008-04-15 08:34 21,936,640 --a------ C:\Windows\System32\imageres.dll
2008-04-15 08:07 . 2008-04-15 08:07 <DIR> d-------- C:\Users\Simes\AppData\Roaming\Grisoft
2008-04-15 08:07 . 2008-04-17 10:13 <DIR> d-------- C:\Users\All Users\Google Updater
2008-04-15 08:07 . 2008-04-17 10:13 <DIR> d-------- C:\ProgramData\Google Updater
2008-04-15 08:06 . 2008-03-29 18:31 75,856 --a------ C:\Windows\System32\drivers\aswSP.sys
2008-04-15 08:06 . 2008-03-29 18:35 20,560 --a------ C:\Windows\System32\drivers\aswFsBlk.sys
2008-04-15 08:06 . 2008-04-15 08:06 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_ 00.Wdf
2008-04-12 22:23 . 2008-04-13 02:04 32,768 --a------ C:\Windows\SPInstall.etl
2008-04-12 22:01 . 2008-04-12 22:06 <DIR> d-------- C:\Users\Simes\AppData\Roaming\RegistrySmart
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Videos
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Searches
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Saved Games
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Pictures
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Links
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Downloads
2008-04-12 12:11 . 2008-04-12 12:11 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents
2008-04-09 15:32 . 2008-04-09 15:32 <DIR> d-------- C:\Deckard
2008-04-09 02:42 . 2008-04-09 02:42 <DIR> d-------- C:\Users\All Users\eSellerate
2008-04-09 02:42 . 2008-04-09 02:42 <DIR> d-------- C:\ProgramData\eSellerate
2008-04-09 02:32 . 2008-04-13 01:03 <DIR> d-a------ C:\Users\All Users\TEMP
2008-04-09 02:32 . 2008-04-13 01:03 <DIR> d-a------ C:\ProgramData\TEMP
2008-04-09 02:32 . 2008-04-09 02:42 <DIR> d-------- C:\Program Files\1 Click PC Fix
2008-03-30 10:45 . 2008-03-30 10:45 <DIR> d-------- C:\PerfLogs
2008-03-30 10:12 . 2008-01-19 08:43 3,600,440 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-03-30 10:12 . 2008-01-19 08:33 2,623,488 --a------ C:\Windows\System32\SLsvc.exe
2008-03-30 10:12 . 2008-01-19 08:36 1,541,120 --a------ C:\Windows\System32\onex.dll
2008-03-30 10:12 . 2008-01-19 08:43 266,808 --a------ C:\Windows\System32\drivers\acpi.sys
2008-03-30 10:12 . 2008-01-19 08:42 151,096 --a------ C:\Windows\System32\drivers\pci.sys
2008-03-30 10:12 . 2008-01-19 08:42 51,768 --a------ C:\Windows\System32\PSHED.DLL
2008-03-30 10:10 . 2008-01-19 08:35 4,875,776 --a------ C:\Windows\System32\NlsData0009.dll
2008-03-30 10:09 . 2008-01-19 08:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-03-30 10:08 . 2008-01-19 08:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-03-30 10:07 . 2008-01-19 07:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-03-26 16:20 . 2008-04-09 00:35 <DIR> d-------- C:\nav-update
2008-03-25 22:48 . 2008-04-17 13:13 12 --a------ C:\Windows\bthservsdp.dat
2008-03-20 14:04 . 2008-03-20 20:07 <DIR> d-------- C:\Users\All Users\SITEguard
2008-03-20 14:04 . 2008-03-20 20:07 <DIR> d-------- C:\ProgramData\SITEguard
2008-03-20 14:00 . 2008-03-20 20:41 <DIR> d-------- C:\Users\All Users\STOPzilla!
2008-03-20 14:00 . 2008-03-20 20:41 <DIR> d-------- C:\ProgramData\STOPzilla!
