[Resolved] Avi and explorer.exe error

Welcome! Register for a free account (or login) > How does it work?

Quickly register. It will only take 60 seconds.
Start a new topic. Ask your question. Wait for an email reply.
Is your system infected? Begin reading the malware removal guide.

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

2 Pages

1 2 >

[Resolved] Avi and explorer.exe error

Options

grave View Member Profile	Jul 4 2009, 08:56 AM Post #1
Authentic Member Group: Authentic Member Posts: 43 Joined: 21-August 07 Member No.: 72,314 Operating System: windows xp	Every time I open a folder with an avi file in it I get an explorer.exe error message that reads "windows explorer has encountered a problem and needs to close." Im running Windows xp w/ service pack 3. If anyone can help me I posted my Hijackthis log. Thanks in advance. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:20:04 AM, on 7/4/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\Shared Files\CTDevSrv.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\WINDOWS\system32\NMSAccess.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\VTTimer.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\HP\KBD\KBD.EXE C:\windows\system\hpsysdrv.exe C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn6\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn6\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BTjunkie Toolbar - {1a71246c-3eb0-4d6c-af77-3ab756017c3a} - C:\Program Files\BTjunkie\tbBTju.dll O2 - BHO: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn6\YTSingleInstance.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: BellSouth Toolbar - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\PROGRA~1\BLSTOO~1\BLSTOO~1.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn6\yt.dll O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll O3 - Toolbar: BTjunkie Toolbar - {1a71246c-3eb0-4d6c-af77-3ab756017c3a} - C:\Program Files\BTjunkie\tbBTju.dll O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini" O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1112078643\EE\AOLHostManager.exe O4 - HKLM\..\Run: [BellSouthAlertManager.exe] "C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe" /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [CamserviceDP] C:\Program Files\Hercules\DualPix Exchange\Camservice.exe /startup O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Hellhound\Application Data\mjusbsp\cdloader2.exe" MAGICJACK O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; PeoplePal 3.0; .NET CLR 2.0.50727)" -"http://games.myspace.com/MySpace2.0/App/GameShell.aspx?cx=600000&cn=SD%3dLCD5GjzfiiTrsVRCuUKmsh1Vv%2bW0hw5Mu069MOHcPPAnAuG8U2A6NYnYL0f64xVu%26LT%3d0%26CL%3dC%26TO%3d1244385052%26A%3dkb9vBp3yfcpWN9aAWmk8ydrtIPE%3d%26SA%3dkb9vBp3yfcpWN9aAWmk8ydrtIPE%3d&rx=1200000&rn=SD%3dLCD5GjzfiiTrsVRCuUKmsh1Vv%2bW0hw5Mu069MOHcPPAnAuG8U2A6NYnYL0f64xVu%26LT%3d0%26CL%3dR%26TO%3d1244385652%26A%3d3Y%2fUq%2fnhOqrATUBFK%2fIYzbgJ028%3d%26SA%3d3Y%2fUq%2fnhOqrATUBFK%2fIYzbgJ028%3d&ui=33jt6ztoql0t%2fIzg7QXz0N3qwBk%3d&ux=86400000&un=DA%3d%26SD%3dLCD5GjzfiiTrsVRCuUKmsh1Vv%2bW0hw5Mu069MOHcPPAnAuG8U2A6NYnYL0f64xVu%26LT%3d0%26CL%3dU%26TO%3d1244470852%26A%3d98jOSZrl0EmgrOIDFwCPrzLKqyg%3d%26SA%3d98jOSZrl0EmgrOIDFwCPrzLKqyg%3d&room=0fcd4c29-7e98-44f9-af0c-c189860d6335&code=113398277&channel=110343720&lc=en&refid=&device=-1&carrier O4 - HKUS\S-1-5-19\..\Run: [pofufemive] Rundll32.exe "C:\WINDOWS\system32\yajosofo.dll",s (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [pofufemive] Rundll32.exe "C:\WINDOWS\system32\yajosofo.dll",s (User 'NETWORK SERVICE') O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - http://ea-src-cdn.systemrequirementslab.co...reqlab_srlx.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1229297256000 O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O16 - DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} (CPlayFirstSandScriptControl Object) - http://www.shockwave.com/content/sandscrip...pt.1.0.0.21.cab O16 - DPF: {E85362EF-40D4-4E5D-BE07-D6B036CCA277} (GoPets Control) - https://secure.gopetslive.com/dev/gopets.cab O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: Creative Centrale Media Server (CTUPnPSv) - Creative Technology Ltd - C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: NMSAccess - Unknown owner - C:\WINDOWS\system32\NMSAccess.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- End of file - 11812 bytes

CatByte View Member Profile	Jul 4 2009, 07:19 PM Post #2
Classroom Administrator Group: Classroom Admin Posts: 9,584 Joined: 18-November 04 From: Canada Member No.: 18,614 Operating System: xp sp3	Hi and Welcome, NOTE: Malware removal is NOT instantaneous, most infections require more than one round to properly eradicate. Absence of symptoms does not always mean the job is complete, you can be certain that I will advise you when the computer is clean. Kindly follow my instructions in the order posted. Please DO NOT run any scans or fix items without my direction. Please do the following: STEP #1 Please download DDS and save it to your desktop. Disable any script blocking protection Double click dds.pif to run the tool. When done, two DDS.txt's will open. Save both reports to your desktop. --------------------------------------------------- Please include the contents of the following in your next reply: DDS.txt Attach.txt. STEP #2 Download GMER Rootkit Scanner from here or here. Extract the contents of the zipped file to desktop. Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent . If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO. Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Uncheck the following ... Sections IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) Then click the Scan button & wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop, and attach it in reply. Caution Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

CatByte View Member Profile	Jul 5 2009, 11:40 AM Post #4
Classroom Administrator Group: Classroom Admin Posts: 9,584 Joined: 18-November 04 From: Canada Member No.: 18,614 Operating System: xp sp3	Hi, Please do the following: Download ComboFix from one of these locations: Link 1 Link 2 Link 3 VERY IMPORTANT !!! Save ComboFix.exe to your Desktop * IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions. Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now**

