|
|||||||
| Windows Vista Problem solving for the Windows Vista Operating System. Please remember to state which edition of Vista you are using - Home Basic, Home Premium, Business, Ultimate etc. and whether you are using the 32-bit or 64-bit version if you know. |
 |
|
|
Topic Tools |
|
#1
April 9th, 2008, 03:29 AM
|
|||
|
|||
Rundll32 error
Using Vista Home Premium 32 bit. I seem to have acquired something nasty on my system that has changed my taskbar and menus to Windows Classic. When I go to Personalize and try to change appearance etc I get an error saying Rundll32 has stopped working. I've seen from Google that I can add the line drivers=mmsystem.dll to the system registry to fix this but I do not know where exactly to put this. I am also unable to perform a system restore. Also I'm getting loads of Flash pop ups lately. Please someone help, I've never had so many problems!
|
|
#2
April 9th, 2008, 07:34 AM
|
||||
|
||||
|
Hi simespsb. Let see what is running on your computer. Download Deckard's System Scanner (dss.exe) from here to your Desktop. Close all open applications and windows, doubleclick on dss.exe to run it and follow the prompts.
When the scan is complete, a text file will open. Copy and paste the contents of this log (Main.txt) in your next reply. Also post the contents of Extra.txt (it should be minimised on your taskbar but if not, it can be found in the C:\Deckard\System Scanner folder). You may find that the maximum characters allowed is exceeded when you post. If so, halve the logs and make several posts.
|
|
#3
April 9th, 2008, 03:50 PM
|
|||
|
|||
|
Here's the info from DSS scanner main.txt
Deckard's System Scanner v20071014.68
Run by Simes on 2008-04-09 15:33:06 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 5 Restore Point(s) -- 19: 2008-04-09 00:52:00 UTC - RP314 - Restore Operation 18: 2008-04-09 00:31:53 UTC - RP313 - Restore Operation 17: 2008-04-09 00:21:02 UTC - RP312 - Restore Operation 16: 2008-04-09 00:03:45 UTC - RP311 - Windows Update 15: 2008-04-08 23:46:31 UTC - RP310 - Removed Bonjour -- First Restore Point -- 1: 2008-03-30 09:18:25 UTC - RP296 - Windows Vista Service Pack 1 Backed up registry hives. Performed disk cleanup. Percentage of Memory in Use: 77% (more than 75%). Total Physical Memory: 1022 MiB (1024 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-04-09 15:38:36 Platform: Windows Vista Service Pack 1 (6.00.6001) MSIE: Internet Explorer (7.00.6000.16386) Boot mode: Normal Running processes: C:\Windows\System32\taskeng.exe C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe C:\Windows\explorer.exe C:\Windows\System32\dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\aol\1183532771\ee\aolsoftware.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\MyWebSearch\bar\5.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\5.bin\M3SRCHMN.EXE C:\Windows\WindowsMobile\wmdc.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\UberIcon\UberIcon Manager.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Windows\System32\wbem\unsecapp.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Common Files\microsoft shared\Windows Live\WLLoginProxy.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe C:\Users\Simes\AppData\Local\ucwcydlen.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Simes\Desktop\dss.exe C:\Windows\System32\conime.exe C:\Windows\System32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\sw g.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ZPLED] C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.exe O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn.exe" /m=0 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [ucwcydlen] c:\users\simes\appdata\local\ucwcydlen.exe ucwcydlen O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user') O4 - Startup: Stardock ObjectDock.lnk = ? O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZKfox000 O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing) O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing) O9 - Extra button: (no name) - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O15 - Trusted Zone: http://www.gaydar.co.uk (HKCU) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\logishrd\SrvLnch\SrvLnch.exe O23 - Service: lxbc_device - Unknown owner - C:\Windows\System32\lxbccoms.exe O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\Program Files\MyWebSearch\bar\5.bin\MWSSVC.EXE O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 13152 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- All drivers whitelisted. -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 MyWebSearchService (My Web Search Service) - c:\progra~1\mywebs~1\bar\5.bin\mwssvc.exe <Not Verified; MyWebSearch.com; My Web Search Bar> R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe S3 stllssvr - "c:\program files\common files\surething shared\stllssvr.exe" <Not Verified; MicroVision Development, Inc.; SureThing CD Labeler> S3 Symantec Core LC - "c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe" (file missing) -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {6bdd1fc5-810f-11d0-bec7-08002be2092f} Description: Serial Cable using IrDA Protocol Device ID: ROOT\UNKNOWN\0000 Manufacturer: (Standard Infrared Port) Name: Serial Cable using IrDA Protocol PNP Device ID: ROOT\UNKNOWN\0000 Service: irsir Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia Windows Portable Device Driver PNP Device ID: ROOT\WPD\0000 Service: WUDFRd Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0001 Manufacturer: Nokia Name: Nokia Windows Portable Device Driver PNP Device ID: ROOT\WPD\0001 Service: WUDFRd Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0002 Manufacturer: Nokia Name: Nokia 5300 PNP Device ID: ROOT\WPD\0002 Service: WUDFRd Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0003 Manufacturer: Nokia Name: Nokia 5310 XpressMusic PNP Device ID: ROOT\WPD\0003 Service: WUDFRd -- Scheduled Tasks ------------------------------------------------------------- 2008-04-09 15:32:00 356 --a------ C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job 2008-04-09 15:30:00 354 --a------ C:\Windows\Tasks\Recovery DVD Creator.job 2008-04-07 20:00:01 500 --a------ C:\Windows\Tasks\Norton Security Online - Run Full System Scan - Simes.job -- Files created between 2008-03-09 and 2008-04-09 ----------------------------- 2008-04-09 03:08:55 0 -rahs---- C:\MSDOS.SYS 2008-04-09 03:08:55 0 -rahs---- C:\IO.SYS 2008-04-09 02:42:31 0 d-------- C:\Users\All Users\eSellerate 2008-04-09 02:32:49 0 d-------- C:\Users\All Users\TEMP 2008-04-09 02:32:46 494352 --a------ C:\Windows\system32\SHDOC401.DLL <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> 2008-04-09 02:32:46 53248 --a------ C:\Windows\system32\ArmAccess.dll 2008-04-09 02:32:45 0 d-------- C:\Program Files\1 Click PC Fix 2008-04-08 23:58:53 2560 --a------ C:\Windows\_MSRSTRT.EXE 2008-03-31 19:34:08 0 d-------- C:\Program Files\Safari 2008-03-30 10:45:59 0 d-------- C:\PerfLogs 2008-03-30 10:10:14 240640 --a------ C:\Windows\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-30 10:09:08 615424 --a------ C:\Windows\system32\themeui.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-26 16:20:25 0 d-------- C:\nav-update 2008-03-25 22:48:46 12 --a------ C:\Windows\bthservsdp.dat 2008-03-20 14:04:08 0 d-------- C:\Users\All Users\SITEguard 2008-03-20 14:00:32 0 d-------- C:\Program Files\Common Files\iS3 2008-03-20 14:00:28 0 d-------- C:\Users\All Users\STOPzilla! 2008-03-16 17:09:48 0 d-------- C:\Program Files\MessengerSkinner 2008-03-11 15:52:28 0 d-------- C:\Program Files\Common Files\Adobe 2008-03-11 10:52:44 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-03-11 10:50:53 0 d-------- C:\Program Files\Windows Live Favorites 2008-03-11 10:43:52 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
|
|
#4
April 9th, 2008, 03:51 PM
|
|||
|
|||
|
main.txt (2)
-- Find3M Report ---------------------------------------------------------------
2008-04-09 01:58:20 0 d-------- C:\Program Files\Windows Mail 2008-04-09 00:32:59 21936640 --a------ C:\Windows\system32\imageres.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-04-01 04:37:05 0 d-------- C:\Program Files\Java 2008-03-30 10:56:14 174 --ahs---- C:\Program Files\desktop.ini 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Sidebar 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Collaboration 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Calendar 2008-03-30 10:46:50 0 d-------- C:\Program Files\Movie Maker 2008-03-30 10:46:49 0 d-------- C:\Program Files\Windows Photo Gallery 2008-03-30 10:46:49 0 d-------- C:\Program Files\Windows Journal 2008-03-30 10:46:48 0 d-------- C:\Program Files\Windows Defender 2008-03-20 14:00:32 0 d-------- C:\Program Files\Common Files 2008-03-16 17:10:19 0 d-------- C:\Users\Simes\AppData\Roaming\MessengerSkinner 2008-03-15 01:42:48 0 d-------- C:\Program Files\Windows Live 2008-03-13 00:34:58 0 d-------- C:\Users\Simes\AppData\Roaming\uTorrent 2008-03-11 21:27:34 0 d-------- C:\Users\Simes\AppData\Roaming\LimeWire 2008-03-11 10:52:18 0 d-------- C:\Program Files\Windows Live Toolbar 2008-03-06 23:40:48 0 d-------- C:\Program Files\Microsoft Silverlight 2008-03-05 08:58:25 28672 --a------ C:\Windows\system32\f3PSSavr.scr <Not Verified; FunWebProducts.com; Popular Screensavers> 2008-03-05 08:51:26 0 d-------- C:\Program Files\MyWebSearch 2008-03-05 08:51:22 0 d-------- C:\Program Files\FunWebProducts 2008-02-26 14:25:50 0 d-------- C:\Users\Simes\AppData\Roaming\Adobe 2008-02-25 19:21:35 0 d-------- C:\Program Files\iTunes 2008-02-25 19:21:25 0 d-------- C:\Program Files\iPod 2008-02-25 19:19:30 0 d-------- C:\Program Files\QuickTime 2008-02-24 18:01:05 0 d-------- C:\Program Files\LimeWire 2008-02-20 09:31:21 69414 --a------ C:\Windows\system32\uninst.exe 2008-02-20 09:31:21 0 d-------- C:\Program Files\Shutdown Logoff Reboot ActiveX 2008-02-17 21:33:19 0 d-------- C:\Program Files\AOL 9.0 VR 2008-02-17 20:00:23 0 d-------- C:\Program Files\Alwil Software 2008-02-15 09:05:17 0 d-------- C:\Program Files\DFX 2008-02-15 09:04:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-01 12:11:10 586240 --a------ C:\Windows\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [19/01/2008 08:38] "RtHDVCpl"="RtHDVCpl.exe" [09/11/2006 10:57 C:\Windows\RtHDVCpl.exe] "HostManager"="C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe" [14/11/2006 15:01] "@"="" [] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [11/01/2007 11:40] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [24/08/2007 08:00] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/03/2007 15:57] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 10:25] "ZPLED"="C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe" [21/02/2006 07:36] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [25/07/2007 16:02] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [25/07/2007 