2008-03-20 14:00 . 2008-03-20 14:00 <DIR> d-------- C:\Program Files\Common Files\iS3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-04-15 15:40 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-15 15:40 --------- d-----w C:\Users\Vile\AppData\Roaming\uTorrent
2008-04-15 15:40 --------- d-----w C:\Users\Vile\AppData\Roaming\AVG7
2008-04-15 15:40 --------- d-----w C:\Users\Simes\AppData\Roaming\uTorrent
2008-04-15 15:40 --------- d-----w C:\Users\Simes\AppData\Roaming\IcoFX
2008-04-15 15:40 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-04-15 15:40 --------- d-----w C:\Program Files\Windows Live Favorites
2008-04-15 15:40 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-04-15 15:40 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-04-15 15:31 --------- d-----w C:\ProgramData\Viewpoint
2008-04-15 15:30 --------- d-----w C:\Program Files\Viewpoint
2008-04-15 15:30 --------- d-----w C:\Program Files\Roxio
2008-04-15 15:28 --------- d-----w C:\Program Files\Common Files\Apple
2008-04-15 15:18 --------- d-----w C:\Program Files\Windows Mail
2008-04-15 15:15 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-15 14:53 --------- d-----w C:\Program Files\Nokia
2008-04-15 14:53 --------- d-----w C:\Program Files\Common Files\Nokia
2008-04-15 14:46 --------- d-----w C:\ProgramData\Installations
2008-04-13 07:42 --------- d-----w C:\Program Files\Common Files\Stardock
2008-04-12 11:30 --------- d-----w C:\Program Files\Windows Live
2008-04-12 11:30 --------- d-----w C:\Program Files\Packard Bell
2008-04-12 11:17 --------- d-----w C:\ProgramData\Roxio
2008-04-12 11:17 --------- d-----w C:\Program Files\Common Files\Roxio Shared
2008-04-12 11:10 --------- d-----w C:\Program Files\Google
2008-04-01 03:37 --------- d-----w C:\Program Files\Java
2008-03-30 12:32 --------- d-----w C:\ProgramData\NVIDIA
2008-03-30 09:56 174 --sha-w C:\Program Files\desktop.ini
2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Sidebar
2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Journal
2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Defender
2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Collaboration
2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Calendar
2008-03-30 09:25 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-03-30 09:25 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-03-29 17:45 1,146,232 ----a-w C:\Windows\System32\aswBoot.exe
2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-03-29 17:29 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\Windows\system32\drivers\aswTdi.sys
2008-03-29 17:23 95,608 ----a-w C:\Windows\System32\AvastSS.scr
2008-03-11 20:27 --------- d-----w C:\Users\Simes\AppData\Roaming\LimeWire
2008-03-11 14:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-11 09:52 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-11 09:42 --------- d-----w C:\ProgramData\WLInstaller
2008-03-05 07:59 --------- d-----w C:\ProgramData\Windows Live Toolbar
2008-02-25 18:21 --------- d-----w C:\Program Files\iTunes
2008-02-25 18:21 --------- d-----w C:\Program Files\iPod
2008-02-25 18:19 --------- d-----w C:\Program Files\QuickTime
2008-02-24 17:01 --------- d-----w C:\Program Files\LimeWire
2008-02-20 08:31 69,414 ----a-w C:\Windows\System32\uninst.exe