grave View Member Profile	Jul 5 2009, 01:01 PM Post #5
Authentic Member Group: Authentic Member Posts: 43 Joined: 21-August 07 Member No.: 72,314 Operating System: windows xp	the computer is running much faster now, but i am still having the explorer.exe error when i open folders with .avi files. i've attached the combo fix log for you. ComboFix 09-07-04.09 - Hellhound 07/05/2009 14:39.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2512 [GMT -4:00] Running from: c:\documents and settings\Hellhound\Desktop\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090704-0] On-access scanning disabled (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: ZoneAlarm Firewall disabled {829BDA32-94B3-44F4-8446-F8FCFF809F8B} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\HELLHO~1\APPLIC~1\inst.exe c:\documents and settings\Owner\Application Data\inst.exe c:\program files\INSTALL.LOG c:\windows\Installer\24368.msi c:\windows\Installer\24376.msi c:\windows\patch.exe c:\windows\system32\qjsqxaoe.ini . ((((((((((((((((((((((((( Files Created from 2009-06-05 to 2009-07-05 ))))))))))))))))))))))))))))))) . 2009-07-04 13:36 . 2009-03-06 14:22 284160 -c----w- c:\windows\system32\dllcache\pdh.dll 2009-07-04 13:36 . 2009-02-09 12:10 729088 -c----w- c:\windows\system32\dllcache\lsasrv.dll 2009-07-04 13:36 . 2009-02-09 12:10 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll 2009-07-04 13:36 . 2009-02-09 12:10 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll 2009-07-04 13:36 . 2009-02-09 12:10 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll 2009-07-04 13:36 . 2009-02-09 12:10 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll 2009-07-04 13:36 . 2009-02-06 11:11 110592 -c----w- c:\windows\system32\dllcache\services.exe 2009-07-04 13:36 . 2009-02-06 10:10 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe 2009-07-04 13:36 . 2009-02-09 12:10 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll 2009-07-04 13:36 . 2009-02-06 11:08 2189056 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe 2009-07-04 13:36 . 2009-02-06 11:06 2145280 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-07-04 13:35 . 2009-02-06 10:32 2023936 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe 2009-07-04 13:35 . 2008-05-08 14:02 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys 2009-07-04 13:35 . 2008-10-24 11:21 455296 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2009-07-04 13:35 . 2008-06-13 11:05 272128 -c----w- c:\windows\system32\dllcache\bthport.sys 2009-07-04 13:23 . 2008-12-11 10:57 333952 -c----w- c:\windows\system32\dllcache\srv.sys 2009-07-04 13:23 . 2008-05-01 14:33 331776 -c----w- c:\windows\system32\dllcache\msadce.dll 2009-07-04 13:23 . 2008-04-11 19:04 691712 -c----w- c:\windows\system32\dllcache\inetcomm.dll 2009-07-04 13:22 . 2008-10-15 16:34 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll 2009-07-04 13:21 . 2008-09-04 17:15 1106944 -c----w- c:\windows\system32\dllcache\msxml3.dll 2009-07-04 13:21 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2009-07-04 13:21 . 2008-04-21 12:08 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe 2009-07-03 20:18 . 2009-07-03 20:18 -------- d-----w- c:\program files\Aspell 2009-07-03 18:24 . 2009-07-03 18:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype 2009-07-03 18:14 . 2009-05-26 23:50 607472 ----a-w- c:\documents and settings\All Users\Application Data\yahoo!\YUpdater\yupdater.exe 2009-07-03 18:01 . 2007-05-29 16:23 94208 ----a-w- c:\windows\system32\drivers\camfilt2.sys 2009-07-03 18:01 . 2007-05-25 22:37 167936 ----a-w- c:\windows\system32\rsnp2uvc.dll 2009-07-03 18:01 . 2007-05-16 19:33 299008 ----a-w- c:\windows\system32\vsnp2uvc.dll 2009-07-03 18:01 . 2007-05-16 17:02 9602944 ----a-w- c:\windows\system32\drivers\snp2uvc.sys 2009-07-03 18:01 . 2007-05-09 19:16 28160 ----a-w- c:\windows\system32\drivers\sncduvc.sys 2009-07-03 18:01 . 2005-11-23 17:55 53248 ----a-w- c:\windows\system32\csnp2uvc.dll 2009-07-03 18:00 . 2006-08-01 16:31 3600384 ----a-w- c:\windows\ffmpeg.exe 2009-07-03 18:00 . 2009-07-03 18:01 -------- d-----w- c:\windows\system32\HWC HD 2009-07-03 18:00 . 2009-07-03 18:00 -------- d-----w- c:\program files\Hercules 2009-07-03 18:00 . 2009-07-03 18:00 -------- d-----w- c:\docume~1\HELLHO~1\APPLIC~1\InstallShield 2009-06-30 04:36 . 2008-04-13 23:11 21504 -c--a-w- c:\windows\system32\dllcache\hidserv.dll 2009-06-30 04:36 . 2008-04-13 23:11 21504 ----a-w- c:\windows\system32\hidserv.dll 2009-06-27 16:14 . 2009-06-27 16:15 -------- d-----w- c:\program files\Fast AVI MPEG Joiner 2009-06-27 14:36 . 2009-06-27 14:36 -------- d-----w- c:\program files\Common Files\Common Share 2009-06-27 14:35 . 2009-06-27 14:35 -------- d-----w- c:\program files\RER 2009-06-27 09:34 . 2009-06-27 09:34 -------- d-----w- c:\program files\Gabest 2009-06-27 09:34 . 2009-06-27 12:12 -------- d-----w- c:\program files\Xvid 2009-06-27 09:34 . 2009-07-02 16:54 -------- d-----w- c:\program files\AviSynth 2.5 2009-06-22 03:46 . 2009-06-22 03:46 -------- d-----w- c:\docume~1\HELLHO~1\APPLIC~1\rockbox.org 2009-06-13 04:46 . 2009-06-21 05:50 -------- d-----w- c:\docume~1\HELLHO~1\APPLIC~1\gtk-2.0 2009-06-13 03:32 . 2009-07-04 08:21 -------- d-----w- c:\docume~1\HELLHO~1\APPLIC~1\.purple 2009-06-13 03:29 . 2009-07-03 20:18 -------- d-----w- c:\program files\Pidgin 2009-06-13 03:28 . 2009-07-03 20:17 -------- d-----w- c:\program files\Common Files\GTK 2009-06-09 07:36 . 2009-06-09 07:36 10134 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe 2009-06-09 07:36 . 2009-06-09 07:36 -------- d-----w- c:\program files\Microsoft WSE 2009-06-09 06:30 . 2009-06-09 06:30 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\tjnet 2009-06-09 02:13 . 2009-06-09 02:13 47360 ----a-w- c:\documents and settings\Owner\Application Data\pcouffin.sys 2009-06-09 01:42 . 2009-04-10 13:58 6327408 ---ha-w- c:\documents and settings\Owner\Application Data\mjusbsp\in00000\setup.exe 2009-06-09 01:42 . 2009-04-10 13:58 6327408 ---ha-w- c:\documents and settings\Owner\Application Data\mjusbsp\Upgrade\setup1.exe 2009-06-09 01:42 . 2009-04-10 13:55 725296 ---ha-w- c:\documents and settings\Owner\Application Data\mjusbsp\Upgrade\install1.exe 2009-06-09 01:41 . 2009-06-09 01:42 7685232 ---h--w- c:\documents and settings\Owner\Application Data\mjusbsp\ar00000\upgrade.exe 2009-06-09 01:41 . 2008-02-29 12:42 386496 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\ar00000\magicJackSplash.exe 2009-06-09 01:41 . 2009-06-09 01:42 -------- d-----w- c:\documents and settings\Owner\Application Data\mjusbsp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-05 18:44 . 2007-08-21 14:51 665485344 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-07-05 11:08 . 2007-08-21 14:51 7800884 --sha-w- c:\windows\system32\drivers\fidbox.idx 2009-07-03 19:05 . 2008-09-02 01:12 -------- d-----w- c:\docume~1\HELLHO~1\APPLIC~1\mjusbsp 2009-07-03 18:15 . 2007-06-24 01:05 -------- d--h--r- c:\documents and settings\All Users\Application Data\yahoo! 2009-07-03 18:15 . 2004-06-11 19:47 -------- d-----w- c:\program files\Yahoo! 2009-07-03 18:15 . 2005-08-31 03:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2009-07-03 18:00 . 2004-01-26 12:22 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-03 11:57 . 2008-07-18 07:09 -------- d-----w- c:\docume~1\HELLHO~1\APPLIC~1\uTorrent 2009-07-02 16:29 . 2007-09-16 21:14 63047686 ----a-w- c:\windows\Internet Logs\tvDebug.zip 2009-06-09 08:00 . 2004-06-29 03:46 110424 -c--a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-09 07:18 . 2008-01-18 22:48 -------- d-----w- c:\program files\Electronic Arts 2009-06-09 02:47 . 2004-01-26 12:29 -------- d-----w- c:\program files\Common Files\Real 2009-06-09 02:43 . 2004-01-26 11:11 -------- d-----w- c:\program files\HP 2009-06-09 02:42 . 2005-12-28 01:01 -------- d-----w- c:\program files\Max Media Creator 2009-06-09 02:19 . 2007-02-02 15:16 -------- d-----w- c:\program files\Google 2009-06-09 02:15 . 2006-12-15 23:46 -------- d-----w- c:\program files\DVDFab Decrypter 2009-06-09 02:13 . 2006-12-27 22:35 -------- d-----w- c:\documents and settings\Owner\Application Data\Vso 2009-06-09 02:06 . 2006-04-01 22:34 -------- d-----w- c:\program files\Canon 2009-06-09 02:04 . 2004-08-11 05:24 -------- d-----w- c:\program files\AIM 2009-06-09 02:03 . 2005-06-28 02:57 -------- d-----w- c:\program files\A+ 2003 2009-06-08 12:08 . 2007-08-15 22:50 -------- d-----w- c:\documents and settings\Owner\Application Data\uTorrent 2009-06-05 03:57 . 2009-06-05 03:57 -------- d-----w- c:\program files\BTjunkie 2009-06-05 03:57 . 2008-03-04 20:43 -------- d-----w- c:\program files\Conduit 2009-06-01 18:47 . 2009-06-01 18:39 -------- d-----w- c:\program files\Ultra Tag Editor 2009-04-29 04:56 . 2004-01-21 20:16 827392 ----a-w- c:\windows\system32\wininet.dll 2009-04-29 04:55 . 2004-09-09 05:14 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-04-28 19:10 . 2004-09-09 11:35 110424 -c--a-w- c:\documents and settings\Hellhound\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-19 22:50 . 2007-08-26 16:37 717296 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-04-17 12:26 . 2004-01-26 08:11 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-10 13:58 . 2009-04-10 13:58 86360 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\ug00000\magicJack.dll 2009-04-10 13:58 . 2009-04-10 13:58 6327408 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\ug00000\setup.exe 2009-04-10 13:58 . 2009-04-10 13:58 412784 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\magicJackLoader.exe 2009-04-10 13:58 . 2009-04-10 13:58 480608 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\octvqe1_apiw.dll 2009-04-10 13:58 . 2009-04-10 13:58 214360 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\TjVista.dll 2009-04-10 13:58 . 2009-04-10 13:58 325040 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\TjIpSys.dll 2009-04-10 13:57 . 2009-04-10 13:57 398696 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\SJHandsetTigerJet.dll 2009-04-10 13:57 . 2009-04-10 13:57 87384 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\st00000\mjsetup.exe 2009-04-10 13:57 . 2009-04-10 13:57 86360 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\st00000\magicJack.dll 2009-04-10 13:57 . 2009-04-10 13:57 86360 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\magicJack.dll 2009-04-10 13:56 . 2009-04-10 13:56 11871576 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\magicJack.exe 2009-04-10 13:55 . 2009-04-10 13:55 725296 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\ug00000\install.exe 2009-04-10 13:55 . 2009-04-10 13:55 87384 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\in00000\mjsetup.exe 2009-04-10 13:55 . 2009-04-10 13:55 86360 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\in00000\magicJack.dll 2009-04-10 13:53 . 2009-04-10 13:53 456040 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\ug00000\magicJackSplash.exe 2009-04-10 13:53 . 2009-04-10 13:53 456040 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\st00000\magicJackSplash.exe 2009-04-10 13:53 . 2009-04-10 13:53 456040 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\magicJackSplash.exe 2009-04-10 13:53 . 2009-04-10 13:53 456040 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\in00000\magicJackSplash.exe 2009-04-10 13:53 . 2009-04-10 13:53 50520 ----a-w- c:\documents and settings\Owner\Application Data\mjusbsp\cdloader2.exe 2009-04-08 16:12 . 2009-04-08 15:55 45056 ----a-w- c:\windows\system32\sstunst2.exe 2009-04-08 16:12 . 2009-04-08 16:12 475136 ----a-w- c:\windows\system32\Shadow Usul.scr 2009-04-08 16:12 . 2009-04-08 16:12 499200 ----a-w- c:\windows\system32\Haunted House.scr 2009-04-08 16:04 . 2009-04-08 16:04 1048171 ----a-w- c:\windows\system32\Puririn_Valentine.scr 2009-04-08 16:02 . 2009-04-08 16:02 520192 ----a-w- c:\windows\system32\Beautiful Katamari.scr 2009-04-08 15:56 . 2009-04-08 15:56 499200 ----a-w- c:\windows\system32\Maraqua.scr 2009-04-08 15:55 . 2009-04-08 15:55 499200 ----a-w- c:\windows\system32\Pirates.scr 2009-04-08 15:51 . 2009-04-08 15:51 520192 ----a-w- c:\windows\system32\Neopets - Meepits.scr 2005-02-01 06:39 . 2005-02-01 06:39 0 -csha-w- c:\windows\SMINST\HPCD.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1a71246c-3eb0-4d6c-af77-3ab756017c3a}] 2009-05-20 22:05 2085400 ----a-w- c:\program files\BTjunkie\tbBTju.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdloader"="c:\documents and settings\Hellhound\Application Data\mjusbsp\cdloader2.exe" [2009-04-10 50520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "Sunkist2k"="c:\program files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 135168] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 36975] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2003-11-04 221184] "KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736] "BellSouthAlertManager.exe"="c:\program files\BellSouth\AM\BellSouthAlertManager.exe" [2007-01-28 2061816] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 919016] "PS2"="c:\windows\system32\ps2.exe" [2003-09-13 98304] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-13 8466432] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-13 81920] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936] "CamserviceDP"="c:\program files\Hercules\DualPix Exchange\Camservice.exe" [2007-08-10 81920] "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2005-03-08 53248] "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-10-30 16269312] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-08-13 1626112] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "navapsvc"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Documents and Settings\\Owner\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Documents and Settings\\Hellhound\\Application Data\\mjusbsp\\magicJack.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12479:TCP"= 12479:TCP:BitComet 12479 TCP "12479:UDP"= 12479:UDP:BitComet 12479 UDP "57867:TCP"= 57867:TCP:Pando P2P TCP Listening Port "57867:UDP"= 57867:UDP:Pando P2P UDP Listening Port R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [1/14/2008 8:48 PM 26112] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [12/25/2008 1:47 PM 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/25/2008 1:47 PM 20560] S3 camfilt2;camfilt2;c:\windows\system32\drivers\camfilt2.sys [7/3/2009 2:01 PM 94208] S3 CTUPnPSv;Creative Centrale Media Server;c:\program files\Creative\Creative Centrale\CTUPnPSv.exe [5/21/2008 7:42 AM 64000] S3 pmxscan;Visioneer USB Kernel;c:\windows\system32\drivers\usbscan.sys [6/29/2004 9:53 PM 15104] S3 XIRLINK;Dsc Pro Digital Camera;c:\windows\system32\DRIVERS\C-itnt.sys --> c:\windows\system32\DRIVERS\C-itnt.sys [?] --- Other Services/Drivers In Memory --- NewlyCreated - QBLAUIKJ Deregistered - qblauikj . Contents of the 'Scheduled Tasks' folder 2009-07-05 c:\windows\Tasks\User_Feed_Synchronization-{0DC9D31D-8840-4429-8815-B63903EC5A99}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 15:58] 2009-07-05 c:\windows\Tasks\User_Feed_Synchronization-{91EB3C36-B623-4EBA-8C23-125A130C723B}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 15:58] . - - - - ORPHANS REMOVED - - - - HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe HKCU-RunOnce-Shockwave Updater - c:\windows\system32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; PeoplePal 3.0; .NET HKLM-Run-OpwareSE2 - c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe HKLM-Run-OPSE reminder - c:\program files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe HKLM-Run-HostManager - c:\program files\Common Files\AOL\1112078643\EE\AOLHostManager.exe . ------- Supplementary Scan ------- . uStart Page = about:blank uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://www.yahoo.com mSearch Bar = hxxp://srch-qus10.hpwis.com/ IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm Trusted Zone: yourmusic.com\www DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} - hxxp://ea-src-cdn.systemrequirementslab.com/curi/bin/sysreqlab_srlx.cab DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} - hxxp://www.shockwave.com/content/sandscript/sis/SandScript.1.0.0.21.cab DPF: {E85362EF-40D4-4E5D-BE07-D6B036CCA277} - hxxps://secure.gopetslive.com/dev/gopets.cab DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab . ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-05 14:44 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . Completion time: 2009-07-05 14:47 ComboFix-quarantined-files.txt 2009-07-05 18:46 Pre-Run: 38,504,370,176 bytes free Post-Run: 38,964,047,872 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /usepmtimer 254 --- E O F --- 2009-07-05 09:18 Attached File(s)** ComboFix.txt ( 19.84K ) Number of downloads: 90