16:06] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp. exe" [29/03/2008 18:37] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/02/2008 00:13] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [19/02/2008 14:10] "MyWebSearch Email Plugin"="C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsoemon.e xe" [05/03/2008 08:58] "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn. exe" [05/03/2008 08:58] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [] "NvSvc"="C:\Windows\system32\nvsvc.dll" [12/09/2007 06:28] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [12/09/2007 06:28] "NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [12/09/2007 06:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [27/06/2007 19:03] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [27/08/2007 21:27] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [17/08/2007 19:10] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [19/01/2008 08:33] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [10/12/2007 11:12] "ucwcydlen"="c:\users\simes\appdata\local\ucwcydle n.exe" [09/04/2008 15:29] [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog C:\Users\Simes\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [8/27/2007 9:27:36 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableUIADesktopToggle"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum bthsvcs BthServ WindowsMobile wcescomm rapimgr LocalServiceRestricted WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{17eb75ee-5582-11dc-a2ed-00038a000015}] AutoRun\command- I:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-04-09 15:42:52 ------------
|
|
#5
April 9th, 2008, 03:54 PM
|
|||
|
|||
|
Extra.txt
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft® Windows Vista™ Home Premium (build 6001) SP 1.0 Architecture: X86; Language: English CPU 0: Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz Percentage of Memory in Use: 81% Physical Memory (total/avail): 1021.76 MiB / 190.8 MiB Pagefile Memory (total/avail): 2311.85 MiB / 841.66 MiB Virtual Memory (total/avail): 2047.88 MiB / 1873.43 MiB C: is Fixed (NTFS) - 224.88 GiB total, 171.17 GiB free. D: is Removable (No Media) E: is Removable (No Media) F: is Removable (No Media) G: is Removable (No Media) H: is CDROM (No Media) \\.\PHYSICALDRIVE0 - ST3250820AS ATA Device - 232.88 GiB - 2 partitions \PARTITION0 - Unknown - 8 GiB \PARTITION1 (bootable) - Installable File System - 224.88 GiB - C: \\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device \\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device \\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device \\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FW: Norton Security Online v2007 (Symantec Corporation) Disabled AV: avast! antivirus 4.8.1169 [VPS 080409-0] v4.8.1169 (ALWIL Software) AV: Norton Security Online v2007 (Symantec Corporation) Disabled Outdated AS: AVG Anti-Spyware v7, 5, 1, 43 (GRISOFT s.r.o.) Disabled Outdated AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) AS: Norton Security Online v2007 (Symantec Corporation) Outdated AS: avast! antivirus 4.8.1169 [VPS 080409-0] v4.8.1169 (ALWIL Software) [HKLM\System\CurrentControlSet\Services\SharedAcces s\Parameters\FirewallPolicy\DomainProfile\Authoriz edApplications\List] [HKLM\System\CurrentControlSet\Services\SharedAcces s\Parameters\FirewallPolicy\StandardProfile\Author izedApplications\List] -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\ProgramData APPDATA=C:\Users\Simes\AppData\Roaming CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=SIMES-PC ComSpec=C:\Windows\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\Simes LOCALAPPDATA=C:\Users\Simes\AppData\Local LOGONSERVER=\\SIMES-PC NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\Program Files\PC Connectivity Solution\;C:\Windows\system32;C:\Windows;C:\Window s\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WS F;.WSH;.MSC PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 2, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0f02 ProgramData=C:\ProgramData ProgramFiles=C:\Program Files PROMPT=$P$G PUBLIC=C:\Users\Public QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip RoxioCentral=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\ SystemDrive=C: SystemRoot=C:\Windows TEMP=C:\Users\Simes\AppData\Local\Temp TMP=C:\Users\Simes\AppData\Local\Temp USERDOMAIN=Simes-PC USERNAME=Simes USERPROFILE=C:\Users\Simes windir=C:\Windows -- User Profiles --------------------------------------------------------------- Packard Bell Simes Vile Administrator (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\Windows\UNNeroBackItUp.exe /UNINSTALL --> C:\Windows\UNNeroMediaHome.exe /UNINSTALL --> C:\Windows\UNNeroShowTime.exe /UNINSTALL --> C:\Windows\UNNeroVision.exe /UNINSTALL --> C:\Windows\UNRecode.exe /UNINSTALL --> MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF} --> MsiExec.exe /I{0D330013-4A99-46D6-83C6-2C959C68DBFF} --> MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87} --> MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0} --> MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048} --> MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA} --> MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82} --> MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C} 1 Click PC Fix v3.5 --> "C:\Program Files\1 Click PC Fix\unins000.exe" 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85} 2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59} Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activ eX.exe Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugi n.exe Adobe Reader 8 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AdobeReader* Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} AOL Uninstaller (Choose which Products to Remove) --> C:\Program Files\Common Files\AOL\uninstaller.exe Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4} µTorrent --> "C:\Users\Simes\Program Files\uTorrent\uTorrent.exe" /UNINSTALL avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup AVG Anti-Rootkit Free --> C:\Program Files\GRISOFT\AVG Anti-Rootkit Free\Uninstall.exe AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe British Telecom --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *BT_GB* BT Home Hub --> C:\Program Files\BT Home Hub\Uninstall.exe BT Voyager 1055 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\070 1\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5B38B88D-1A17-42A1-A8CB-E784C0E7D242}\Setup.exe" -l0x9 Creator 9 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *CREATOR9* DFX 8 for Windows Media Player --> MsiExec.exe /I{c94b04c0-3a4c-4fd6-9414-e04a8e5b4d52} Flash Player plugins 9 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Flashplayer* Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72} Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29} Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll" Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall HDReg --> MsiExec.exe /I{AB7032FF-AFED-4C58-AA5C-8473B273793A} Highlight Viewer (Windows Live Toolbar) --> MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF} IcoFX 1.5.01 --> "C:\Program Files\IcoFX 1.5\unins000.exe" Infocentre Rev. 2.0 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Infocentre* Internet from BT --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ct or.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5187CE38-4730-404E-8700-3841F19A058C}\Setup.exe" iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138} Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Lexmark Z500-Z600 Series --> C:\Program Files\Lexmark Z500-Z600 Series\Install\x86\Uninst.exe LimeWire 4.16.6 --> "C:\Program Files\LimeWire\uninstall.exe" Logitech QuickCam --> MsiExec.exe /X{364EC092-93CF-4DDC-9D7A-7278452028E0} LogonStudio Vista --> C:\PROGRA~1\Stardock\OBJECT~2\LOGONS~1\UNWISE.EXE C:\PROGRA~1\Stardock\OBJECT~2\LOGONS~1\INSTALL.LOG Map Button (Windows Live Toolbar) --> MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA} Microsoft .NET Framework 1.1 --> msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1 --> MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1 Hotfix (KB929729) --> "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Upda tes\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Upda tes\M929729\M929729Uninstall.msp"
|
|
#6
April 9th, 2008, 03:55 PM
|
|||
|
|||
|
Extra.txt (2)
Microsoft Expression Web --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall WEBDESIGNER /dll ESETUP.DLL
Microsoft Expression Web --> MsiExec.exe /X{90120000-0026-0000-0000-0000000FF1CE} Microsoft Expression Web MUI (English) --> MsiExec.exe /X{90120000-0026-0409-0000-0000000FF1CE} Microsoft Expression Web Service Pack 1 (SP1) --> msiexec /package {90120000-0026-0000-0000-0000000FF1CE} /uninstall {9037FDA8-8383-4B6F-859D-D49C3C625225} Microsoft Expression Web Service Pack 1 (SP1) --> msiexec /package {90120000-0026-0409-0000-0000000FF1CE} /uninstall {DA3B8FC6-8B1D-447A-A5EE-B226DCC10662} Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE} Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE} Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE} Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE} Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE} Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE} Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE} Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE} Microsoft Office Project 2007 Service Pack 1 (SP1) --> msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {C1877F6E-C1C8-486D-A697-86431029690C} Microsoft Office Project 2007 Service Pack 1 (SP1) --> msiexec /package {90120000-00B4-0409-0000-0000000FF1CE} /uninstall {75EC8FFC-B913-4991-B3A1-22576D2FC45D} Microsoft Office Project MUI (English) 2007 --> MsiExec.exe /X{90120000-00B4-0409-0000-0000000FF1CE} Microsoft Office Project Professional 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJPRO /dll OSETUP.DLL Microsoft Office Project Professional 2007 --> MsiExec.exe /X{90120000-003B-0000-0000-0000000FF1CE} Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE} Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office Visio 2007 Service Pack 1 (SP1) --> msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {AA4F2610-5FF1-4DCD-A6FB-BCA2D09A6443} Microsoft Office Visio 2007 Service Pack 1 (SP1) --> msiexec /package {90120000-0054-0409-0000-0000000FF1CE} /uninstall {EA35370F-586C-45E1-AC6C-A4E275C6B762} Microsoft Office Visio MUI (English) 2007 --> MsiExec.exe /X{90120000-0054-0409-0000-0000000FF1CE} Microsoft Office Visio Professional 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall VISPRO /dll OSETUP.DLL Microsoft Office Visio Professional 2007 --> MsiExec.exe /X{90120000-0051-0000-0000-0000000FF1CE} Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE} Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Mozilla