2008-02-20 08:31 --------- d-----w C:\Program Files\Shutdown Logoff Reboot ActiveX
2008-02-17 20:33 --------- d-----w C:\Program Files\AOL 9.0 VR
2008-02-17 19:03 --------- d-----w C:\ProgramData\Avg7
2008-02-17 19:00 --------- d-----w C:\Program Files\Alwil Software
2008-02-11 08:39 253,952 ----a-w C:\Windows\System32\OnlineScannerDLLA.dll
2008-02-11 08:39 237,568 ----a-w C:\Windows\System32\OnlineScannerDLLW.dll
2008-02-08 12:53 110,592 ----a-w C:\Windows\System32\OnlineScannerLang.dll
2008-02-05 07:48 77,824 ----a-w C:\Windows\System32\OnlineScannerUninstaller.exe
2008-02-01 11:11 586,240 ----a-w C:\Windows\WLXPGSS.SCR
2008-01-19 07:43 376,376 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-01-19 07:43 3,548,728 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-01-19 07:42 94,776 ----a-w C:\Windows\System32\MigAutoPlay.exe
2008-01-19 07:42 247,352 ----a-w C:\Windows\System32\clfs.sys
2008-01-19 07:42 177,208 ----a-w C:\Windows\System32\halmacpi.dll
2008-01-19 07:42 141,880 ----a-w C:\Windows\System32\halacpi.dll
2008-01-19 07:41 24,120 ----a-w C:\Windows\System32\BOOTVID.DLL
2008-01-19 07:41 21,560 ----a-w C:\Windows\System32\kdusb.dll
2008-01-19 07:41 19,512 ----a-w C:\Windows\System32\kdcom.dll
2008-01-19 07:38 46,080 ----a-w C:\Windows\System32\NAPCRYPT.DLL
2008-01-19 07:38 4,595,712 ----a-w C:\Windows\System32\AuthFWSnapin.dll
2008-01-19 07:38 242,744 ----a-w C:\Windows\System32\rsaenh.dll
2008-01-19 07:38 155,704 ----a-w C:\Windows\System32\dssenh.dll
2008-01-19 07:38 131,640 ----a-w C:\Windows\System32\basecsp.dll
2008-01-19 07:38 103,936 ----a-w C:\Windows\System32\NAPHLPR.DLL
2008-01-19 07:38 1,203,792 ----a-w C:\Windows\System32\ntdll.dll
2008-01-19 07:36 996,352 ----a-w C:\Windows\System32\WMNetMgr.dll
2008-01-19 07:35 98,304 ----a-w C:\Windows\System32\mssitlb.dll
2008-01-19 07:34 98,816 ----a-w C:\Windows\System32\mfps.dll
2008-01-19 07:33 98,304 ----a-w C:\Windows\System32\makecab.exe
2008-01-19 07:32 879,616 ----a-w C:\Windows\System32\Bubbles.scr
2008-01-19 07:32 704,512 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-01-19 07:32 5,714,432 ----a-w C:\Windows\System32\logon.scr
2008-01-19 07:32 258,048 ----a-w C:\Windows\System32\winspool.drv
2008-01-19 07:32 221,184 ----a-w C:\Windows\System32\Mystify.scr
2008-01-19 07:32 220,672 ----a-w C:\Windows\System32\Ribbons.scr
2008-01-19 07:32 21,504 ----a-w C:\Windows\System32\msacm32.drv
2008-01-19 07:32 166,912 ----a-w C:\Windows\System32\wdmaud.drv
2008-01-19 07:32 1,370,624 ----a-w C:\Windows\System32\Aurora.scr
2008-01-19 07:31 7,680 ----a-w C:\Windows\System32\spwizres.dll
2008-01-19 07:31 57,856 ----a-w C:\Windows\System32\nlsbres.dll
2008-01-19 07:31 118,272 ----a-w C:\Windows\System32\RDPENCDD.dll
2008-01-19 07:30 17,920 ----a-w C:\Windows\System32\netevent.dll
2008-01-19 07:29 705,536 ----a-w C:\Windows\System32\imagesp1.dll
2008-01-19 07:29 58,880 ----a-w C:\Windows\System32\msobjs.dll
2008-01-19 07:28 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll
2008-01-19 07:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-01-19 06:01 14,336 ----a-w C:\Windows\System32\tsddd.dll
2008-01-19 06:01 134,656 ----a-w C:\Windows\System32\rdpdd.dll
2008-01-19 05:52 56,320 ----a-w C:\Windows\System32\vga256.dll
2008-01-19 05:52 21,504 ----a-w C:\Windows\System32\vga64k.dll
.