CatByte View Member Profile	Jul 5 2009, 01:23 PM Post #6
Classroom Administrator Group: Classroom Admin Posts: 9,584 Joined: 18-November 04 From: Canada Member No.: 18,614 Operating System: xp sp3	Hi, Please do the following: Download TFC to your desktop Close any open windows. Double click the TFC icon to run the program TFC will close all open programs itself in order to run, Click the Start button to begin the process. Allow TFC to run uninterrupted. The program should not take long to finish it's job Once its finished it should automatically reboot your machine, if it doesn't, manually reboot to ensure a complete clean It's normal after running TFC cleaner that the PC will be slower to boot the first time. NEXT Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

grave View Member Profile	Jul 5 2009, 01:46 PM Post #7
Authentic Member Group: Authentic Member Posts: 43 Joined: 21-August 07 Member No.: 72,314 Operating System: windows xp	OTL logfile created on: 7/5/2009 3:38:25 PM - Run 1 OTL by OldTimer - Version 3.0.6.5 Folder = C:\Documents and Settings\Hellhound\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 2.00 Gb Total Physical Memory \| 2.00 Gb Available Physical Memory \| 100.00% Memory free 3.50 Gb Paging File \| 3.12 Gb Available in Paging File \| 89.07% Paging File free Paging file location(s): C:\pagefile.sys 672 1344 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 144.89 Gb Total Space \| 36.28 Gb Free Space \| 25.04% Space Free \| Partition Type: NTFS Drive D: \| 4.14 Gb Total Space \| 0.61 Gb Free Space \| 14.84% Space Free \| Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PUMPKIN Current User Name: Hellhound Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Zone Labs, LLC) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) PRC - C:\Program Files\Creative\Shared Files\CTDevSrv.exe (Creative Technology Ltd) PRC - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) PRC - C:\WINDOWS\System32\NMSAccess.exe () PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation) PRC - C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation) PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.) PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) PRC - C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.) PRC - C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.) PRC - C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) PRC - C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe (BellSouth) PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems) PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC) PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation) PRC - C:\Documents and Settings\Hellhound\Desktop\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (aspnet_state [On_Demand \| Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (aswUpdSv [Auto \| Running]) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software) SRV - (avast! Antivirus [Auto \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software) SRV - (avast! Mail Scanner [On_Demand \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software) SRV - (avast! Web Scanner [On_Demand \| Running]) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software) SRV - (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (CTDevice_Srv [Auto \| Running]) -- C:\Program Files\Creative\Shared Files\CTDevSrv.exe (Creative Technology Ltd) SRV - (CTUPnPSv [On_Demand \| Stopped]) -- C:\Program Files\Creative\Creative Centrale\CTUPnPSv.exe (Creative Technology Ltd) SRV - (helpsvc [Auto \| Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IDriverT [On_Demand \| Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (IviRegMgr [Auto \| Running]) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) SRV - (NMSAccess [Auto \| Running]) -- C:\WINDOWS\System32\NMSAccess.exe () SRV - (NVSvc [Auto \| Running]) -- C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation) SRV - (ose [On_Demand \| Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (SimpTcp [Auto \| Running]) -- C:\WINDOWS\System32\tcpsvcs.exe (Microsoft Corporation) SRV - (vsmon [Auto \| Running]) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Zone Labs, LLC) SRV - (WLSetupSvc [On_Demand \| Stopped]) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation) SRV - (YahooAUService [Auto \| Running]) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.) ========== Driver Services (SafeList) ========== DRV - (Aavmker4 [System \| Running]) -- C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software) DRV - (AFS2K [System \| Running]) -- C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.) DRV - (AgereSoftModem [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\AGRSM.sys (Agere Systems) DRV - (ALCXSENS [On_Demand \| Stopped]) -- C:\WINDOWS\System32\drivers\ALCXSENS.SYS (Sensaura Ltd) DRV - (ALCXWDM [On_Demand \| Stopped]) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.) DRV - (AmdK8 [System \| Running]) -- C:\WINDOWS\System32\DRIVERS\AmdK8.sys (Advanced Micro Devices) DRV - (Aspi32 [System \| Running]) -- C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec) DRV - (aswFsBlk [Auto \| Running]) -- C:\WINDOWS\System32\DRIVERS\aswFsBlk.sys (ALWIL Software) DRV - (aswMon2 [Auto \| Running]) -- C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software) DRV - (aswRdr [On_Demand \| Running]) -- C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software) DRV - (aswSP [System \| Running]) -- C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software) DRV - (aswTdi [System \| Running]) -- C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software) DRV - (ati2mtag [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.) DRV - (camfilt2 [On_Demand \| Stopped]) -- C:\WINDOWS\System32\Drivers\camfilt2.sys (Guillemot Corporation) DRV - (fasttx2k [Boot \| Running]) -- C:\WINDOWS\System32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.) DRV - (FETND5BV [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\fetnd5bv.sys (VIA Technologies, Inc. ) DRV - (FETNDISB [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\fetnd5b.sys (VIA Technologies, Inc. ) DRV - (HDAudBus [On_Demand \| Running]) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (ialm [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation) DRV - (IntcAzAudAddService [On_Demand \| Running]) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (iteraid [Boot \| Running]) -- C:\WINDOWS\system32\DRIVERS\iteraid.sys (Integrated Technology Express, Inc.) DRV - (KLIF [System \| Running]) -- C:\WINDOWS\System32\DRIVERS\klif.sys (Kaspersky Lab) DRV - (nv [On_Demand \| Running]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (nvata [Boot \| Running]) -- C:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation) DRV - (NVENETFD [On_Demand \| Running]) -- C:\WINDOWS\System32\DRIVERS\NVENETFD.sys (NVIDIA Corporation) DRV - (nvnetbus [On_Demand \| Running]) -- C:\WINDOWS\System32\DRIVERS\nvnetbus.sys (NVIDIA Corporation) DRV - (nv_agp [Boot \| Running]) -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys (NVIDIA Corporation) DRV - (pcouffin [On_Demand \| Stopped]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software) DRV - (prodrv06 [System \| Running]) -- C:\WINDOWS\System32\drivers\prodrv06.sys (Protection Technology) DRV - (prohlp02 [Boot \| Running]) -- C:\WINDOWS\System32\drivers\prohlp02.sys (Protection Technology) DRV - (prosync1 [Boot \| Running]) -- C:\WINDOWS\System32\drivers\prosync1.sys (Protection Technology) DRV - (Ps2 [On_Demand \| Running]) -- C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company) DRV - (Ptilink [On_Demand \| Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot \| Running]) -- C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions) DRV - (rtl8139 [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\R8139n51.SYS (Realtek Semiconductor Corporation ) DRV - (Secdrv [Auto \| Running]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (sfhlp01 [Boot \| Running]) -- C:\WINDOWS\System32\drivers\sfhlp01.sys (Protection Technology) DRV - (SiS315 [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\sisgrp.sys (Silicon Integrated Systems Corporation) DRV - (SISAGP [Boot \| Running]) -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys (Silicon Integrated Systems Corporation) DRV - (SiSkp [System \| Running]) -- C:\WINDOWS\System32\DRIVERS\srvkp.sys (Silicon Integrated Systems Corporation) DRV - (SNP2UVC [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\snp2uvc.sys () DRV - (SONYPVU1 [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\SONYPVU1.SYS (Sony Corporation) DRV - (sptd [Boot \| Running]) -- C:\WINDOWS\System32\Drivers\sptd.sys () DRV - (srescan [Boot \| Running]) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys (Zone Labs, LLC) DRV - (SunkFilt [On_Demand \| Stopped]) -- C:\WINDOWS\System32\Drivers\sunkfilt.sys (Alcor Micro Corp.) DRV - (usbaudio [On_Demand \| Stopped]) -- C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation) DRV - (viaagp1 [Boot \| Running]) -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.) DRV - (viagfx [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\vtmini.sys (Copyright © VIA/S3 Graphics Co, Ltd.) DRV - (vsdatant [System \| Running]) -- C:\WINDOWS\System32\vsdatant.sys (Zone Labs, LLC) DRV - (wanatw [On_Demand \| Stopped]) -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys (America Online, Inc.) DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand \| Stopped]) -- C:\WINDOWS\System32\drivers\ialmsbw.sys (Intel Corporation) DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand \| Stopped]) -- C:\WINDOWS\System32\drivers\ialmkchw.sys (Intel Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe...-8&fr=b1ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn6\yt.dll (Yahoo! Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== [2008/04/28 19:13:54 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\mozilla\Firefox\Profiles\eqlcpwmv.default\extensions O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn6\yt.dll (Yahoo! Inc.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (BTjunkie Toolbar) - {1a71246c-3eb0-4d6c-af77-3ab756017c3a} - C:\Program Files\BTjunkie\tbBTju.dll (Conduit Ltd.) O2 - BHO: (BellSouth Toolbar) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\Program Files\blstoolbar\blstoolbar.dll () O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Neopets) - {CD292324-974F-4224-D074-CACA427AA030} - C:\Program Files\Neopets\Toolbar\Toolbar.dll (Velocity Services, Inc.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\companion\Installs\cpn6\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (BTjunkie Toolbar) - {1a71246c-3eb0-4d6c-af77-3ab756017c3a} - C:\Program Files\BTjunkie\tbBTju.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll () O3 - HKLM\..\Toolbar: (BellSouth Toolbar) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\Program Files\blstoolbar\blstoolbar.dll () O3 - HKLM\..\Toolbar: (Neopets) - {CD292324-974F-4224-D074-CACA427AA030} - C:\Program Files\Neopets\Toolbar\Toolbar.dll (Velocity Services, Inc.) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn6\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (BTjunkie Toolbar) - {1A71246C-3EB0-4D6C-AF77-3AB756017C3A} - C:\Program Files\BTjunkie\tbBTju.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (BellSouth Toolbar) - {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - C:\Program Files\blstoolbar\blstoolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Neopets) - {CD292324-974F-4224-D074-CACA427AA030} - C:\Program Files\Neopets\Toolbar\Toolbar.dll (Velocity Services, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn6\yt.dll (Yahoo! Inc.) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [BellSouthAlertManager.exe] C:\Program Files\BellSouth\AM\BellSouthAlertManager.exe (BellSouth) O4 - HKLM..\Run: [CamserviceDP] File not found O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [ISUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation) O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE () O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe (Alcor Micro, Corp.) O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions) O4 - HKLM..\Run: [VTTimer] C:\WINDOWS\System32\VTTimer.exe (S3 Graphics, Inc.) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Zone Labs, LLC) O4 - HKCU..\Run: [cdloader] C:\Documents and Settings\Hellhound\Application Data\mjusbsp\cdloader2.exe (magicJack L.P.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2009/07/03 14:15:05 \| 00,000,000 \| ---D \| M] O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2009/07/03 14:15:05 \| 00,000,000 \| ---D \| M] O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2009/07/03 14:15:05 \| 00,000,000 \| ---D \| M] O9 - Extra Button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (Yahoo! Inc.) O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (Yahoo! Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5) O15 - HKCU\..Trusted Domains: yourmusic.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} http://downloads.ewido.net/ewidoOnlineScan.cab (ewidoOnlineScan Control) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} http://ea-src-cdn.systemrequirementslab.co...reqlab_srlx.cab (System Requirements Lab Class) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd...b?1229297256000 (WUWebControl Class) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Java Plug-in 1.4.2_03) O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://games.myspace.com/Gameshell/GameHos...ronGameHost.cab (Oberon Flash Game Host) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {D410AFBD-4E26-4D5F-840F-0412D6F6BB8D} http://www.shockwave.com/content/sandscrip...pt.1.0.0.21.cab (CPlayFirstSandScriptControl Object) O16 - DPF: {E85362EF-40D4-4E5D-BE07-D6B036CCA277} https://secure.gopetslive.com/dev/gopets.cab (GoPets Control) O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab (GoPetsWeb Control) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 192.168.1.254 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/01/26 05:28:24 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/27 14:07:38 \| 00,000,000 \| -HS- \| M] () - D:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found ========== Files/Folders - Created Within 30 Days ========== [2009/07/05 15:28:07 \| 00,000,000 \| -HSD \| C] -- C:\RECYCLER [2009/07/05 15:26:54 \| 00,513,536 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Hellhound\Desktop\OTL.exe [2009/07/05 15:26:09 \| 00,265,216 \| ---- \| C] (OldTimer Tools) -- C:\Documents and Settings\Hellhound\Desktop\TFC.exe [2009/07/05 14:45:28 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\System32\dllcache\cache [2009/07/05 14:38:54 \| 00,000,000 \| RHSD \| C] -- C:\cmdcons [2009/07/05 14:36:45 \| 00,212,480 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009/07/05 14:36:45 \| 00,161,792 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009/07/05 14:36:45 \| 00,155,136 \| ---- \| C] () -- C:\WINDOWS\PEV.exe [2009/07/05 14:36:45 \| 00,136,704 \| ---- \| C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009/07/05 14:36:45 \| 00,098,816 \| ---- \| C] () -- C:\WINDOWS\sed.exe [2009/07/05 14:36:45 \| 00,080,412 \| ---- \| C] () -- C:\WINDOWS\grep.exe [2009/07/05 14:36:45 \| 00,068,096 \| ---- \| C] () -- C:\WINDOWS\zip.exe [2009/07/05 14:36:45 \| 00,031,232 \| ---- \| C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/07/05 14:36:39 \| 00,000,000 \| --SD \| C] -- C:\ComboFix [2009/07/05 14:36:36 \| 00,000,000 \| ---D \| C] -- C:\Qoobox [2009/07/05 14:31:56 \| 03,045,756 \| R--- \| C] () -- C:\Documents and Settings\Hellhound\Desktop\ComboFix.exe [2009/07/04 23:00:32 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\Desktop\New Folder [2009/07/04 11:30:21 \| 02,032,936 \| ---- \| C] (Skype Technologies S.A.) -- C:\Documents and Settings\Hellhound\Desktop\SkypeSetup.exe [2009/07/04 09:36:01 \| 00,729,088 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll [2009/07/04 09:36:01 \| 00,617,472 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\advapi32.dll [2009/07/04 09:36:01 \| 00,473,600 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll [2009/07/04 09:36:01 \| 00,453,120 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll [2009/07/04 09:36:01 \| 00,401,408 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll [2009/07/04 09:36:01 \| 00,284,160 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pdh.dll [2009/07/04 09:36:01 \| 00,227,840 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe [2009/07/04 09:36:01 \| 00,110,592 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\services.exe [2009/07/04 09:36:00 \| 02,189,056 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2009/07/04 09:36:00 \| 02,145,280 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2009/07/04 09:36:00 \| 00,714,752 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntdll.dll [2009/07/04 09:35:59 \| 02,023,936 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2009/07/04 09:35:33 \| 00,203,136 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rmcast.sys [2009/07/04 09:35:32 \| 00,455,296 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys [2009/07/04 09:35:30 \| 00,272,128 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys [2009/07/04 09:23:21 \| 00,333,952 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys [2009/07/04 09:23:19 \| 00,331,776 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll [2009/07/04 09:23:09 \| 00,691,712 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll [2009/07/04 09:22:01 \| 00,337,408 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll [2009/07/04 09:21:59 \| 01,106,944 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml3.dll [2009/07/04 09:21:11 \| 00,002,560 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll [2009/07/04 09:21:10 \| 01,203,922 \| ---- \| C] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb [2009/07/04 09:21:09 \| 00,215,552 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wordpad.exe [2009/07/04 09:17:09 \| 00,027,496 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2009/07/03 16:18:41 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Aspell [2009/07/03 14:24:46 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Skype [2009/07/03 14:07:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\My Documents\Hercules webcam [2009/07/03 14:01:28 \| 09,602,944 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2009/07/03 14:01:28 \| 00,299,008 \| ---- \| C] (Sonix) -- C:\WINDOWS\System32\vsnp2uvc.dll [2009/07/03 14:01:28 \| 00,167,936 \| ---- \| C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll [2009/07/03 14:01:28 \| 00,094,208 \| ---- \| C] (Guillemot Corporation) -- C:\WINDOWS\System32\drivers\camfilt2.sys [2009/07/03 14:01:28 \| 00,053,248 \| ---- \| C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll [2009/07/03 14:01:28 \| 00,028,160 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys [2009/07/03 14:01:28 \| 00,015,497 \| ---- \| C] () -- C:\WINDOWS\snp2uvc.ini [2009/07/03 14:01:28 \| 00,013,022 \| ---- \| C] () -- C:\WINDOWS\snp2uvc.src [2009/07/03 14:00:57 \| 03,600,384 \| ---- \| C] () -- C:\WINDOWS\ffmpeg.exe [2009/07/03 14:00:52 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\System32\HWC HD [2009/07/03 14:00:51 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Hercules [2009/07/03 14:00:09 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\Application Data\InstallShield [2009/06/30 00:36:28 \| 00,021,504 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\hidserv.dll [2009/06/30 00:36:28 \| 00,021,504 