Firefox (2.0.0.13) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe MSVC80_x86 --> MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27} MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} My Web Search (Webfetti) --> rundll32 C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwsbar.dll,O Nero 7 Ultra Edition --> MsiExec.exe /X{26D3E377-1DCA-4043-9410-B4A9BACF1033} neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NIS2007 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *NIS2007_GB* Nokia Connectivity Cable Driver --> MsiExec.exe /X{0A3D3C54-2EC0-4D67-B265-FF17926E6D67} Nokia PC Suite --> C:\ProgramData\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Nokia_PC_Suite_rel_6_85_14_1_eng.exe Nokia PC Suite --> MsiExec.exe /I{29466F9C-7C6A-419C-B301-F440FAF78760} Nokia Software Updater --> MsiExec.exe /X{3741689E-584D-40C9-B011-373A0371846D} NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI ObjectDock --> C:\PROGRA~1\Stardock\OBJECT~1\UNWISE.EXE C:\PROGRA~1\Stardock\OBJECT~1\INSTALL.LOG Packard Bell Updator --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *Updator* PC Connectivity Solution --> MsiExec.exe /I{BA084E7C-8ABA-4670-BDE8-B85E689A5C1B} QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067} Realtek HD Audio V6.0.1.5322 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *AUDIO_REALTEK* Realtek High Definition Audio Driver --> RtlUpd.exe -r -m RF Keyboard 1.0 --> C:\Program Files\Wireless\RF Keyboard\1.0\unins000.EXE Roxio Creator 9 LE --> MsiExec.exe /I{B7FB0C86-41A4-4402-9A33-912C462042A0} RTC Client API v1.2 --> MsiExec.exe /X{44CDBD1B-89FB-4E02-8319-2A4C550F664A} Safari --> MsiExec.exe /I{0AFC9710-5DD6-4C6A-BA52-91AE992B2C9D} Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for Excel 2007 (KB946974) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E} Security Update for Office 2007 (KB947801) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E} Security Update for Outlook 2007 (KB946983) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3} Security Update for Visio 2007 (KB947590) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41} Security Update for Visio 2007 (KB947590) --> msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41} SetUp My PC --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *SETUPMYPC_GB* Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D} UberIcon 1.0.4 --> "C:\Program Files\UberIcon\unins000.exe" Update for Office 2007 (KB946691) --> msiexec /package {90120000-0026-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278} Update for Office 2007 (KB946691) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278} Update for Office 2007 (KB946691) --> msiexec /package {90120000-003B-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278} Update for Office 2007 (KB946691) --> msiexec /package {90120000-0051-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278} Update for Outlook 2007 Junk Email Filter (kb949037) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B4F188C6-6DBF-42A5-A8A3-3086D1A384F2} VIA Rhine-Family Fast-Ethernet Adapter --> Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA Video NVIDIA v97.46 --> "C:\Program Files\Packard Bell\Smart Restore\SmartRestore.exe" /MSADDREM *VIDEO_NVIDIA* Viewpoint Media Player --> C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u Windows Driver Package - Nokia Modem (02/15/2007 3.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pcc s_bluetooth.inf_48f6f624\pccs_bluetooth.inf Windows Driver Package - Nokia Modem (02/15/2007 3.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pcc s_bluetooth.inf_51d2d3e1\pccs_bluetooth.inf Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\nok btmdm.inf_e5643fdd\nokbtmdm.inf Windows Driver Package - Nokia Modem (08/03/2007 3.2) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pcc s_bluetooth.inf_5f8b7288\pccs_bluetooth.inf Windows Driver Package - Nokia Modem (08/03/2007 6.84.0.2) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\nok btmdm.inf_7837a5db\nokbtmdm.inf Windows Driver Package - Nokia Modem (08/08/2007 3.3) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pcc s_bluetooth.inf_a81bde77\pccs_bluetooth.inf Windows Driver Package - Nokia Modem (10/12/2007 3.6) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\nok ia_bluetooth.inf_ee12375f\nokia_bluetooth.inf Windows Installer Clean Up --> MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52} Windows Live Favorites for Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66} Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Mail --> MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7} Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live OneCare safety scanner --> "C:\Program Files\Windows Live Safety Center\UnInstall.exe" Windows Live OneCare safety scanner --> MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D} Windows Live Outlook Toolbar (Windows Live Toolbar) --> MsiExec.exe /X{A40D6757-B145-4FE7-B694-89180A9F3F64} Windows Live Photo Gallery --> MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C} Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750} Windows Live Toolbar --> MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750} Windows Live Toolbar Extension (Windows Live Toolbar) --> MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D} Windows Live Toolbar Feed Detector (Windows Live Toolbar) --> MsiExec.exe /X{38024121-D084-4E7D-B1A2-1A04CB5C4CF3} Windows Live Writer --> MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397} Windows Media Player Firefox Plugin --> MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} Windows Mobile Device Center --> MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917} Windows Mobile Device Center Driver Update --> MsiExec.exe /X{E7044E25-3038-4A76-9064-344AC038043E} -- Application Event Log ------------------------------------------------------- Event Record #/Type17808 / Error Event Submitted/Written: 04/09/2008 03:28:13 PM Event ID/Source: 1000 / Application Error Event Description: Faulting application LVPrcSrv.exe, version 11.1.0.2021, time stamp 0x46a05f1a, faulting module USER32.dll, version 6.0.6001.18000, time stamp 0x4791a7a6, exception code 0xc0000142, fault offset 0x00009cac, process id 0x115c, application start time 0xLVPrcSrv.exe0. Event Record #/Type17792 / Success Event Submitted/Written: 04/09/2008 07:57:20 AM Event ID/Source: 5617 / WinMgmt Event Description: Event Record #/Type17791 / Success Event Submitted/Written: 04/09/2008 07:57:19 AM Event ID/Source: 5615 / WinMgmt Event Description: Event Record #/Type17787 / Success Event Submitted/Written: 04/09/2008 07:57:07 AM Event ID/Source: 902 / Software Licensing Service Event Description: The Software Licensing service has started. Event Record #/Type17778 / Warning Event Submitted/Written: 04/09/2008 03:35:54 AM Event ID/Source: 1530 / profsvc Event Description: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-1821962517-124290910-3490180065-1003_Classes: Process 872 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-1821962517-124290910-3490180065-1003_CLASSES -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type58060 / Warning Event Submitted/Written: 04/09/2008 03:29:41 PM Event ID/Source: 3004 / WinDefend Event Description: %Simes-PC27 Real-Time Protection agent has detected changes. Microsoft recommends you analyze the software that made these changes for potential risks. You can use information about how these programs operate to choose whether to allow them to run or remove them from your computer. Allow changes only if you trust the program or the software publisher. %Simes-PC27 can't undo changes that you allow. For more information please see the following: %Simes-PC275 Scan ID: {A2073F2B-0442-4424-8DEB-B45CE0B1FA9D} User: Simes-PC\Simes Name: %Simes-PC271 ID: %Simes-PC272 Severity ID: %Simes-PC273 Category ID: %Simes-PC274 Path Found: %Simes-PC276 Alert Type: %Simes-PC278 Detection Type: 1.1.1600.02 Event Record #/Type58026 / Error Event Submitted/Written: 04/09/2008 07:58:39 AM Event ID/Source: 7026 / Service Control Manager Event Description: i8042prt Event Record #/Type57944 / Error Event Submitted/Written: 04/09/2008 07:57:06 AM Event ID/Source: 15016 / HTTP Event Description: \Device\Http\ReqQueueKerberos Event Record #/Type57929 / Warning Event Submitted/Written: 04/09/2008 03:36:02 AM Event ID/Source: 4001 / Microsoft-Windows-WLAN-AutoConfig Event Description: Event Record #/Type57895 / Warning Event Submitted/Written: 04/09/2008 03:13:30 AM Event ID/Source: 1003 / Dhcp Event Description: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001B9E5E8E82. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. -- End of Deckard's System Scanner: finished at 2008-04-09 15:42:52 ------------
|
|
#7
April 10th, 2008, 01:00 AM
|
||||
|
||||
|
Your operating system is infected. Download the latest version of Combofix.exe from here and save it to your C folder (C:\ComboFix.exe).
Doubleclick on combofix.exe and and the scan will start. When the scan completes, a text window with your log will open. Please copy and paste that log back here. A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. NB Please disable your antivirus program as it may interfere with ComboFix's routines. Copy this log in your next reply together with a new Hijack This log. Moving to the Cyber Safety Forum
|
|
#8
April 11th, 2008, 07:02 AM
|
|||
|
|||
|
Ok, here's the ComboFix log