Reply With Quote
  #41  
Old April 17th, 2008, 07:36 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
((((((((((((((((((((((((((((( snapshot_2008-04-16_18.39.51.64 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-16 17:17:39 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-04-17 17:05:30 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-03-30 09:45:55 665,600 ----a-w C:\Windows\inf\drvindex.dat
+ 2008-04-17 04:47:57 665,600 ----a-w C:\Windows\inf\drvindex.dat
- 2008-04-15 14:54:56 51,200 ----a-w C:\Windows\inf\infpub.dat
+ 2008-04-17 04:48:05 51,200 ----a-w C:\Windows\inf\infpub.dat
- 2008-04-15 14:54:56 86,016 ----a-w C:\Windows\inf\infstor.dat
+ 2008-04-17 04:48:05 86,016 ----a-w C:\Windows\inf\infstor.dat
- 2008-04-15 14:54:55 143,360 ----a-w C:\Windows\inf\infstrng.dat
+ 2008-04-17 04:47:57 143,360 ----a-w C:\Windows\inf\infstrng.dat
- 2008-04-16 17:17:40 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
+ 2008-04-17 17:05:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive0.dat
- 2008-04-16 17:17:40 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
+ 2008-04-17 17:05:31 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\lastalive1.dat
- 2008-04-16 17:20:11 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\Microsoft\Windows\UsrClass.dat
+ 2008-04-17 17:48:06 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\Microsoft\Windows\UsrClass.dat
- 2008-04-16 17:19:15 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-04-17 17:07:27 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat
+ 2008-04-17 17:07:27 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat .LOG1
- 2008-04-16 17:29:52 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Local\Microsoft\Windows\UsrClass.dat
+ 2008-04-17 18:00:06 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Local\Microsoft\Windows\UsrClass.dat
- 2008-04-16 17:18:37 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.d at
+ 2008-04-17 17:07:44 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.d at
+ 2008-04-17 17:07:44 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.d at.LOG1
- 2008-01-19 07:44:08 986,680 ----a-w C:\Windows\System32\Boot\winload.exe
+ 2008-02-29 07:11:54 988,216 ----a-w C:\Windows\System32\Boot\winload.exe
- 2008-01-19 07:44:06 926,776 ----a-w C:\Windows\System32\Boot\winresume.exe
+ 2008-02-29 07:11:56 927,288 ----a-w C:\Windows\System32\Boot\winresume.exe
- 2008-04-16 17:18:28 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at
+ 2008-04-17 17:07:43 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at
- 2008-04-16 17:18:28 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-17 17:07:43 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-04-16 17:18:28 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat
+ 2008-04-17 17:07:43 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat
- 2008-04-15 15:41:45 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.da t
+ 2008-04-17 17:31:41 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.da t
+ 2008-04-17 17:31:41 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.da t.LOG1
- 2008-04-16 17:22:20 108,606 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-04-17 17:09:57 109,138 ----a-w C:\Windows\System32\perfc009.dat
- 2008-04-16 17:22:20 607,738 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-04-17 17:09:57 608,270 ----a-w C:\Windows\System32\perfh009.dat
- 2008-04-16 17:36:01 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat
+ 2008-04-17 12:13:53 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat
- 2008-04-16 17:19:36 10,010 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1821962517-124290910-3490180065-1003_UserData.bin
+ 2008-04-17 17:08:41 10,018 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1821962517-124290910-3490180065-1003_UserData.bin
- 2008-04-16 17:19:36 67,062 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics _SystemData.bin
+ 2008-04-17 17:08:39 67,062 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics _SystemData.bin
- 2008-04-13 01:04:42 2,640 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-04-16 20:00:22 2,640 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-04-16 17:19:34 59,220 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnos tics_SystemData.bin
+ 2008-04-17 04:39:46 59,236 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnos tics_SystemData.bin
- 2008-04-16 17:36:00 2,775,754 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001 c50b5_blobs.bin
+ 2008-04-17 04:48:10 3,275,221 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001 c50b5_blobs.bin