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hidserv.dll [2009/06/27 12:14:59 \| 00,000,758 \| ---- \| C] () -- C:\Documents and Settings\Hellhound\Desktop\Fast AVI MPEG Joiner.lnk [2009/06/27 12:14:58 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Fast AVI MPEG Joiner [2009/06/27 10:38:09 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\My Documents\RER Soft, Inc [2009/06/27 10:36:06 \| 00,000,783 \| ---- \| C] () -- C:\Documents and Settings\Hellhound\Desktop\RER Video Converter.lnk [2009/06/27 10:36:01 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Common Share [2009/06/27 10:35:59 \| 00,000,000 \| ---D \| C] -- C:\Program Files\RER [2009/06/27 08:33:39 \| 00,000,613 \| ---- \| C] () -- C:\Documents and Settings\Hellhound\Application Data\AutoGK.ini [2009/06/27 05:34:50 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Gabest [2009/06/27 05:34:43 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Xvid [2009/06/27 05:34:28 \| 00,000,000 \| ---D \| C] -- C:\Program Files\AviSynth 2.5 [2009/06/21 23:46:56 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\Application Data\rockbox.org [2009/06/13 00:46:13 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\Application Data\gtk-2.0 [2009/06/12 23:32:15 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\Application Data\.purple [2009/06/12 23:29:15 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Pidgin [2009/06/12 23:28:57 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\GTK [2009/06/09 03:36:38 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Microsoft WSE [2009/06/05 22:40:02 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Hellhound\My Documents\Oberon Media [2009/02/17 04:51:25 \| 00,000,057 \| ---- \| C] () -- C:\WINDOWS\_delis43.ini [2009/01/28 14:50:44 \| 00,815,104 \| ---- \| C] () -- C:\WINDOWS\System32\xvidcore.dll [2009/01/28 14:50:44 \| 00,180,224 \| ---- \| C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008/05/04 02:05:30 \| 00,000,067 \| ---- \| C] () -- C:\WINDOWS\#1 DVD Audio Ripper.INI [2008/01/28 09:58:06 \| 00,086,304 \| ---- \| C] () -- C:\WINDOWS\RHVIDEO.DLL [2007/11/29 18:30:28 \| 03,596,288 \| ---- \| C] () -- C:\WINDOWS\System32\qt-dx331.dll [2007/11/29 18:28:24 \| 00,000,416 \| ---- \| C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2007/11/29 18:28:24 \| 00,000,416 \| ---- \| C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2007/11/28 17:52:32 \| 00,012,288 \| ---- \| C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2007/09/30 00:11:44 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\RingtoneMaker.INI [2007/09/30 00:06:24 \| 00,002,770 \| ---- \| C] () -- C:\WINDOWS\mgxoschk.ini [2007/09/14 13:27:15 \| 00,000,073 \| ---- \| C] () -- C:\WINDOWS\EurekaLog.ini [2007/09/14 09:37:20 \| 00,000,067 \| ---- \| C] () -- C:\WINDOWS\Easy Video to DVD.INI [2007/08/26 12:37:16 \| 00,717,296 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2007/08/21 10:51:13 \| 00,796,048 \| ---- \| C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll [2007/08/13 17:14:16 \| 01,703,936 \| ---- \| C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2007/08/13 17:14:16 \| 01,019,904 \| ---- \| C] () -- C:\WINDOWS\System32\nvwimg.dll [2007/08/13 17:14:13 \| 00,466,944 \| ---- \| C] () -- C:\WINDOWS\System32\nvshell.dll [2007/08/13 17:14:12 \| 00,286,720 \| ---- \| C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2007/08/13 17:14:11 \| 01,474,560 \| ---- \| C] () -- C:\WINDOWS\System32\nview.dll [2007/07/31 16:15:03 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\MSDraw.ini [2007/07/20 11:36:32 \| 00,006,048 \| ---- \| C] () -- C:\WINDOWS\System32\MCC16.dll [2007/06/15 11:47:36 \| 00,040,448 \| ---- \| C] () -- C:\WINDOWS\System32\BJAXSecurityManager.dll [2007/06/15 11:47:31 \| 00,086,016 \| ---- \| C] () -- C:\WINDOWS\System32\BJInstaller.dll [2007/01/28 15:43:47 \| 00,323,584 \| ---- \| C] () -- C:\WINDOWS\System32\FoxImager.dll [2006/12/15 20:18:18 \| 00,000,116 \| ---- \| C] () -- C:\WINDOWS\NeroDigital.ini [2006/12/15 19:46:19 \| 00,014,848 \| ---- \| C] () -- C:\WINDOWS\System32\BASSMOD.dll [2006/06/14 13:06:43 \| 00,000,217 \| ---- \| C] () -- C:\WINDOWS\MPPAGER.INI [2006/05/09 09:00:26 \| 00,000,004 \| -H-- \| C] () -- C:\WINDOWS\uccspecb.sys [2006/04/01 18:44:25 \| 00,008,704 \| ---- \| C] () -- C:\WINDOWS\System32\CNMVS7K.DLL [2005/08/06 14:22:02 \| 00,000,026 \| ---- \| C] () -- C:\WINDOWS\WAR2R.INI [2005/07/09 17:49:15 \| 00,000,717 \| ---- \| C] () -- C:\WINDOWS\QIII.INI [2005/06/09 00:46:20 \| 00,069,632 \| ---- \| C] () -- C:\WINDOWS\System32\xmltok.dll [2005/06/09 00:46:19 \| 00,036,864 \| ---- \| C] () -- C:\WINDOWS\System32\xmlparse.dll [2005/03/29 02:54:07 \| 00,000,004 \| ---- \| C] () -- C:\WINDOWS\msoffice.ini [2005/03/07 03:55:46 \| 00,000,020 \| ---- \| C] () -- C:\WINDOWS\calera.ini [2005/03/07 03:55:41 \| 00,269,312 \| ---- \| C] () -- C:\WINDOWS\System32\FPXIG.DLL [2005/03/07 03:55:41 \| 00,068,096 \| ---- \| C] () -- C:\WINDOWS\System32\IGFPX32P.DLL [2005/03/07 03:55:41 \| 00,065,024 \| ---- \| C] () -- C:\WINDOWS\System32\JPEGACC.DLL [2005/03/07 03:55:32 \| 00,101,376 \| ---- \| C] () -- C:\WINDOWS\System32\WELSOF32.DLL [2004/09/17 17:37:42 \| 00,061,440 \| ---- \| C] () -- C:\WINDOWS\System32\vuins32.dll [2004/08/30 03:50:29 \| 00,000,040 \| ---- \| C] () -- C:\WINDOWS\TSC.INI [2004/08/30 03:46:34 \| 00,000,170 \| ---- \| C] () -- C:\WINDOWS\GetServer.ini [2004/07/10 02:02:17 \| 00,000,155 \| ---- \| C] () -- C:\WINDOWS\winamp.ini [2004/06/29 00:54:53 \| 00,000,896 \| ---- \| C] () -- C:\WINDOWS\System32\hpsj16.dll [2004/06/29 00:54:53 \| 00,000,687 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\hpscan16.sys [2004/06/29 00:54:52 \| 00,000,057 \| ---- \| C] () -- C:\WINDOWS\HPDS23.INI [2004/06/28 23:43:16 \| 00,000,039 \| ---- \| C] () -- C:\WINDOWS\VTWAIN.INI [2004/06/28 23:43:16 \| 00,000,022 \| ---- \| C] () -- C:\WINDOWS\ppdrv.ini [2004/06/28 23:41:35 \| 00,000,860 \| ---- \| C] () -- C:\WINDOWS\wininit.ini [2004/06/28 23:40:11 \| 00,306,688 \| ---- \| C] () -- C:\WINDOWS\System32\Lffpx7.dll [2004/06/28 23:40:11 \| 00,095,232 \| ---- \| C] () -- C:\WINDOWS\System32\Lfkodak.dll [2004/06/28 23:40:10 \| 00,148,512 \| ---- \| C] () -- C:\WINDOWS\hpud32.dll [2004/06/28 23:40:10 \| 00,123,424 \| ---- \| C] () -- C:\WINDOWS\p1220_32.dll [2004/06/28 23:40:10 \| 00,000,038 \| ---- \| C] () -- C:\WINDOWS\hpudrv.ini [2004/06/28 19:35:18 \| 00,156,157 \| ---- \| C] () -- C:\WINDOWS\cdPlayer.ini [2004/06/18 18:04:17 \| 00,012,288 \| ---- \| C] () -- C:\WINDOWS\impborl.dll [2004/06/13 22:56:05 \| 00,000,061 \| ---- \| C] () -- C:\WINDOWS\MSREGUSR.INI [2004/06/13 20:53:27 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\iPlayer.INI [2004/06/12 17:00:37 \| 00,001,113 \| ---- \| C] () -- C:\WINDOWS\SIERRA.INI [2004/06/11 15:46:47 \| 00,204,800 \| ---- \| C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2004/06/11 15:46:47 \| 00,200,704 \| ---- \| C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2004/06/11 15:46:47 \| 00,192,512 \| ---- \| C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2004/06/11 15:46:47 \| 00,192,512 \| ---- \| C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2004/06/11 15:46:47 \| 00,188,416 \| ---- \| C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2004/06/11 15:46:47 \| 00,020,480 \| ---- \| C] () -- C:\WINDOWS\System32\IVIresize.dll [2004/01/28 22:21:05 \| 00,000,451 \| ---- \| C] () -- C:\WINDOWS\VGAsetup.ini [2004/01/28 22:21:05 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\System32\VGAunistlog.ini [2004/01/27 06:47:39 \| 00,000,061 \| ---- \| C] () -- C:\WINDOWS\smscfg.ini [2004/01/27 06:26:18 \| 00,002,150 \| ---- \| C] () -- C:\WINDOWS\System32\mshrml.ini [2004/01/26 09:32:19 \| 00,028,672 \| ---- \| C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll [2004/01/26 09:31:25 \| 00,094,208 \| ---- \| C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll [2004/01/26 09:31:25 \| 00,077,824 \| ---- \| C] () -- C:\WINDOWS\System32\ProgressTrace.dll [2004/01/26 09:23:22 \| 00,167,936 \| ---- \| C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll [2004/01/26 09:17:11 \| 00,029,216 \| ---- \| C] () -- C:\WINDOWS\System32\CHODDI.SYS [2004/01/26 09:16:36 \| 00,024,576 \| ---- \| C] () -- C:\WINDOWS\System32\syscontr.dll [2004/01/26 09:16:00 \| 00,045,056 \| ---- \| C] () -- C:\WINDOWS\System32\hpreg.dll [2004/01/26 09:00:28 \| 00,000,479 \| ---- \| C] () -- C:\WINDOWS\ODBC.INI [2004/01/26 08:46:03 \| 00,000,897 \| ---- \| C] () -- C:\WINDOWS\QUICKEN.INI [2004/01/26 06:56:30 \| 00,001,793 \| ---- \| C] () -- C:\WINDOWS\System32\fxsperf.ini [2004/01/26 06:14:16 \| 00,363,520 \| ---- \| C] () -- C:\WINDOWS\System32\psisdecd.dll [2004/01/26 06:02:59 \| 00,299,073 \| ---- \| C] () -- C:\WINDOWS\System32\PythonCOM22.dll [2004/01/26 06:02:59 \| 00,065,536 \| ---- \| C] () -- C:\WINDOWS\System32\PyWinTypes22.dll [2004/01/26 06:02:33 \| 00,016,896 \| ---- \| C] () -- C:\WINDOWS\System32\bcbmm.dll [2004/01/26 05:33:52 \| 00,000,810 \| ---- \| C] () -- C:\WINDOWS\orun32.ini [2004/01/26 04:11:44 \| 00,000,553 \| ---- \| C] () -- C:\WINDOWS\System32\oeminfo.ini [2004/01/26 04:11:01 \| 00,000,715 \| ---- \| C] () -- C:\WINDOWS\win.ini [2004/01/26 04:10:51 \| 00,000,227 \| ---- \| C] () -- C:\WINDOWS\system.ini [2003/12/09 14:16:52 \| 00,442,368 \| ---- \| C] ( ) -- C:\WINDOWS\System32\comintfs.dll [2003/09/23 04:19:42 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\System32\px.ini [2003/01/08 02:05:08 \| 00,002,695 \| ---- \| C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/10/15 18:54:04 \| 00,153,088 \| ---- \| C] () -- C:\WINDOWS\System32\unrar.dll [2002/10/06 14:42:57 \| 00,237,568 \| ---- \| C] () -- C:\WINDOWS\System32\OggDS.dll [2002/10/04 19:04:25 \| 00,921,600 \| ---- \| C] () -- C:\WINDOWS\System32\vorbisenc.dll [2002/10/04 19:04:24 \| 00,188,416 \| ---- \| C] () -- C:\WINDOWS\System32\vorbis.dll [2002/10/04 19:04:17 \| 00,045,056 \| ---- \| C] () -- C:\WINDOWS\System32\ogg.dll [2002/01/25 09:04:50 \| 00,005,440 \| ---- \| C] () -- C:\WINDOWS\System32\mciwa16.dll [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\pspsbext.