ComboFix 08-04-09.9 - Simes 2008-04-11 6:40:03.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.264 [GMT 1:00] Running from: C:\Users\Simes\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Program Files\FunWebProducts C:\Program Files\internet explorer\msimg32.dll C:\Program Files\messengerskinner C:\Program Files\messengerskinner\download\defaultPack.cab C:\Program Files\messengerskinner\MessengerSkinnerDll.dll C:\Program Files\messengerskinner\resources\appconfig.xml C:\Program Files\messengerskinner\resources\btn.rgn C:\Program Files\messengerskinner\resources\btnBnr.rgn C:\Program Files\messengerskinner\resources\btnIn.rgn C:\Program Files\messengerskinner\resources\btnInNormal.bmp C:\Program Files\messengerskinner\resources\btnInOver.bmp C:\Program Files\messengerskinner\resources\btnNormal.bmp C:\Program Files\messengerskinner\resources\btnNormal.gif C:\Program Files\messengerskinner\resources\btnNormalBnr.bmp C:\Program Files\messengerskinner\resources\btnNormalBnr.gif C:\Program Files\messengerskinner\resources\btnOver.bmp C:\Program Files\messengerskinner\resources\btnOver.gif C:\Program Files\messengerskinner\resources\btnOverBnr.bmp C:\Program Files\messengerskinner\resources\btnOverBnr.gif C:\Program Files\messengerskinner\resources\languages_v2.xml C:\Program Files\messengerskinner\uninst.exe C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\2.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\2.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\2.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\3.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3BKGERR.JPG C:\Program Files\MyWebSearch\bar\5.bin\F3CJPEG.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3DTACTL.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3HISTSW.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3HTTPCT.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3IMSTUB.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3POPSWT.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3PSSAVR.SCR C:\Program Files\MyWebSearch\bar\5.bin\F3REPROX.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3RESTUB.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3SCHMON.EXE C:\Program Files\MyWebSearch\bar\5.bin\F3SCRCTR.DLL C:\Program Files\MyWebSearch\bar\5.bin\F3SPACER.WMV C:\Program Files\MyWebSearch\bar\5.bin\F3WALLPP.DAT C:\Program Files\MyWebSearch\bar\5.bin\F3WPHOOK.DLL C:\Program Files\MyWebSearch\bar\5.bin\FWPBUDDY.PNG C:\Program Files\MyWebSearch\bar\5.bin\M3FFXTBR.JAR C:\Program Files\MyWebSearch\bar\5.bin\M3FFXTBR.MANIFEST C:\Program Files\MyWebSearch\bar\5.bin\M3HIGHIN.EXE C:\Program Files\MyWebSearch\bar\5.bin\M3HTML.DLL C:\Program Files\MyWebSearch\bar\5.bin\M3IDLE.DLL C:\Program Files\MyWebSearch\bar\5.bin\M3IMPIPE.EXE C:\Program Files\MyWebSearch\bar\5.bin\M3MEDINT.EXE C:\Program Files\MyWebSearch\bar\5.bin\M3MSG.DLL C:\Program Files\MyWebSearch\bar\5.bin\M3NTSTBR.JAR C:\Program Files\MyWebSearch\bar\5.bin\M3NTSTBR.MANIFEST C:\Program Files\MyWebSearch\bar\5.bin\M3OUTLCN.DLL C:\Program Files\MyWebSearch\bar\5.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\5.bin\M3SKIN.DLL C:\Program Files\MyWebSearch\bar\5.bin\M3SKPLAY.EXE C:\Program Files\MyWebSearch\bar\5.bin\M3SLSRCH.EXE C:\Program Files\MyWebSearch\bar\5.bin\M3SRCHMN.EXE C:\Program Files\MyWebSearch\bar\5.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\5.bin\MWSOEPLG.DLL C:\Program Files\MyWebSearch\bar\5.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\5.bin\MWSSVC.EXE C:\Program Files\MyWebSearch\bar\5.bin\NPMYWEBS.DLL C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S C:\Program Files\MyWebSearch\bar\Cache\files.ini C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S C:\Program Files\MyWebSearch\bar\icons\CM.ICO C:\Program Files\MyWebSearch\bar\icons\MFC.ICO C:\Program Files\MyWebSearch\bar\icons\PSS.ICO C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO C:\Program Files\MyWebSearch\bar\icons\WB.ICO C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\MessengerSkinner.ln k C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Privacy Policy.url C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Terms and Conditions.url C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Uninstall.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MessengerSkinner\Website.url c:\Users\Simes\AppData\Local\ucwcydlen.dat c:\users\simes\appdata\local\ucwcydlen.exe c:\Users\Simes\AppData\Local\ucwcydlen_nav.dat C:\Users\Simes\AppData\Local\ucwcydlen_navps.dat C:\Users\Simes\AppData\Roaming\MessengerSkinner C:\Windows\system32\f3PSSavr.scr C:\Windows\system32\nvs2.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SZKG5 ((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 ))))))))))))))))))))))))))))))) . 2008-04-09 15:32 . 2008-04-09 15:32 <DIR> d-------- C:\Deckard 2008-04-09 02:42 . 2008-04-09 02:42 <DIR> d-------- C:\Users\All Users\eSellerate 2008-04-09 02:42 . 2008-04-09 02:42 <DIR> d-------- C:\ProgramData\eSellerate 2008-04-09 02:32 . 2008-04-09 02:32 <DIR> d-------- C:\Users\All Users\TEMP 2008-04-09 02:32 . 2008-04-09 02:32 <DIR> d-------- C:\ProgramData\TEMP 2008-04-09 02:32 . 2008-04-09 02:42 <DIR> d-------- C:\Program Files\1 Click PC Fix 2008-04-09 02:32 . 2001-08-17 00:00 494,352 --a------ C:\Windows\System32\SHDOC401.DLL 2008-04-09 02:32 . 2000-05-22 15:58 83,144 --a------ C:\Windows\System32\PICCLP32.OCX 2008-04-09 02:32 . 2007-12-19 16:12 53,248 --a------ C:\Windows\System32\ArmAccess.dll 2008-04-08 23:58 . 2008-04-08 23:58 2,560 --a------ C:\Windows\_MSRSTRT.EXE 2008-04-07 05:05 . 2008-03-29 18:31 75,856 --a------ C:\Windows\System32\drivers\aswSP.sys 2008-04-07 05:05 . 2008-03-29 18:35 20,560 --a------ C:\Windows\System32\drivers\aswFsBlk.sys 2008-03-31 19:34 . 2008-03-31 19:34 <DIR> d-------- C:\Program Files\Safari 2008-03-30 10:45 . 2008-03-30 10:45 <DIR> d-------- C:\PerfLogs 2008-03-30 10:12 . 2008-01-19 08:43 3,600,440 --a------ C:\Windows\System32\ntkrnlpa.exe 2008-03-30 10:12 . 2008-01-19 08:33 2,623,488 --a------ C:\Windows\System32\SLsvc.exe 2008-03-30 10:12 . 2008-01-19 08:36 1,541,120 --a------ C:\Windows\System32\onex.dll 2008-03-30 10:12 . 2008-01-19 08:43 266,808 --a------ C:\Windows\System32\drivers\acpi.sys 2008-03-30 10:12 . 2008-01-19 08:42 151,096 --a------ C:\Windows\System32\drivers\pci.sys 2008-03-30 10:12 . 2008-01-19 08:42 51,768 --a------ C:\Windows\System32\PSHED.DLL 2008-03-30 10:10 . 2008-01-19 08:35 4,875,776 --a------ C:\Windows\System32\NlsData0009.dll 2008-03-30 10:09 . 2008-01-19 08:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll 2008-03-30 10:08 . 2008-01-19 08:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll 2008-03-30 10:07 . 2008-01-19 07:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL 2008-03-26 16:20 . 2008-04-09 00:35 <DIR> d-------- C:\nav-update 2008-03-25 22:48 . 2008-04-10 21:32 12 --a------ C:\Windows\bthservsdp.dat 2008-03-20 14:04 . 2008-03-20 20:07 <DIR> d-------- C:\Users\All Users\SITEguard 2008-03-20 14:04 . 2008-03-20 20:07 <DIR> d-------- C:\ProgramData\SITEguard 2008-03-20 14:00 . 2008-03-20 20:41 <DIR> d-------- C:\Users\All Users\STOPzilla! 2008-03-20 14:00 . 2008-03-20 20:41 <DIR> d-------- C:\ProgramData\STOPzilla! 2008-03-20 14:00 . 2008-03-20 14:00 <DIR> d-------- C:\Program Files\Common Files\iS3 2008-03-11 16:53 . 2007-09-12 18:58 58,792 --a------ C:\Windows\System32\wbload.dll 2008-03-11 16:53 . 2007-07-11 15:06 42,672 --a------ C:\Windows\System32\wbsys.dll 2008-03-11 15:52 . 2008-03-11 15:52 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-03-11 10:53 . 2006-11-29 14:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll 2008-03-11 10:52 . 2008-03-11 10:52 <DIR> d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-03-11 10:50 . 2008-03-11 10:50 <DIR> d-------- C:\Program Files\Windows Live Favorites 2008-03-11 10:43 . 2008-03-11 10:48 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) . 2008-04-10 08:51 --------- d-----w C:\ProgramData\Google Updater 2008-04-09 00:58 --------- d-----w C:\Program Files\Windows Mail 2008-04-09 00:12 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-08 23:39 615,424 ----a-w C:\Windows\System32\themeui.dll 2008-04-08 23:39 240,640 ----a-w C:\Windows\System32\uxtheme.dll 2008-04-08 23:32 21,936,640 ----a-w C:\Windows\System32\imageres.dll 2008-04-01 03:37 --------- d-----w C:\Program Files\Java 2008-03-30 12:32 --------- d-----w C:\ProgramData\NVIDIA 2008-03-30 09:56 174 --sha-w C:\Program Files\desktop.ini 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Journal 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Defender 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Collaboration 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Calendar 2008-03-30 09:25 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-03-30 09:25 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-03-29 17:45 1,146,232 ----a-w C:\Windows\System32\aswBoot.exe 2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys 2008-03-29 17:29 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys 2008-03-29 17:27 42,912 ----a-w C:\Windows\system32\drivers\aswTdi.sys 2008-03-29 17:23 95,608 ----a-w C:\Windows\System32\AvastSS.scr 2008-03-15 00:42 --------- d-----w C:\Program Files\Windows Live 2008-03-12 23:34 --------- d-----w C:\Users\Simes\AppData\Roaming\uTorrent 2008-03-11 20:27 --------- d-----w C:\Users\Simes\AppData\Roaming\LimeWire 2008-03-11 09:52 --------- d-----w C:\Program Files\Windows Live Toolbar 2008-03-11 09:42 --------- d-----w C:\ProgramData\WLInstaller 2008-03-06 22:40 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-03-05 07:59 --------- d-----w C:\ProgramData\Windows Live Toolbar 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-26 04:54 43,520 ----a-w C:\Windows\system32\drivers\fetnd5bv.sys 2008-02-25 18:21 --------- d-----w C:\Program Files\iTunes 2008-02-25 18:21 --------- d-----w C:\Program Files\iPod 2008-02-25 18:19 --------- d-----w C:\Program Files\QuickTime 2008-02-24 17:01 --------- d-----w C:\Program Files\LimeWire 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-20 08:31 69,414 ----a-w C:\Windows\System32\uninst.exe 2008-02-20 08:31 --------- d-----w C:\Program Files\Shutdown Logoff Reboot ActiveX 2008-02-17 20:33 --------- d-----w C:\Program Files\AOL 9.0 VR 2008-02-17 19:04 --------- d-----w C:\Users\Vile\AppData\Roaming\AVG7 2008-02-17 19:03 --------- d-----w C:\ProgramData\Avg7 2008-02-17 19:00 --------- d-----w C:\Program Files\Alwil Software 2008-02-15 08:05 --------- d-----w C:\Program Files\DFX 2008-02-15 08:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-01 11:11 586,240 ----a-w C:\Windows\WLXPGSS.SCR 2008-01-19 07:43 376,376 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll 2008-01-19 07:43 3,548,728 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-01-19 07:42 94,776 ----a-w C:\Windows\System32\MigAutoPlay.exe 2008-01-19 07:42 247,352 ----a-w C:\Windows\System32\clfs.sys 2008-01-19 07:42 177,208 ----a-w C:\Windows\System32\halmacpi.dll 2008-01-19 07:42 141,880 ----a-w C:\Windows\System32\halacpi.dll 2008-01-19 07:41 24,120 ----a-w C:\Windows\System32\BOOTVID.DLL 2008-01-19 07:41 21,560 ----a-w C:\Windows\System32\kdusb.dll 2008-01-19 07:41 19,512 ----a-w C:\Windows\System32\kdcom.dll 2008-01-19 07:38 46,080 ----a-w C:\Windows\System32\NAPCRYPT.DLL 2008-01-19 07:38 4,595,712 ----a-w C:\Windows\System32\AuthFWSnapin.dll 2008-01-19 07:38 242,744 ----a-w C:\Windows\System32\rsaenh.dll 2008-01-19 07:38 155,704 ----a-w C:\Windows\System32\dssenh.dll 2008-01-19 07:38 131,640 ----a-w C:\Windows\System32\basecsp.dll 2008-01-19 07:38 103,936 ----a-w C:\Windows\System32\NAPHLPR.DLL 2008-01-19 07:38 1,203,792 ----a-w C:\Windows\System32\ntdll.dll 2008-01-19 07:36 996,352 ----a-w C:\Windows\System32\WMNetMgr.dll 2008-01-19 07:35 98,304 ----a-w C:\Windows\System32\mssitlb.dll 2008-01-19 07:34 98,816 ----a-w C:\Windows\System32\mfps.dll 2008-01-19 07:33 98,304 ----a-w C:\Windows\System32\makecab.exe 2008-01-19 07:32 879,616 ----a-w C:\Windows\System32\Bubbles.scr 2008-01-19 07:32 704,512 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2008-01-19 07:32 5,714,432 ----a-w C:\Windows\System32\logon.scr 2008-01-19 07:32 258,048 ----a-w C:\Windows\System32\winspool.drv 2008-01-19 07:32 221,184 ----a-w C:\Windows\System32\Mystify.scr 2008-01-19 07:32 220,672 ----a-w C:\Windows\System32\Ribbons.scr 2008-01-19 07:32 21,504 ----a-w C:\Windows\System32\msacm32.drv 2008-01-19 07:32 166,912 ----a-w C:\Windows\System32\wdmaud.drv 2008-01-19 07:32 1,370,624 ----a-w C:\Windows\System32\Aurora.scr 2008-01-19 07:31 7,680 ----a-w C:\Windows\System32\spwizres.dll 2008-01-19 07:31 57,856 ----a-w C:\Windows\System32\nlsbres.dll 2008-01-19 07:31 118,272 ----a-w C:\Windows\System32\RDPENCDD.dll 2008-01-19 07:30 17,920 ----a-w C:\Windows\System32\netevent.dll 2008-01-19 07:29 705,536 ----a-w C:\Windows\System32\imagesp1.dll 2008-01-19 07:29 58,880 ----a-w C:\Windows\System32\msobjs.dll 2008-01-19 07:28 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll 2008-01-19 07:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-01-19 06:01 14,336 ----a-w C:\Windows\System32\tsddd.dll 2008-01-19 06:01 134,656 ----a-w C:\Windows\System32\rdpdd.dll 2008-01-19 05:52 56,320 ----a-w C:\Windows\System32\vga256.dll 2008-01-19 05:52 21,504 ----a-w C:\Windows\System32\vga64k.dll 2008-01-19 05:52 11,776 ----a-w C:\Windows\System32\framebuf.dll 2008-01-19 05:52 10,752 ----a-w C:\Windows\System32\vga.dll 2008-01-19 05:50 14,848 ----a-w C:\Windows\System32\iscsilog.dll