+ 2008-02-29 06:53:29 46,592 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6001.18027_none_6929f 9588cd4875c\setbcdlocale.dll
+ 2008-02-29 07:11:54 988,216 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6001.18027_none_6929f 9588cd4875c\winload.exe
+ 2008-02-29 07:11:56 927,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6001.18027_none_6929f 9588cd4875c\winresume.exe
+ 2008-02-29 06:37:41 46,592 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6001.22125_none_69b19 58fa5f3f478\setbcdlocale.dll
+ 2008-02-29 07:02:42 988,216 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6001.22125_none_69b19 58fa5f3f478\winload.exe
+ 2008-02-29 07:02:41 927,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.0.6001.22125_none_69b19 58fa5f3f478\winresume.exe
+ 2008-02-29 06:51:24 19,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..uggertransport-1394_31bf3856ad364e35_6.0.6000.16646_none_61bfda98 f6d6f5d5\kd1394.dll
+ 2008-02-29 06:54:17 19,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..uggertransport-1394_31bf3856ad364e35_6.0.6000.20782_none_621a368c 1018a007\kd1394.dll
+ 2008-02-29 07:14:21 19,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..uggertransport-1394_31bf3856ad364e35_6.0.6001.18027_none_63bcb960 f3ec683b\kd1394.dll
+ 2008-02-29 06:57:07 19,000 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..uggertransport-1394_31bf3856ad364e35_6.0.6001.22125_none_64445598 0d0bd557\kd1394.dll
+ 2008-02-14 23:19:24 944,184 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6000.16646_none_591b3d 986f9b5725\winload.exe
+ 2008-02-14 23:13:10 944,696 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6000.20782_none_597599 8b88dd0157\winload.exe
+ 2008-02-29 07:11:54 988,216 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6001.18027_none_5b181c 606cb0c98b\winload.exe
+ 2008-02-29 07:11:56 927,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6001.18027_none_5b181c 606cb0c98b\winresume.exe
+ 2008-02-29 07:02:42 988,216 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6001.22125_none_5b9fb8 9785d036a7\winload.exe
+ 2008-02-29 07:02:41 927,288 ----a-w C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.0.6001.22125_none_5b9fb8 9785d036a7\winresume.exe
+ 2008-02-19 05:10:22 620,088 ----a-w C:\Windows\winsxs\x86_microsoft-windows-codeintegrity_31bf3856ad364e35_6.0.6000.16642_none _9e68737c07b7f5c7\ci.dll
+ 2008-02-19 04:54:56 620,088 ----a-w C:\Windows\winsxs\x86_microsoft-windows-codeintegrity_31bf3856ad364e35_6.0.6000.20775_none _9ed4a16120eb3569\ci.dll
+ 2008-02-22 05:05:52 615,992 ----a-w C:\Windows\winsxs\x86_microsoft-windows-codeintegrity_31bf3856ad364e35_6.0.6001.18023_none _a065524404cd682d\ci.dll
+ 2008-02-22 04:57:25 615,992 ----a-w C:\Windows\winsxs\x86_microsoft-windows-codeintegrity_31bf3856ad364e35_6.0.6001.22120_none _a0ebee311dedbbf2\ci.dll
+ 2008-02-29 06:34:50 7,168 ----a-w C:\Windows\winsxs\x86_microsoft-windows-i..humb-shift_keyboard_31bf3856ad364e35_6.0.6000.16646_non e_ebb5eec692f230bc\f3ahvoas.dll
+ 2008-02-29 06:30:51 7,168 ----a-w C:\Windows\winsxs\x86_microsoft-windows-i..humb-shift_keyboard_31bf3856ad364e35_6.0.6000.20782_non e_ec104ab9ac33daee\f3ahvoas.dll
+ 2008-02-29 06:35:17 6,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-i..rd-japanese_106_key_31bf3856ad364e35_6.0.6000.16646_n one_dafbedd9168fe683\kbd106n.dll
+ 2008-02-29 06:31:23 6,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-i..rd-japanese_106_key_31bf3856ad364e35_6.0.6000.20782_n one_db5649cc2fd190b5\kbd106n.dll
+ 2008-02-29 06:38:54 313,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.16646_none_44d4534d b6337506\rstrui.exe
+ 2008-02-29 06:39:13 40,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.16646_none_44d4534d b6337506\srclient.dll
+ 2008-02-29 06:39:13 371,712 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.16646_none_44d4534d b6337506\srcore.dll
+ 2008-02-29 06:38:59 16,384 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.16646_none_44d4534d b6337506\srdelayed.exe
+ 2008-02-29 04:05:40 313,856 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.20782_none_452eaf40 cf751f38\rstrui.exe
+ 2008-02-29 06:33:44 40,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.20782_none_452eaf40 cf751f38\srclient.dll
+ 2008-02-29 06:33:44 371,712 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.20782_none_452eaf40 cf751f38\srcore.dll
+ 2008-02-29 04:05:32 16,384 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6000.20782_none_452eaf40 cf751f38\srdelayed.exe
+ 2008-02-29 04:12:59 318,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.18027_none_46d13215 b348e76c\rstrui.exe