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\pspfidrv.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\pspfbase.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\pspaudrv.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\pspapdrv.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\mciwaw95.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\mcipspwa.ini [2002/01/25 09:04:50 \| 00,000,221 \| ---- \| C] () -- C:\WINDOWS\System32\mcipspct.ini [2002/01/25 09:04:50 \| 00,000,220 \| ---- \| C] () -- C:\WINDOWS\System32\pspwave.ini [2002/01/25 09:04:50 \| 00,000,219 \| ---- \| C] () -- C:\WINDOWS\System32\pspdss.ini [2002/01/25 09:04:50 \| 00,000,219 \| ---- \| C] () -- C:\WINDOWS\System32\pspddi.ini [2001/07/13 07:04:00 \| 00,373,248 \| ---- \| C] () -- C:\WINDOWS\EyeCand3.INI ========== Files - Modified Within 30 Days ========== [2009/07/05 15:40:00 \| 00,000,422 \| -H-- \| M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{91EB3C36-B623-4EBA-8C23-125A130C723B}.job [2009/07/05 15:38:11 \| 00,000,430 \| -H-- \| M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{0DC9D31D-8840-4429-8815-B63903EC5A99}.job [2009/07/05 15:35:12 \| 66,551,4016 \| -HS- \| M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009/07/05 15:31:35 \| 00,000,188 \| ---- \| M] () -- C:\WINDOWS\System\hpsysdrv.DAT [2009/07/05 15:30:46 \| 00,000,336 \| ---- \| M] () -- C:\WINDOWS\System32\vsconfig.xml [2009/07/05 15:30:25 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/07/05 15:30:03 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/07/05 15:30:00 \| 32,207,54432 \| -HS- \| M] () -- C:\hiberfil.sys [2009/07/05 15:28:44 \| 07,802,036 \| -HS- \| M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009/07/05 15:26:55 \| 00,513,536 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Hellhound\Desktop\OTL.exe [2009/07/05 15:26:09 \| 00,265,216 \| ---- \| M] (OldTimer Tools) -- C:\Documents and Settings\Hellhound\Desktop\TFC.exe [2009/07/05 14:44:43 \| 00,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2009/07/05 14:38:58 \| 00,000,277 \| RHS- \| M] () -- C:\boot.ini [2009/07/05 14:32:00 \| 03,045,756 \| R--- \| M] () -- C:\Documents and Settings\Hellhound\Desktop\ComboFix.exe [2009/07/05 05:28:47 \| 00,414,116 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/07/05 05:28:47 \| 00,066,208 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/07/05 05:28:44 \| 00,488,184 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/07/05 05:23:17 \| 00,351,384 \| ---- \| M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/07/05 05:18:33 \| 00,001,355 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2009/07/05 05:16:31 \| 00,000,715 \| ---- \| M] () -- C:\WINDOWS\win.ini [2009/07/04 11:30:24 \| 02,032,936 \| ---- \| M] (Skype Technologies S.A.) -- C:\Documents and Settings\Hellhound\Desktop\SkypeSetup.exe [2009/07/04 09:58:12 \| 00,012,598 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/07/03 16:55:56 \| 00,033,792 \| ---- \| M] () -- C:\Documents and Settings\Hellhound\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/06/27 12:14:59 \| 00,000,758 \| ---- \| M] () -- C:\Documents and Settings\Hellhound\Desktop\Fast AVI MPEG Joiner.lnk [2009/06/27 10:36:06 \| 00,000,783 \| ---- \| M] () -- C:\Documents and Settings\Hellhound\Desktop\RER Video Converter.lnk [2009/06/27 09:44:03 \| 00,000,613 \| ---- \| M] () -- C:\Documents and Settings\Hellhound\Application Data\AutoGK.ini [2009/06/08 08:10:10 \| 00,155,136 \| ---- \| M] () -- C:\WINDOWS\PEV.exe ========== LOP Check ========== [2009/07/03 14:24:46 \| 00,000,000 \| RH-D \| M] -- C:\Documents and Settings\All Users\Application Data [2008/09/08 16:55:05 \| 00,000,000 \| -H-D \| M] -- C:\Documents and Settings\All Users\Application Data\{1DC446AE-02CE-4ED1-9CCE-6CED69BDEEFC} [2008/09/08 16:55:39 \| 00,000,000 \| -H-D \| M] -- C:\Documents and Settings\All Users\Application Data\{F80BA25A-BEA5-42AE-89A4-E9FC6C7E53FB} [2006/12/15 19:49:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Ahead [2007/08/18 19:55:07 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\ashampoo [2007/09/29 11:07:01 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\AVS4YOU [2007/06/15 12:00:01 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\BellSouth [2006/04/01 18:44:26 \| 00,000,000 \| -H-D \| M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ [2009/04/19 18:55:23 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite [2009/04/11 01:43:00 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\DVD Shrink [2008/01/26 09:21:32 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\FLEXnet [2008/02/09 21:17:47 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\GameHouse [2007/08/21 10:52:36 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier [2004/01/26 09:27:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Motive [2004/08/04 01:41:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\MSN6 [2008/08/28 22:21:41 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound [2007/06/20 17:28:49 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst [2008/09/25 20:02:09 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\PopCap [2005/03/29 02:44:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Pure Networks [2009/04/26 07:58:21 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\River Past G4 [2009/04/26 07:58:04 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\River Past G5 [2004/01/26 05:35:32 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SBSI [2007/04/17 15:51:46 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan [2007/07/12 10:08:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\SonyPicturesGames [2008/07/08 17:27:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\TechSmith [2006/05/27 04:59:34 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Trymedia [2004/06/11 15:27:21 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2008/05/26 21:03:56 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\vsosdk [2008/02/06 12:30:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\YAHOO [2009/07/05 14:43:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data [2009/07/04 04:21:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\.purple [2006/12/15 20:24:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Ahead [2005/05/16 04:17:13 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Aim [2007/09/30 02:29:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\AVS Video Converter [2007/09/29 11:07:10 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\AVS4YOU [2007/06/15 12:35:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\BellSouth [2009/04/22 01:04:46 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Canon [2008/09/02 14:33:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\com.ebay.sandimas.public-beta.AA1EEF5552BF52051F68E7EAF27E23FA6449A65C.1 [2009/04/10 04:03:44 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\dvdcss [2005/03/23 09:50:49 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\FileOpen [2009/06/21 01:50:16 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\gtk-2.0 [2004/01/27 06:26:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\interMute [2004/08/06 23:20:44 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\InterVideo [2008/07/02 00:11:29 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\iriver [2005/05/30 06:21:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Jasc [2008/07/16 04:26:36 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\LEGO Company [2008/10/18 18:19:38 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\LimeWire [2007/11/06 20:07:41 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\LucasArts [2009/07/03 15:05:33 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\mjusbsp [2004/08/07 01:30:44 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Motive [2008/01/18 19:22:52 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\My Battle for Middle-earth™ II Files [2008/01/29 09:28:09 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\My The Lord of the Rings, The Rise of the Witch-king Files [2008/08/28 22:26:24 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\NCH Swift Sound [2008/04/20 08:15:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Neopets Toolbar [2007/09/01 13:16:36 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Obsidium [2008/11/03 20:44:26 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\River Past G4 [2008/11/03 20:07:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\River Past G5 [2009/06/21 23:46:56 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\rockbox.org [2004/01/26 09:49:44 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\SampleView [2007/05/19 22:34:54 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Template [2009/07/03 07:57:18 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\uTorrent [2009/05/04 15:07:39 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Vso [2008/11/02 03:47:59 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Hellhound\Application Data\Xilisoft Corporation [2003/08/16 12:14:00 \| 00,000,065 \| RH-- \| M] () -- C:\WINDOWS\Tasks\desktop.ini [2009/07/05 15:30:25 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\Tasks\SA.DAT [2009/07/05 15:38:11 \| 00,000,430 \| -H-- \| M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{0DC9D31D-8840-4429-8815-B63903EC5A99}.job [2009/07/05 15:40:00 \| 00,000,422 \| -H-- \| M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{91EB3C36-B623-4EBA-8C23-125A130C723B}.job ========== Purity Check ========== < End of report >