|
|
#9
April 11th, 2008, 07:04 AM
|
|||
|
|||
|
ComboFix (2)
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-08-27 21:27 68856] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2007-08-17 19:10 159744] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 08:38 1008184] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 10:57 3784704 C:\Windows\RtHDVCpl.exe] "HostManager"="C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe" [2006-11-14 15:01 50736] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 11:40 232184] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "ZPLED"="C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe" [2006-02-21 07:36 347648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 16:02 563984] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 16:06 2027792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn. exe" [ ] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 06:28 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 06:28 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [2007-09-12 06:28 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336] C:\Users\Simes\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM 3450608] C:\Users\Vile\AppData\Roaming\Microsoft\Windows\St art Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM 3450608] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [8/27/2007 9:27:36 PM 124912] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules] "{F1A39805-9129-40C9-9D62-1F089F28431E}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler "{E5E6C791-A413-4093-94AA-4D9743A21AAB}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler "{1F265EE6-34B0-446D-8D19-9BFF18E93194}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services "{3083F52B-8100-4B16-BF34-0D0A8958299F}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services "{84C9B841-D3C4-4E4B-8D52-006D997A56AE}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL "{57BAACD9-725C-4F6C-8723-77CC78923AF0}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL "{34D7DF6C-945E-4FDD-B57E-E2B94D75DE65}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed "{D01EEF7D-3F5F-4244-81EE-504CF62B3607}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed "{323ADFCA-8888-452F-894C-54CCF5475F79}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader "{EC5F4FA8-7167-4279-9372-385EE4D1A473}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader "{D4341B99-BD29-4B6F-B766-0BA7C84893A7}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information "{C2E5407B-81A6-4D0F-A46B-0EFE7D27E251}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information "{0144BEC3-8707-4D02-81D2-C6BB9906EC26}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{42E1FA8D-1CE7-4936-8F85-06714C0CCF56}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{FA70FEBB-B1A0-44C5-9F77-E34C700AC627}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxb cpswx.exe:Printer Status Window "{DA10CEF0-1668-4EC9-AC67-517F03AE8832}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxb cpswx.exe:Printer Status Window "{7DBAD7E5-DAED-428A-A8C3-5E38247F45FE}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{F301911F-B415-4521-AA57-51EA3427D064}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{ADDCE154-83EA-40F3-B2F5-C398B2C956B8}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{00ACE8CA-D4FB-42DC-B417-49A1F4EAC79A}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{0E44B8C6-8507-4021-BF36-D29CDE1D6993}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{12D6D331-8B61-4FB6-82CB-C3AD61F75A24}"= UDP:C:\Windows\System32\lxbccoms.exe:Lexmark Communications System "{92F066A9-4A09-406A-9E33-0A146D616E5D}"= TCP:C:\Windows\System32\lxbccoms.exe:Lexmark Communications System "TCP Query User{99AECBDB-9C23-44BF-B951-5ED1740E949B}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{8737DD94-9CB7-495E-87A2-FE02B57C1CEE}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{60A78BBC-32B6-4774-A4F4-66467E8137A6}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire "UDP Query User{A824382E-3020-4DAA-B067-E3A5FD242B60}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire "{BB7EB973-27CE-48B5-807E-992C2B65D7D3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{B1A5FAD4-B536-47AF-B66D-DB4080FD0815}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{24A6AD5F-D4F1-4FD3-BA8D-54108510609B}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "{4973EB2A-6E3A-4C77-BC52-F36A8E152419}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{E1C61C59-BA73-4FCB-AD7E-EA77F2385FB5}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{2CD5A0BA-DC6E-4D00-9A83-190B6869D80D}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "TCP Query User{FF9CD70E-7325-4B40-A7E5-06200E20886F}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{53280BDD-9CF8-42EC-A2C6-5EA0E4D94134}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{8AE1A76F-17B6-4574-9A51-C3A75B49EE2F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpo licy\StandardProfile\GloballyOpenPorts\List] "123:UDP"= 123:UDP:*:Enabled:NTP R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 18:31] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswF sBlk.sys [2008-03-29 18:35] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\as wMonFlt.sys [2008-03-29 18:32] R2 lxbc_device;lxbc_device;C:\Windows\system32\lxbcco ms.exe [2007-03-16 01:24] R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 08:33] R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 08:33] R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:54] S2 MyWebSearchService;My Web Search Service;C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwssvc.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{17eb75ee-5582-11dc-a2ed-00038a000015}] \shell\AutoRun\command - I:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-04-11 05:32:01 C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2008-04-07 19:00:01 C:\Windows\Tasks\Norton Security Online - Run Full System Scan - Simes.job" - C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeB/TASK: "2008-04-11 05:30:00 C:\Windows\Tasks\Recovery DVD Creator.job" - C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe . ************************************************** ************************ catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-11 06:45:24 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************** ************************ . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\Windows\Explorer.exe -> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll -> C:\Program Files\UberIcon\UberIcon.dll . Completion time: 2008-04-11 6:53:32 ComboFix-quarantined-files.txt 2008-04-11 05:52:21 Pre-Run: 181,096,660,992 bytes free Post-Run: 181,062,537,216 bytes free . 2008-04-09 00:12:04 --- E O F ---
|
|
#10
April 11th, 2008, 07:34 AM
|
|||
|
|||
|
DSS main.txt
Deckard's System Scanner v20071014.68
Run by Simes on 2008-04-11 07:09:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 1022 MiB (1024 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-04-11 07:10:39 Platform: Windows Vista Service Pack 1 (6.00.6001) MSIE: Internet Explorer (7.00.6000.16386) Boot mode: Normal Running processes: C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe C:\Windows\System32\taskeng.exe C:\Windows\System32\dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\aol\1183532771\ee\aolsoftware.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\WindowsMobile\wmdc.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Windows\System32\rundll32.exe C:\Program Files\UberIcon\UberIcon Manager.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Windows\System32\wbem\unsecapp.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe C:\Windows\System32\conime.exe C:\Windows\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Simes\Desktop\dss.exe C:\Windows\System32\SearchFilterHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\sw g.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ZPLED] C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn.exe" /m=0 O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user') O4 - Startup: Stardock ObjectDock.lnk = ? O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZKfox000 O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing) O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing) O9 - Extra button: (no name) - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O15 - Trusted Zone: http://www.gaydar.co.uk (HKCU) O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\aol\acs\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\logishrd\SrvLnch\SrvLnch.exe O23 - Service: lxbc_device - Unknown owner - C:\Windows\System32\lxbccoms.exe O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwssvc.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 12254 bytes -- Files created between 2008-03-11 and 2008-04-11 ----------------------------- 2008-04-10 16:06:25 68096 --a------ C:\Windows\zip.exe 2008-04-10 16:06:25 49152 --a------ C:\Windows\VFind.exe 2008-04-10 16:06:25 212480 --a------ C:\Windows\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-04-10 16:06:25 136704 --a------ C:\Windows\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-04-10 16:06:25 161792 --a------ C:\Windows\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-04-10 16:06:25 98816 --a------ C:\Windows\sed.exe 2008-04-10 16:06:25 80412 --a------ C:\Windows\grep.exe 2008-04-10 16:06:25 73728 --a------ C:\Windows\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-04-09 03:08:55 0 -rahs---- C:\MSDOS.SYS 2008-04-09 03:08:55 0 -rahs---- C:\IO.SYS 2008-04-09 02:42:31 0 d-------- C:\Users\All Users\eSellerate 2008-04-09 02:32:49 0 d-------- C:\Users\All Users\TEMP 2008-04-09 02:32:46 494352 --a------ C:\Windows\system32\SHDOC401.DLL <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> 2008-04-09 02:32:46 53248 --a------ C:\Windows\system32\ArmAccess.dll 2008-04-09 02:32:45 0 d-------- C:\Program Files\1 Click PC Fix 2008-04-08 23:58:53 2560 --a------ C:\Windows\_MSRSTRT.EXE 2008-03-31 19:34:08 0 d-------- C:\Program Files\Safari 2008-03-30 10:45:59 0 d-------- C:\PerfLogs 2008-03-30 10:10:14 240640 --a------ C:\Windows\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-30 10:09:08 615424 --a------ C:\Windows\system32\themeui.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-26 16:20:25 0 d-------- C:\nav-update 2008-03-25 22:48:46 12 --a------ C:\Windows\bthservsdp.dat 2008-03-20 14:04:08 0 d-------- C:\Users\All Users\SITEguard 2008-03-20 14:00:32 0 d-------- C:\Program Files\Common Files\iS3 2008-03-20 14:00:28 0 d-------- C:\Users\All Users\STOPzilla! 2008-03-11 15:52:28 0 d-------- C:\Program Files\Common Files\Adobe 2008-03-11 10:52:44 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-03-11 10:50:53 0 d-------- C:\Program Files\Windows Live Favorites 2008-03-11 10:43:52 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