+ 2008-02-29 06:53:38 40,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.18027_none_46d13215 b348e76c\srclient.dll
+ 2008-02-29 06:53:39 378,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.18027_none_46d13215 b348e76c\srcore.dll
+ 2008-02-29 04:12:53 14,848 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.18027_none_46d13215 b348e76c\srdelayed.exe
+ 2008-02-29 04:06:52 318,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.22125_none_4758ce4c cc685488\rstrui.exe
+ 2008-02-29 06:37:51 40,960 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.22125_none_4758ce4c cc685488\srclient.dll
+ 2008-02-29 06:37:51 378,368 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.22125_none_4758ce4c cc685488\srcore.dll
+ 2008-02-29 04:06:46 14,848 ----a-w C:\Windows\winsxs\x86_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.0.6001.22125_none_4758ce4c cc685488\srdelayed.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Reply With Quote
  #42  
Old April 17th, 2008, 07:36 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-08-27 21:27 68856]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2007-08-17 19:10 159744]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 08:38 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 10:57 3784704 C:\Windows\RtHDVCpl.exe]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 06:28 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 06:28 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [2007-09-12 06:28 81920]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 11:40 232184]
"ZPLED"="C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe" [2006-02-21 07:36 347648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"HostManager"="C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe" [2006-11-14 15:01 50736]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 16:06 2027792]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 16:02 563984]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\Users\Vile\AppData\Roaming\Microsoft\Windows\St art Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM 3450608]

C:\Users\Simes\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM 3450608]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [8/27/2007 9:27:36 PM 124912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~2\WINDOW~1\wbsrv.dll 2008-01-14 21:13 210168 C:\PROGRA~1\Stardock\OBJECT~2\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules]
"{F1A39805-9129-40C9-9D62-1F089F28431E}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler
"{E5E6C791-A413-4093-94AA-4D9743A21AAB}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler
"{1F265EE6-34B0-446D-8D19-9BFF18E93194}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services
"{3083F52B-8100-4B16-BF34-0D0A8958299F}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services
"{84C9B841-D3C4-4E4B-8D52-006D997A56AE}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{57BAACD9-725C-4F6C-8723-77CC78923AF0}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{34D7DF6C-945E-4FDD-B57E-E2B94D75DE65}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{D01EEF7D-3F5F-4244-81EE-504CF62B3607}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{323ADFCA-8888-452F-894C-54CCF5475F79}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{EC5F4FA8-7167-4279-9372-385EE4D1A473}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{D4341B99-BD29-4B6F-B766-0BA7C84893A7}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{C2E5407B-81A6-4D0F-A46B-0EFE7D27E251}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{0144BEC3-8707-4D02-81D2-C6BB9906EC26}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{42E1FA8D-1CE7-4936-8F85-06714C0CCF56}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{FA70FEBB-B1A0-44C5-9F77-E34C700AC627}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxb cpswx.exe:Printer Status Window
"{DA10CEF0-1668-4EC9-AC67-517F03AE8832}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxb cpswx.exe:Printer Status Window
"{7DBAD7E5-DAED-428A-A8C3-5E38247F45FE}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{F301911F-B415-4521-AA57-51EA3427D064}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{ADDCE154-83EA-40F3-B2F5-C398B2C956B8}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{00ACE8CA-D4FB-42DC-B417-49A1F4EAC79A}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{0E44B8C6-8507-4021-BF36-D29CDE1D6993}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{12D6D331-8B61-4FB6-82CB-C3AD61F75A24}"= UDP:C:\Windows\System32\lxbccoms.exe:Lexmark Communications System