CatByte View Member Profile	Jul 5 2009, 02:04 PM Post #9
Classroom Administrator Group: Classroom Admin Posts: 9,584 Joined: 18-November 04 From: Canada Member No.: 18,614 Operating System: xp sp3	Hi please do the following: Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review: Close any open programs Turn off the real time scanner of any existing antivirus program while performing the online scan 3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take quite a long time to download. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply NEXT Let's have a look at the file association for your .avi files: Please do this Go to My Computer > Tools > Folder Options then click on File Types. There you will see all the registered file types in Windows, choose the .avi file type and click on the Change button. Pick the program you want to open the .avi files with, click on Ok, then on Close. You may want to restart your PC to be sure. Let me know if that resolves the issue.

grave View Member Profile	Jul 6 2009, 04:05 PM Post #10
Authentic Member Group: Authentic Member Posts: 43 Joined: 21-August 07 Member No.: 72,314 Operating System: windows xp	-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, July 6, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, July 06, 2009 19:17:15 Records in database: 2433243 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ Scan statistics: Files scanned: 195942 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 03:04:35 No malware has been detected. The scan area is clean. The selected area was scanned.

grave

Jul 6 2009, 04:12 PM

Post #11

Authentic Member

Group: Authentic Member
Posts: 43
Joined: 21-August 07
Member No.: 72,314
Operating System: windows xp

I still get the error message. I attached screen shots of the message and also added the windows error report. I appreciate all your help with this problem, I hope we can figure out this problem.