|
|
#11
April 11th, 2008, 07:35 AM
|
|||
|
|||
|
main.txt (2)
-- Find3M Report ---------------------------------------------------------------
2008-04-09 01:58:20 0 d-------- C:\Program Files\Windows Mail 2008-04-09 00:32:59 21936640 --a------ C:\Windows\system32\imageres.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-04-01 04:37:05 0 d-------- C:\Program Files\Java 2008-03-30 10:56:14 174 --ahs---- C:\Program Files\desktop.ini 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Sidebar 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Collaboration 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Calendar 2008-03-30 10:46:50 0 d-------- C:\Program Files\Movie Maker 2008-03-30 10:46:49 0 d-------- C:\Program Files\Windows Photo Gallery 2008-03-30 10:46:49 0 d-------- C:\Program Files\Windows Journal 2008-03-30 10:46:48 0 d-------- C:\Program Files\Windows Defender 2008-03-20 14:00:32 0 d-------- C:\Program Files\Common Files 2008-03-15 01:42:48 0 d-------- C:\Program Files\Windows Live 2008-03-13 00:34:58 0 d-------- C:\Users\Simes\AppData\Roaming\uTorrent 2008-03-11 21:27:34 0 d-------- C:\Users\Simes\AppData\Roaming\LimeWire 2008-03-11 10:52:18 0 d-------- C:\Program Files\Windows Live Toolbar 2008-03-06 23:40:48 0 d-------- C:\Program Files\Microsoft Silverlight 2008-02-26 14:25:50 0 d-------- C:\Users\Simes\AppData\Roaming\Adobe 2008-02-25 19:21:35 0 d-------- C:\Program Files\iTunes 2008-02-25 19:21:25 0 d-------- C:\Program Files\iPod 2008-02-25 19:19:30 0 d-------- C:\Program Files\QuickTime 2008-02-24 18:01:05 0 d-------- C:\Program Files\LimeWire 2008-02-20 09:31:21 69414 --a------ C:\Windows\system32\uninst.exe 2008-02-20 09:31:21 0 d-------- C:\Program Files\Shutdown Logoff Reboot ActiveX 2008-02-17 21:33:19 0 d-------- C:\Program Files\AOL 9.0 VR 2008-02-17 20:00:23 0 d-------- C:\Program Files\Alwil Software 2008-02-15 09:05:17 0 d-------- C:\Program Files\DFX 2008-02-15 09:04:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-01 12:11:10 586240 --a------ C:\Windows\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [19/01/2008 08:38] "RtHDVCpl"="RtHDVCpl.exe" [09/11/2006 10:57 C:\Windows\RtHDVCpl.exe] "HostManager"="C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe" [14/11/2006 15:01] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [11/01/2007 11:40] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [24/08/2007 08:00] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/03/2007 15:57] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 10:25] "ZPLED"="C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe" [21/02/2006 07:36] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [25/07/2007 16:02] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [25/07/2007 16:06] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/02/2008 00:13] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [19/02/2008 14:10] "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn. exe" [] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [] "NvSvc"="C:\Windows\system32\nvsvc.dll" [12/09/2007 06:28] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [12/09/2007 06:28] "NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [12/09/2007 06:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [27/06/2007 19:03] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [27/08/2007 21:27] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [17/08/2007 19:10] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [19/01/2008 08:33] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [10/12/2007 11:12] [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog C:\Users\Simes\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [8/27/2007 9:27:36 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableUIADesktopToggle"=0 (0x0) "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum bthsvcs BthServ WindowsMobile wcescomm rapimgr LocalServiceRestricted WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{17eb75ee-5582-11dc-a2ed-00038a000015}] AutoRun\command- I:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-04-11 07:29:11 ------------
|
|
#12
April 11th, 2008, 09:41 AM
|
||||
|
||||
|
I can see a Symantec startup in your log but it looks as though you have uninstalled all Norton/Symantec software. If so, go here and run the online Norton Removal Utility and reboot afterwards. It should get rid of Norton traces.
Also please check to make sure that Security Center is monitoring your AntiVirus and antispyware protection and other settings that you have enabled. To do this, go to Control Panel > Security Center and you should see Malware Protection with a big green button that says ON. See the graphic here. You can change settings by clicking on the appropriate Menu item on the lefthand side of the screen. Next, go here and download Hijack This to your Desktop. When you have downloaded it, doubleclick to install. Once installed, open Hijack This and click on scan. Check the below entries and click on Fix Checked. O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\5.bin\m3SrchMn.exe" /m=0 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...tml?p=ZKfox000 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} () - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.0.cab Open notepad and copy and paste the text in the codebox below into it: Code:
Driver:: MyWebSearchService Folder:: C:\PROGRA~1\MYWEBS~1 DirLook:: C:\nav-update  ComboFix will run again. When the fix completes it will create a C:\ComboFix.txt log. Please post that log in your next reply. Also post a new Hijack This log please.
|
|
#13
April 11th, 2008, 06:35 PM
|
|||
|
|||
|
ComboFix log (1)
ComboFix 08-04-09.9 - Simes 2008-04-11 18:17:36.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.381 [GMT 1:00] Running from: C:\Users\Simes\Desktop\ComboFix.exe Command switches used :: C:\Users\Simes\Desktop\CFScript.txt * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-03-11 to 2008-04-11 ))))))))))))))))))))))))))))))) . 2008-04-09 15:32 . 2008-04-09 15:32 <DIR> d-------- C:\Deckard 2008-04-09 02:42 . 2008-04-09 02:42 <DIR> d-------- C:\Users\All Users\eSellerate 2008-04-09 02:42 . 2008-04-09 02:42 <DIR> d-------- C:\ProgramData\eSellerate 2008-04-09 02:32 . 2008-04-09 02:32 <DIR> d-------- C:\Users\All Users\TEMP 2008-04-09 02:32 . 2008-04-09 02:32 <DIR> d-------- C:\ProgramData\TEMP 2008-04-09 02:32 . 2008-04-09 02:42 <DIR> d-------- C:\Program Files\1 Click PC Fix 2008-04-09 02:32 . 2001-08-17 00:00 494,352 --a------ C:\Windows\System32\SHDOC401.DLL 2008-04-09 02:32 . 2000-05-22 15:58 83,144 --a------ C:\Windows\System32\PICCLP32.OCX 2008-04-09 02:32 . 2007-12-19 16:12 53,248 --a------ C:\Windows\System32\ArmAccess.dll 2008-04-08 23:58 . 2008-04-08 23:58 2,560 --a------ C:\Windows\_MSRSTRT.EXE 2008-04-07 05:05 . 2008-03-29 18:31 75,856 --a------ C:\Windows\System32\drivers\aswSP.sys 2008-04-07 05:05 . 2008-03-29 18:35 20,560 --a------ C:\Windows\System32\drivers\aswFsBlk.sys 2008-03-31 19:34 . 2008-03-31 19:34 <DIR> d-------- C:\Program Files\Safari 2008-03-30 10:45 . 2008-03-30 10:45 <DIR> d-------- C:\PerfLogs 2008-03-30 10:12 . 2008-01-19 08:43 3,600,440 --a------ C:\Windows\System32\ntkrnlpa.exe 2008-03-30 10:12 . 2008-01-19 08:33 2,623,488 --a------ C:\Windows\System32\SLsvc.exe 2008-03-30 10:12 . 2008-01-19 08:36 1,541,120 --a------ C:\Windows\System32\onex.dll 2008-03-30 10:12 . 2008-01-19 08:43 266,808 --a------ C:\Windows\System32\drivers\acpi.sys 2008-03-30 10:12 . 2008-01-19 08:42 151,096 --a------ C:\Windows\System32\drivers\pci.sys 2008-03-30 10:12 . 2008-01-19 08:42 51,768 --a------ C:\Windows\System32\PSHED.DLL 2008-03-30 10:10 . 2008-01-19 08:35 4,875,776 --a------ C:\Windows\System32\NlsData0009.dll 2008-03-30 10:09 . 2008-01-19 08:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll 2008-03-30 10:08 . 2008-01-19 08:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll 2008-03-30 10:07 . 2008-01-19 07:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL 2008-03-26 16:20 . 2008-04-09 00:35 <DIR> d-------- C:\nav-update 2008-03-25 22:48 . 2008-04-11 18:04 12 --a------ C:\Windows\bthservsdp.dat 2008-03-20 14:04 . 2008-03-20 20:07 <DIR> d-------- C:\Users\All Users\SITEguard 2008-03-20 14:04 . 2008-03-20 20:07 <DIR> d-------- C:\ProgramData\SITEguard 2008-03-20 14:00 . 2008-03-20 20:41 <DIR> d-------- C:\Users\All Users\STOPzilla! 2008-03-20 14:00 . 2008-03-20 20:41 <DIR> d-------- C:\ProgramData\STOPzilla! 2008-03-20 14:00 . 2008-03-20 14:00 <DIR> d-------- C:\Program Files\Common Files\iS3 2008-03-11 16:53 . 2007-09-12 18:58 58,792 --a------ C:\Windows\System32\wbload.dll 2008-03-11 16:53 . 2007-07-11 15:06 42,672 --a------ C:\Windows\System32\wbsys.dll 2008-03-11 15:52 . 2008-03-11 15:52 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-03-11 10:53 . 2006-11-29 14:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll 2008-03-11 10:52 . 2008-03-11 10:52 <DIR> d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-03-11 10:50 . 2008-03-11 10:50 <DIR> d-------- C:\Program Files\Windows Live Favorites 2008-03-11 10:43 . 2008-03-11 10:48 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) . 