"{92F066A9-4A09-406A-9E33-0A146D616E5D}"= TCP:C:\Windows\System32\lxbccoms.exe:Lexmark Communications System
"TCP Query User{99AECBDB-9C23-44BF-B951-5ED1740E949B}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{8737DD94-9CB7-495E-87A2-FE02B57C1CEE}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{60A78BBC-32B6-4774-A4F4-66467E8137A6}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{A824382E-3020-4DAA-B067-E3A5FD242B60}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"{BB7EB973-27CE-48B5-807E-992C2B65D7D3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{B1A5FAD4-B536-47AF-B66D-DB4080FD0815}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{24A6AD5F-D4F1-4FD3-BA8D-54108510609B}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{4973EB2A-6E3A-4C77-BC52-F36A8E152419}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E1C61C59-BA73-4FCB-AD7E-EA77F2385FB5}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{2CD5A0BA-DC6E-4D00-9A83-190B6869D80D}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{FF9CD70E-7325-4B40-A7E5-06200E20886F}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{53280BDD-9CF8-42EC-A2C6-5EA0E4D94134}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{8AE1A76F-17B6-4574-9A51-C3A75B49EE2F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7195D617-C04F-43E1-8DDF-1C876BDFF5A0}C:\\users\\simes\\appdata\\local\\tem p\\wzse0.tmp\\symnrt.exe"= UDP:C:\users\simes\appdata\local\temp\wzse0.tmp\sy mnrt.exe:symnrt.exe
"UDP Query User{DC382C8D-388C-4E3A-AE2D-8BEC53C6B395}C:\\users\\simes\\appdata\\local\\tem p\\wzse0.tmp\\symnrt.exe"= TCP:C:\users\simes\appdata\local\temp\wzse0.tmp\sy mnrt.exe:symnrt.exe

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\StandardProfile\GloballyOpenPorts\List]
"123:UDP"= 123:UDP:*:Enabled:NTP

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 18:31]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswF sBlk.sys [2008-03-29 18:35]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\as wMonFlt.sys [2008-03-29 18:32]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2008-01-02 03:12]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{17eb75ee-5582-11dc-a2ed-00038a000015}]
\shell\AutoRun\command - I:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2008-04-17 17:32:11 C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-03-31 19:00:00 C:\Windows\Tasks\Norton Security Online - Run Full System Scan - Simes.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeB/TASK:
"2008-04-17 18:00:00 C:\Windows\Tasks\Recovery DVD Creator.job"
- C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe
.
************************************************** ************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 19:03:16
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
-> C:\Program Files\UberIcon\UberIcon.dll
.
Completion time: 2008-04-17 19:10:44
ComboFix-quarantined-files.txt 2008-04-17 18:09:16
ComboFix2.txt 2008-04-16 17:40:26
ComboFix3.txt 2008-04-16 17:13:10
ComboFix4.txt 2008-04-11 17:30:03
ComboFix5.txt 2008-04-11 05:53:36

Pre-Run: 173,188,866,048 bytes free
Post-Run: 173,152,935,936 bytes free
.
2008-04-17 04:42:39 --- E O F ---
Reply With Quote
  #43  
Old April 17th, 2008, 10:29 PM
AnnMarie's Avatar
AnnMarie AnnMarie is offline
CTH Subscriber
 
Join Date: Oct 2001
O/S: Windows Vista 32-bit
Location: New Zealand
Posts: 59,810
Yes that log looks fine. There were My Web Search startups showing in Hijack This. Did you get rid of the entries? Are you still getting popups?
Reply With Quote
  #44  
Old April 18th, 2008, 06:51 PM
simespsb simespsb is offline
Member
 
Join Date: Apr 2008
Posts: 34
Not sure what happened to the MyWebSearch entries, but the pop ups have gone. Many thanks again for your support.
Reply With Quote
  #45  
Old April 19th, 2008, 12:39 AM
AnnMarie's Avatar
AnnMarie AnnMarie is offline
CTH Subscriber
 
Join Date: Oct 2001
O/S: Windows Vista 32-bit
Location: New Zealand
Posts: 59,810
You are welcome.
Reply With Quote
Reply

Bookmarks

Topic Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Topics
Topic Topic Starter Forum Replies Last Post
rundll32 error Total Noob Windows Vista 1 December 20th, 2016 05:39 PM
Rundll32.exe Error and More. Nicholas_Roge Malware Removal 7 June 6th, 2008 04:16 AM
Error for rundll32.exe BoBrooke Windows XP 3 March 5th, 2007 05:41 PM
16 bit MS DOS & Rundll32 error richie1242 Windows XP 0 July 27th, 2004 03:51 AM
Rundll32.exe error HELP Johnny K Windows XP 0 May 12th, 2004 11:10 PM


All times are GMT +1. The time now is 05:44 AM.