<?xml version="1.0" encoding="UTF-16"?>
<DATABASE>
<EXE NAME="SYSTEM INFO" FILTER="GRABMI_FILTER_SYSTEM">
<MATCHING_FILE NAME="advapi32.dll" SIZE="617472" CHECKSUM="0xA0887D0D" BIN_FILE_VERSION="5.1.2600.5755" BIN_PRODUCT_VERSION="5.1.2600.5755" PRODUCT_VERSION="5.1.2600.5755" FILE_DESCRIPTION="Advanced Windows 32 Base API" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)" ORIGINAL_FILENAME="advapi32.dll" INTERNAL_NAME="advapi32.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xA5BB8" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5755" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5755" LINK_DATE="02/09/2009 12:10:48" UPTO_LINK_DATE="02/09/2009 12:10:48" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="gdi32.dll" SIZE="286720" CHECKSUM="0x98314A3F" BIN_FILE_VERSION="5.1.2600.5698" BIN_PRODUCT_VERSION="5.1.2600.5698" PRODUCT_VERSION="5.1.2600.5698" FILE_DESCRIPTION="GDI Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5698 (xpsp_sp3_gdr.081022-1932)" ORIGINAL_FILENAME="gdi32" INTERNAL_NAME="gdi32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x4CE95" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5698" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5698" LINK_DATE="10/23/2008 12:36:14" UPTO_LINK_DATE="10/23/2008 12:36:14" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="kernel32.dll" SIZE="989696" CHECKSUM="0x2D998938" BIN_FILE_VERSION="5.1.2600.5781" BIN_PRODUCT_VERSION="5.1.2600.5781" PRODUCT_VERSION="5.1.2600.5781" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5781 (xpsp_sp3_gdr.090321-1317)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xFE572" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5781" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5781" LINK_DATE="03/21/2009 14:06:58" UPTO_LINK_DATE="03/21/2009 14:06:58" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="ntdll.dll" SIZE="714752" CHECKSUM="0xC695BA95" BIN_FILE_VERSION="5.1.2600.5755" BIN_PRODUCT_VERSION="5.1.2600.5755" PRODUCT_VERSION="5.1.2600.5755" FILE_DESCRIPTION="NT Layer DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)" ORIGINAL_FILENAME="ntdll.dll" INTERNAL_NAME="ntdll.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xBC674" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5755" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5755" LINK_DATE="02/09/2009 12:10:48" UPTO_LINK_DATE="02/09/2009 12:10:48" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="ole32.dll" SIZE="1287168" CHECKSUM="0xB764FEEA" BIN_FILE_VERSION="5.1.2600.5512" BIN_PRODUCT_VERSION="5.1.2600.5512" PRODUCT_VERSION="5.1.2600.5512" FILE_DESCRIPTION="Microsoft OLE for Windows" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5512 (xpsp.080413-2108)" ORIGINAL_FILENAME="OLE32.DLL" INTERNAL_NAME="OLE32.DLL" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x14744B" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5512" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5512" LINK_DATE="04/14/2008 00:10:57" UPTO_LINK_DATE="04/14/2008 00:10:57" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="oleaut32.dll" SIZE="551936" CHECKSUM="0xE8E0E87" BIN_FILE_VERSION="5.1.2600.5512" BIN_PRODUCT_VERSION="5.1.2600.5512" PRODUCT_VERSION="5.1.2600.5512" COMPANY_NAME="Microsoft Corporation" FILE_VERSION="5.1.2600.5512" INTERNAL_NAME="OLEAUT32.DLL" LEGAL_COPYRIGHT="Copyright © Microsoft Corp. 1993-2001." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x8D4E3" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5512" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5512" LINK_DATE="04/14/2008 00:10:58" UPTO_LINK_DATE="04/14/2008 00:10:58" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="shell32.dll" SIZE="8461312" CHECKSUM="0x229B7DE8" BIN_FILE_VERSION="6.0.2900.5622" BIN_PRODUCT_VERSION="6.0.2900.5622" PRODUCT_VERSION="6.00.2900.5622" FILE_DESCRIPTION="Windows Shell Common Dll" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="6.00.2900.5622 (xpsp_sp3_gdr.080617-1319)" ORIGINAL_FILENAME="SHELL32.DLL" INTERNAL_NAME="SHELL32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x812125" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="6.0.2900.5622" UPTO_BIN_PRODUCT_VERSION="6.0.2900.5622" LINK_DATE="06/17/2008 19:02:17" UPTO_LINK_DATE="06/17/2008 19:02:17" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="user32.dll" SIZE="578560" CHECKSUM="0x6280E825" BIN_FILE_VERSION="5.1.2600.5512" BIN_PRODUCT_VERSION="5.1.2600.5512" PRODUCT_VERSION="5.1.2600.5512" FILE_DESCRIPTION="Windows XP USER API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.1.2600.5512 (xpsp.080413-2105)" ORIGINAL_FILENAME="user32" INTERNAL_NAME="user32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x8FC76" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="5.1.2600.5512" UPTO_BIN_PRODUCT_VERSION="5.1.2600.5512" LINK_DATE="04/14/2008 00:11:07" UPTO_LINK_DATE="04/14/2008 00:11:07" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="wininet.dll" SIZE="827392" CHECKSUM="0x9DF68945" BIN_FILE_VERSION="7.0.6000.16850" BIN_PRODUCT_VERSION="7.0.6000.16850" PRODUCT_VERSION="7.00.6000.16850" FILE_DESCRIPTION="Internet Extensions for Win32" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Windows® Internet Explorer" FILE_VERSION="7.00.6000.16850 (vista_gdr.090423-0018)" ORIGINAL_FILENAME="wininet.dll" INTERNAL_NAME="wininet.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0xD3257" LINKER_VERSION="0x60000" UPTO_BIN_FILE_VERSION="7.0.6000.16850" UPTO_BIN_PRODUCT_VERSION="7.0.6000.16850" LINK_DATE="04/29/2009 04:56:01" UPTO_LINK_DATE="04/29/2009 04:56:01" VER_LANGUAGE="English (United States) [0x409]" />
<MATCHING_FILE NAME="winsock.dll" SIZE="2864" CHECKSUM="0x73AE8088" BIN_FILE_VERSION="3.10.0.103" BIN_PRODUCT_VERSION="3.10.0.103" PRODUCT_VERSION="3.10" FILE_DESCRIPTION="Windows Socket 16-Bit DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows™ Operating System" FILE_VERSION="3.10" ORIGINAL_FILENAME="WINSOCK.DLL" INTERNAL_NAME="WINSOCK" LEGAL_COPYRIGHT="Copyright © Microsoft Corp. 1981-1996" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x10001" VERFILETYPE="0x2" MODULE_TYPE="WIN16" S16BIT_DESCRIPTION="BSD Socket API for Windows" S16BIT_MODULE_NAME="WINSOCK" UPTO_BIN_FILE_VERSION="3.10.0.103" UPTO_BIN_PRODUCT_VERSION="3.10.0.103" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
<EXE NAME="msvcrt.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
<MATCHING_FILE NAME="msvcrt.dll" SIZE="343040" CHECKSUM="0x62160733" BIN_FILE_VERSION="7.0.2600.5512" BIN_PRODUCT_VERSION="6.1.8638.5512" PRODUCT_VERSION="7.0.2600.5512" FILE_DESCRIPTION="Windows NT CRT DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="7.0.2600.5512 (xpsp.080413-2111)" ORIGINAL_FILENAME="msvcrt.dll" INTERNAL_NAME="msvcrt.dll" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x57341" LINKER_VERSION="0x50001" UPTO_BIN_FILE_VERSION="7.0.2600.5512" UPTO_BIN_PRODUCT_VERSION="6.1.8638.5512" LINK_DATE="04/14/2008 00:12:56" UPTO_LINK_DATE="04/14/2008 00:12:56" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
</DATABASE>

Attached thumbnail(s)

CatByte View Member Profile	Jul 6 2009, 04:29 PM Post #12
Classroom Administrator Group: Classroom Admin Posts: 9,584 Joined: 18-November 04 From: Canada Member No.: 18,614 Operating System: xp sp3	Hi, what was the file association set to when you checked? I will need to consult with my colleagues on this one, so please be patient with me and I will get back to you - hopefully with a solution, as soon as possible ~CB

grave View Member Profile	Jul 6 2009, 05:15 PM Post #13
Authentic Member Group: Authentic Member Posts: 43 Joined: 21-August 07 Member No.: 72,314 Operating System: windows xp	I use VLC Media Player for avi's. The problem occurred when I removed some video editing programs. I can't remember the names.

LDTate View Member Profile	Jul 6 2009, 05:37 PM Post #14
Forum God Group: Root Admin Posts: 48,364 Joined: 23-September 04 From: Missouri, USA Member No.: 15,276	Right Click on any AVI and select open with Windows Media Player, does that work?

grave View Member Profile	Jul 6 2009, 06:05 PM Post #15
Authentic Member Group: Authentic Member Posts: 43 Joined: 21-August 07 Member No.: 72,314 Operating System: windows xp	the problem isn't in opening the files, i am able to play the avi's with media programs. the error occurs when a windows folder containing the avi files is opened and viewed. i think it may have something to do with the loading of the thumbnails. QUOTE (LDTate @ Jul 6 2009, 07:37 PM) Right Click on any AVI and select open with Windows Media Player, does that work?

« Next Oldest · Infections Removal · Next Newest »

2 Pages

1 2 >

Topic Title	Replies	Topic Starter	Views	Last Action
Microsoft Windows™ Error message with blue background 123	35	ems88	1,137	41 minutes ago Last post by: Ztruker
Infections Removal ZIP files locked by explorer.exe 12	18	GunnyShaw	119	58 minutes ago Last post by: GunnyShaw
Infections Removal [Resolved] XP Antivirus Pro 2010 infection 12	29	Stormicats	1,198	Today, 03:58 PM Last post by: extremeboy
Infections Removal [Resolved] Perfect Keylogger.	9	lin0056	124	Today, 02:34 PM Last post by: LDTate