2008-04-11 09:51 --------- d-----w C:\ProgramData\Google Updater 2008-04-09 00:58 --------- d-----w C:\Program Files\Windows Mail 2008-04-09 00:12 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-08 23:39 615,424 ----a-w C:\Windows\System32\themeui.dll 2008-04-08 23:39 240,640 ----a-w C:\Windows\System32\uxtheme.dll 2008-04-08 23:32 21,936,640 ----a-w C:\Windows\System32\imageres.dll 2008-04-01 03:37 --------- d-----w C:\Program Files\Java 2008-03-30 12:32 --------- d-----w C:\ProgramData\NVIDIA 2008-03-30 09:56 174 --sha-w C:\Program Files\desktop.ini 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Journal 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Defender 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Collaboration 2008-03-30 09:46 --------- d-----w C:\Program Files\Windows Calendar 2008-03-30 09:25 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-03-30 09:25 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-03-29 17:45 1,146,232 ----a-w C:\Windows\System32\aswBoot.exe 2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys 2008-03-29 17:29 23,152 ----a-w C:\Windows\system32\drivers\aswRdr.sys 2008-03-29 17:27 42,912 ----a-w C:\Windows\system32\drivers\aswTdi.sys 2008-03-29 17:23 95,608 ----a-w C:\Windows\System32\AvastSS.scr 2008-03-15 00:42 --------- d-----w C:\Program Files\Windows Live 2008-03-12 23:34 --------- d-----w C:\Users\Simes\AppData\Roaming\uTorrent 2008-03-11 20:27 --------- d-----w C:\Users\Simes\AppData\Roaming\LimeWire 2008-03-11 09:52 --------- d-----w C:\Program Files\Windows Live Toolbar 2008-03-11 09:42 --------- d-----w C:\ProgramData\WLInstaller 2008-03-06 22:40 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-03-05 07:59 --------- d-----w C:\ProgramData\Windows Live Toolbar 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-26 04:54 43,520 ----a-w C:\Windows\system32\drivers\fetnd5bv.sys 2008-02-25 18:21 --------- d-----w C:\Program Files\iTunes 2008-02-25 18:21 --------- d-----w C:\Program Files\iPod 2008-02-25 18:19 --------- d-----w C:\Program Files\QuickTime 2008-02-24 17:01 --------- d-----w C:\Program Files\LimeWire 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-20 08:31 69,414 ----a-w C:\Windows\System32\uninst.exe 2008-02-20 08:31 --------- d-----w C:\Program Files\Shutdown Logoff Reboot ActiveX 2008-02-17 20:33 --------- d-----w C:\Program Files\AOL 9.0 VR 2008-02-17 19:04 --------- d-----w C:\Users\Vile\AppData\Roaming\AVG7 2008-02-17 19:03 --------- d-----w C:\ProgramData\Avg7 2008-02-17 19:00 --------- d-----w C:\Program Files\Alwil Software 2008-02-15 08:05 --------- d-----w C:\Program Files\DFX 2008-02-15 08:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-01 11:11 586,240 ----a-w C:\Windows\WLXPGSS.SCR 2008-01-19 07:43 376,376 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll 2008-01-19 07:43 3,548,728 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-01-19 07:42 94,776 ----a-w C:\Windows\System32\MigAutoPlay.exe 2008-01-19 07:42 247,352 ----a-w C:\Windows\System32\clfs.sys 2008-01-19 07:42 177,208 ----a-w C:\Windows\System32\halmacpi.dll 2008-01-19 07:42 141,880 ----a-w C:\Windows\System32\halacpi.dll 2008-01-19 07:41 24,120 ----a-w C:\Windows\System32\BOOTVID.DLL 2008-01-19 07:41 21,560 ----a-w C:\Windows\System32\kdusb.dll 2008-01-19 07:41 19,512 ----a-w C:\Windows\System32\kdcom.dll 2008-01-19 07:38 46,080 ----a-w C:\Windows\System32\NAPCRYPT.DLL 2008-01-19 07:38 4,595,712 ----a-w C:\Windows\System32\AuthFWSnapin.dll 2008-01-19 07:38 242,744 ----a-w C:\Windows\System32\rsaenh.dll 2008-01-19 07:38 155,704 ----a-w C:\Windows\System32\dssenh.dll 2008-01-19 07:38 131,640 ----a-w C:\Windows\System32\basecsp.dll 2008-01-19 07:38 103,936 ----a-w C:\Windows\System32\NAPHLPR.DLL 2008-01-19 07:38 1,203,792 ----a-w C:\Windows\System32\ntdll.dll 2008-01-19 07:36 996,352 ----a-w C:\Windows\System32\WMNetMgr.dll 2008-01-19 07:35 98,304 ----a-w C:\Windows\System32\mssitlb.dll 2008-01-19 07:34 98,816 ----a-w C:\Windows\System32\mfps.dll 2008-01-19 07:33 98,304 ----a-w C:\Windows\System32\makecab.exe 2008-01-19 07:32 879,616 ----a-w C:\Windows\System32\Bubbles.scr 2008-01-19 07:32 704,512 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2008-01-19 07:32 5,714,432 ----a-w C:\Windows\System32\logon.scr 2008-01-19 07:32 258,048 ----a-w C:\Windows\System32\winspool.drv 2008-01-19 07:32 221,184 ----a-w C:\Windows\System32\Mystify.scr 2008-01-19 07:32 220,672 ----a-w C:\Windows\System32\Ribbons.scr 2008-01-19 07:32 21,504 ----a-w C:\Windows\System32\msacm32.drv 2008-01-19 07:32 166,912 ----a-w C:\Windows\System32\wdmaud.drv 2008-01-19 07:32 1,370,624 ----a-w C:\Windows\System32\Aurora.scr 2008-01-19 07:31 7,680 ----a-w C:\Windows\System32\spwizres.dll 2008-01-19 07:31 57,856 ----a-w C:\Windows\System32\nlsbres.dll 2008-01-19 07:31 118,272 ----a-w C:\Windows\System32\RDPENCDD.dll 2008-01-19 07:30 17,920 ----a-w C:\Windows\System32\netevent.dll 2008-01-19 07:29 705,536 ----a-w C:\Windows\System32\imagesp1.dll 2008-01-19 07:29 58,880 ----a-w C:\Windows\System32\msobjs.dll 2008-01-19 07:28 7,168 ----a-w C:\Windows\System32\f3ahvoas.dll 2008-01-19 07:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-01-19 06:01 14,336 ----a-w C:\Windows\System32\tsddd.dll 2008-01-19 06:01 134,656 ----a-w C:\Windows\System32\rdpdd.dll 2008-01-19 05:52 56,320 ----a-w C:\Windows\System32\vga256.dll 2008-01-19 05:52 21,504 ----a-w C:\Windows\System32\vga64k.dll 2008-01-19 05:52 11,776 ----a-w C:\Windows\System32\framebuf.dll 2008-01-19 05:52 10,752 ----a-w C:\Windows\System32\vga.dll 2008-01-19 05:50 14,848 ----a-w C:\Windows\System32\iscsilog.dll . (((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))) ))))))) . ---- Directory of C:\nav-update ---- 2008-04-09 00:35 1078420 --a------ C:\nav-update\VistaGlazzSetup.exe 2008-04-02 20:03 0 --a------ C:\nav-update\PopupSecure.exe 2008-03-26 16:21 6057132 --a------ C:\nav-update\UPDATE_V2100_297.exe ((((((((((((((((((((((((((((( snapshot@2008-04-11_ 6.49.48.20 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-11 04:02:21 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-04-11 17:05:45 67,584 --s-a-w C:\Windows\bootstat.dat - 2008-04-11 05:44:22 53,248 ----a-w C:\Windows\PSEXESVC.EXE + 2008-04-11 17:22:44 53,248 ----a-w C:\Windows\PSEXESVC.EXE - 2008-04-11 05:17:36 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\Microsoft\Windows\usrclass.dat + 2008-04-11 17:21:02 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Lo cal\Microsoft\Windows\usrclass.dat - 2008-04-11 04:04:43 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-04-11 17:07:24 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT - 2008-04-11 05:40:19 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Local\Microsoft\Windows\usrclass.dat + 2008-04-11 17:17:14 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\ Local\Microsoft\Windows\usrclass.dat - 2008-04-11 04:04:38 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.D AT + 2008-04-11 17:07:18 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.D AT + 2008-04-11 17:07:18 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.d at.LOG1 - 2008-04-11 04:04:12 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at + 2008-04-11 17:06:30 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\History\History.IE5\index.d at - 2008-04-11 04:04:12 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-04-11 17:06:30 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\L ocal\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-04-11 04:04:12 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat + 2008-04-11 17:06:30 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\R oaming\Microsoft\Windows\Cookies\index.dat - 2008-04-09 02:13:03 9,584 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1821962517-124290910-3490180065-1003_UserData.bin + 2008-04-11 17:07:37 9,608 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1821962517-124290910-3490180065-1003_UserData.bin - 2008-04-11 04:05:19 64,800 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics _SystemData.bin + 2008-04-11 17:07:37 64,816 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics _SystemData.bin - 2008-04-09 15:48:27 57,972 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnos tics_SystemData.bin + 2008-04-11 17:07:35 58,126 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnos tics_SystemData.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4
|
|
#14
April 11th, 2008, 06:37 PM
|
|||
|
|||
|
ComboFix (2)
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-08-27 21:27 68856] "UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe" [2007-08-17 19:10 159744] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 11:12 695808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 08:38 1008184] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-09 10:57 3784704 C:\Windows\RtHDVCpl.exe] "HostManager"="C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe" [2006-11-14 15:01 50736] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 11:40 232184] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312] "ZPLED"="C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe" [2006-02-21 07:36 347648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 16:02 563984] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 16:06 2027792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-12 06:28 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-12 06:28 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray. dll" [2007-09-12 06:28 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336] C:\Users\Simes\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM 3450608] C:\Users\Vile\AppData\Roaming\Microsoft\Windows\St art Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [9/6/2007 1:34:55 PM 3450608] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [8/27/2007 9:27:36 PM 124912] [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpo licy\FirewallRules] "{F1A39805-9129-40C9-9D62-1F089F28431E}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler "{E5E6C791-A413-4093-94AA-4D9743A21AAB}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Connectivity Service Dialler "{1F265EE6-34B0-446D-8D19-9BFF18E93194}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services "{3083F52B-8100-4B16-BF34-0D0A8958299F}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Connectivity Services "{84C9B841-D3C4-4E4B-8D52-006D997A56AE}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL "{57BAACD9-725C-4F6C-8723-77CC78923AF0}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL "{34D7DF6C-945E-4FDD-B57E-E2B94D75DE65}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed "{D01EEF7D-3F5F-4244-81EE-504CF62B3607}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed "{323ADFCA-8888-452F-894C-54CCF5475F79}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader "{EC5F4FA8-7167-4279-9372-385EE4D1A473}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader "{D4341B99-BD29-4B6F-B766-0BA7C84893A7}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information "{C2E5407B-81A6-4D0F-A46B-0EFE7D27E251}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information "{0144BEC3-8707-4D02-81D2-C6BB9906EC26}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{42E1FA8D-1CE7-4936-8F85-06714C0CCF56}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{FA70FEBB-B1A0-44C5-9F77-E34C700AC627}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxb cpswx.exe:Printer Status Window "{DA10CEF0-1668-4EC9-AC67-517F03AE8832}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxb cpswx.exe:Printer Status Window "{7DBAD7E5-DAED-428A-A8C3-5E38247F45FE}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{F301911F-B415-4521-AA57-51EA3427D064}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{ADDCE154-83EA-40F3-B2F5-C398B2C956B8}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{00ACE8CA-D4FB-42DC-B417-49A1F4EAC79A}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{0E44B8C6-8507-4021-BF36-D29CDE1D6993}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{12D6D331-8B61-4FB6-82CB-C3AD61F75A24}"= UDP:C:\Windows\System32\lxbccoms.exe:Lexmark Communications System "{92F066A9-4A09-406A-9E33-0A146D616E5D}"= TCP:C:\Windows\System32\lxbccoms.exe:Lexmark Communications System "TCP Query User{99AECBDB-9C23-44BF-B951-5ED1740E949B}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{8737DD94-9CB7-495E-87A2-FE02B57C1CEE}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{60A78BBC-32B6-4774-A4F4-66467E8137A6}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire "UDP Query User{A824382E-3020-4DAA-B067-E3A5FD242B60}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire "{BB7EB973-27CE-48B5-807E-992C2B65D7D3}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{B1A5FAD4-B536-47AF-B66D-DB4080FD0815}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{24A6AD5F-D4F1-4FD3-BA8D-54108510609B}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "{4973EB2A-6E3A-4C77-BC52-F36A8E152419}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{E1C61C59-BA73-4FCB-AD7E-EA77F2385FB5}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{2CD5A0BA-DC6E-4D00-9A83-190B6869D80D}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "TCP Query User{FF9CD70E-7325-4B40-A7E5-06200E20886F}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{53280BDD-9CF8-42EC-A2C6-5EA0E4D94134}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{8AE1A76F-17B6-4574-9A51-C3A75B49EE2F}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{6E57F6DB-0360-47CF-951D-2767A6C9CF39}C:\\users\\simes\\appdata\\local\\tem p\\wzse0.tmp\\symnrt.exe"= UDP:C:\users\simes\appdata\local\temp\wzse0.tmp\sy mnrt.exe:symnrt.exe "UDP Query User{45CBC18E-99AE-40E7-AC1E-C5B56DC4C08E}C:\\users\\simes\\appdata\\local\\tem p\\wzse0.tmp\\symnrt.exe"= TCP:C:\users\simes\appdata\local\temp\wzse0.tmp\sy mnrt.exe:symnrt.exe [HKLM\~\services\sharedaccess\parameters\firewallpo licy\StandardProfile\GloballyOpenPorts\List] "123:UDP"= 123:UDP:*:Enabled:NTP R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 18:31] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswF sBlk.sys [2008-03-29 18:35] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\as wMonFlt.sys [2008-03-29 18:32] R2 lxbc_device;lxbc_device;C:\Windows\system32\lxbcco ms.exe [2007-03-16 01:24] R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 08:33] R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 08:33] R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:54] S2 MyWebSearchService;My Web Search Service;C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwssvc.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{17eb75ee-5582-11dc-a2ed-00038a000015}] \shell\AutoRun\command - I:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-04-11 16:32:05 C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2008-04-07 19:00:01 C:\Windows\Tasks\Norton Security Online - Run Full System Scan - Simes.job" - C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeB/TASK: "2008-04-11 17:00:00 C:\Windows\Tasks\Recovery DVD Creator.job" - C:\Program Files\Packard Bell\SetupMyPc\MCDCheck.exe . ************************************************** ************************ catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-11 18:23:26 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************** ************************ . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\Windows\Explorer.exe -> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll -> C:\Program Files\UberIcon\UberIcon.dll . Completion time: 2008-04-11 18:30:00 ComboFix-quarantined-files.txt 2008-04-11 17:29:00 ComboFix2.txt 2008-04-11 05:53:36 Pre-Run: 180,541,423,616 bytes free Post-Run: 179,982,979,072 bytes free . 2008-04-09 00:12:04 --- E O F ---
|
|
#15
April 11th, 2008, 07:00 PM
|
|||
|
|||
|
DSS main.txt (1)
Deckard's System Scanner v20071014.68
Run by Simes on 2008-04-11 18:38:14 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 1022 MiB (1024 MiB recommended). -- HijackThis (run as Simes.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:38:41, on 11/04/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\aol\1183532771\ee\aolsoftware.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\WindowsMobile\wmdc.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\UberIcon\UberIcon Manager.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Windows\System32\notepad.exe C:\Windows\system32\conime.exe C:\Windows\Explorer.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Simes\Desktop\dss.exe C:\Users\Simes\Desktop\Simes.exe C:\Windows\system32\taskmgr.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ig?hl=en R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\sw g.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1183532771\ee\AOLSoftware.exe O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ZPLED] C:\Program Files\Wireless\RF Keyboard\1.0\ZPKBDLED.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe O4 - HKCU\..\Run: [UberIcon] "C:\Program Files\UberIcon\UberIcon Manager.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user') O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing) O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (file missing) O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL O15 - Trusted Zone: http://www.gaydar.co.uk O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: lxbc_device - - C:\Windows\system32\lxbccoms.exe O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\5.bin\mwssvc.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- End of file - 10981 bytes -- Files created between 2008-03-11 and 2008-04-11 ----------------------------- 2008-04-10 16:06:25 68096 --a------ C:\Windows\zip.exe 2008-04-10 16:06:25 49152 --a------ C:\Windows\VFind.exe 2008-04-10 16:06:25 212480 --a------ C:\Windows\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-04-10 16:06:25 136704 --a------ C:\Windows\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-04-10 16:06:25 161792 --a------ C:\Windows\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-04-10 16:06:25 98816 --a------ C:\Windows\sed.exe 2008-04-10 16:06:25 80412 --a------ C:\Windows\grep.exe 2008-04-10 16:06:25 73728 --a------ C:\Windows\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-04-09 03:08:55 0 -rahs---- C:\MSDOS.SYS 2008-04-09 03:08:55 0 -rahs---- C:\IO.SYS 2008-04-09 02:42:31 0 d-------- C:\Users\All Users\eSellerate 2008-04-09 02:32:49 0 d-------- C:\Users\All Users\TEMP 2008-04-09 02:32:46 494352 --a------ C:\Windows\system32\SHDOC401.DLL <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> 2008-04-09 02:32:46 53248 --a------ C:\Windows\system32\ArmAccess.dll 2008-04-09 02:32:45 0 d-------- C:\Program Files\1 Click PC Fix 2008-04-08 23:58:53 2560 --a------ C:\Windows\_MSRSTRT.EXE 2008-03-31 19:34:08 0 d-------- C:\Program Files\Safari 2008-03-30 10:45:59 0 d-------- C:\PerfLogs 2008-03-30 10:10:14 240640 --a------ C:\Windows\system32\uxtheme.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-30 10:09:08 615424 --a------ C:\Windows\system32\themeui.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-03-26 16:20:25 0 d-------- C:\nav-update 2008-03-25 22:48:46 12 --a------ C:\Windows\bthservsdp.dat 2008-03-20 14:04:08 0 d-------- C:\Users\All Users\SITEguard 2008-03-20 14:00:32 0 d-------- C:\Program Files\Common Files\iS3 2008-03-20 14:00:28 0 d-------- C:\Users\All Users\STOPzilla! 2008-03-11 15:52:28 0 d-------- C:\Program Files\Common Files\Adobe 2008-03-11 10:52:44 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-03-11 10:50:53 0 d-------- C:\Program Files\Windows Live Favorites 2008-03-11 10:43:52 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller -- Find3M Report --------------------------------------------------------------- 2008-04-09 01:58:20 0 d-------- C:\Program Files\Windows Mail 2008-04-09 00:32:59 21936640 --a------ C:\Windows\system32\imageres.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-04-01 04:37:05 0 d-------- C:\Program Files\Java 2008-03-30 10:56:14 174 --ahs---- C:\Program Files\desktop.ini 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Sidebar 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Collaboration 2008-03-30 10:46:50 0 d-------- C:\Program Files\Windows Calendar 2008-03-30 10:46:50 0 d-------- C:\Program Files\Movie Maker 2008-03-30 10:46:49 0 d-------- C:\Program Files\Windows Photo Gallery 2008-03-30 10:46:49 0 d-------- C:\Program Files\Windows Journal 2008-03-30 10:46:48 0 d-------- C:\Program Files\Windows Defender 2008-03-20 14:00:32 0 d-------- C:\Program Files\Common Files 2008-03-15 01:42:48 0 d-------- C:\Program Files\Windows Live 2008-03-13 00:34:58 0 d-------- C:\Users\Simes\AppData\Roaming\uTorrent 2008-03-11 21:27:34 0 d-------- C:\Users\Simes\AppData\Roaming\LimeWire 2008-03-11 10:52:18 0 d-------- C:\Program Files\Windows Live Toolbar 2008-03-06 23:40:48 0 d-------- C:\Program Files\Microsoft Silverlight 2008-02-26 14:25:50 0 d-------- C:\Users\Simes\AppData\Roaming\Adobe 2008-02-25 19:21:35 0 d-------- C:\Program Files\iTunes 2008-02-25 19:21:25 0 d-------- C:\Program Files\iPod 2008-02-25 19:19:30 0 d-------- C:\Program Files\QuickTime 2008-02-24 18:01:05 0 d-------- C:\Program Files\LimeWire 2008-02-20 09:31:21 69414 --a------ C:\Windows\system32\uninst.exe 2008-02-20 09:31:21 0 d-------- C:\Program Files\Shutdown Logoff Reboot ActiveX 2008-02-17 21:33:19 0 d-------- C:\Program Files\AOL 9.0 VR 2008-02-17 20:00:23 0 d-------- C:\Program Files\Alwil Software 2008-02-15 09:05:17 0 d-------- C:\Program Files\DFX 2008-02-15 09:04:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-01 12:11:10 586240 --a------ C:\Windows\WLXPGSS.SCR <Not Verified; Microsoft Corporation; Windows Live Photo Gallery>
|
|
| Bookmarks |
«
Previous Topic
|
Next Topic
»
| Topic Tools | |
|
|
Similar Topics
|
||||
| Topic | Topic Starter | Forum | Replies | Last Post |
| rundll32 error | Total Noob | Windows Vista | 1 | December 20th, 2016 05:39 PM |
| Rundll32.exe Error and More. | Nicholas_Roge | Malware Removal | 7 | June 6th, 2008 04:16 AM |
| Error for rundll32.exe | BoBrooke | Windows XP | 3 | March 5th, 2007 05:41 PM |
| 16 bit MS DOS & Rundll32 error | richie1242 | Windows XP | 0 | July 27th, 2004 03:51 AM |
| Rundll32.exe error HELP | Johnny K | Windows XP | 0 | May 12th, 2004 11:10 PM |
All times are GMT +1. The time now is 02:44 AM.