 [Closed] I received a response from my post. |
Welcome! Register for a free account (or login) > How does it work?
|
|
  |
 Jun 2 2008, 07:00 PM
Post
#1
|
|
|
New Member  Group: New Member Posts: 5 Joined: 2-June 08 Member No.: 79,419 Operating System: XP  |
Messenger is not running. Browser can be opened or closed Using Norton 360 Ran spyware and everthing was fine. Any ideas? MAIN.TXT Deckard's System Scanner v20071014.68 Run by Mark on 2008-06-02 20:46:33 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 34: 2008-06-03 00:46:37 UTC - RP34 - Deckard's System Scanner Restore Point 33: 2008-06-02 00:15:22 UTC - RP33 - Installed iriver Music Manager 32: 2008-05-28 07:00:48 UTC - RP32 - Software Distribution Service 3.0 31: 2008-05-27 21:31:01 UTC - RP31 - Installed Nero 8 30: 2008-05-27 21:30:05 UTC - RP30 - Installed DirectX -- First Restore Point -- 1: 2008-05-24 18:41:26 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-02 20:48:14 Platform: Windows XP Service Pack 3 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\afinding.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Updater.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DNA\btdna.exe C:\WINDOWS\system32\perfs.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\routing.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wserving.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\E8ROSIAZ\dss[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.microsoft.com/isapi/redir.dll?p...mp;plcid=0x1009 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O1 - Hosts: 64.14.244.60 travelsow.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBHO.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe O4 - HKLM\..\RunServices: [Microsoft] wplayer.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime (User 'Default user') O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1211655543447 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Nero BackItUp Scheduler 3 - Unknown owner - C:\Program Files\Nero\Nero8\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe -- End of file - 11571 bytes -- File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 aliidex - c:\windows\system32\drivers\aliidex.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> R0 aliperf - c:\windows\system32\drivers\aliperf.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> R0 IFP700 (iRiver Internet Audio Player IFP-700) - c:\windows\system32\drivers\ifp700.sys <Not Verified; iRiver, Inc.; IFP-100> R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AFinding (AFinding Service) - c:\windows\system32\afinding.exe R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> R2 Nero BackItUp Scheduler 3 - c:\program files\nero\nero8\nero backitup\nbservice.exe R2 perfmons (perfmons Service) - c:\windows\system32\perfs.exe R2 PLFlash DeviceIoControl Service - c:\windows\system32\ioctlsvc.exe <Not Verified; Prolific Technology Inc.; IoctlSvc Application> R2 Routing (Routing Service) - c:\windows\system32\routing.exe R2 WServing (WServing Service) - c:\windows\system32\wserving.exe R3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Universal Serial Bus (USB) Controller Device ID: PCI\VEN_10B9&DEV_5239&SUBSYS_52391849&REV_01\3&267A616A&0&7B Manufacturer: Name: Universal Serial Bus (USB) Controller PNP Device ID: PCI\VEN_10B9&DEV_5239&SUBSYS_52391849&REV_01\3&267A616A&0&7B Service: -- Files created between 2008-05-02 and 2008-06-02 ----------------------------- 2008-06-01 20:15:25 278528 --a------ C:\WINDOWS\system32\iFPSP.dll <Not Verified; Yurion Inc.; iFPSP Module> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\N10.SYS <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\ifpusb.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\Ifp900.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\Ifp800.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\Ifp700.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\Ifp500.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\ifp300.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 14531 --a------ C:\WINDOWS\system32\drivers\Ifp1000.sys <Not Verified; iRiver, Inc.; IFP-100> 2008-06-01 20:15:23 0 d-------- C:\Program Files\iriver 2008-06-01 19:50:31 880912 --a------ C:\WINDOWS\WM8EUTIL.exe <Not Verified; Microsoft Corporation; Windows Media 8 Encoder Utility> 2008-06-01 19:50:31 0 d-------- C:\Program Files\CD to MP3 Freeware 2008-06-01 19:45:38 0 d-------- C:\Documents and Settings\All Users\Application Data\FreeRIP 2008-06-01 17:52:56 0 d-------- C:\N360_BACKUP 2008-05-31 18:25:00 0 d-------- C:\WINDOWS\system32\Lang 2008-05-31 18:25:00 60416 --a------ C:\WINDOWS\ALCFDRTM.EXE <Not Verified; Realtek Semiconductor Corp.; Realtek ALCFDRTM> 2008-05-27 18:37:49 0 d-------- C:\Documents and Settings\Mark\Application Data\Symantec 2008-05-27 18:12:41 0 d-------- C:\Program Files\NeroInstall.bak 2008-05-27 17:35:13 0 d-------- C:\Documents and Settings\Mark\Application Data\Nero 2008-05-27 17:31:08 0 d-------- C:\Program Files\Nero 2008-05-27 17:31:08 0 d-------- C:\Program Files\Common Files\Nero 2008-05-27 17:31:08 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-05-27 16:53:29 0 d-------- C:\WINDOWS\system32\PreInstall 2008-05-27 16:01:43 0 d-------- C:\Program Files\Norton 360 2008-05-27 16:00:29 0 d-------- C:\Program Files\Symantec 2008-05-27 16:00:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2008-05-27 15:59:27 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-27 15:52:17 0 d-------- C:\Program Files\MagicISO 2008-05-27 15:24:25 0 d-------- C:\Documents and Settings\Mark\Application Data\BitTorrent 2008-05-27 15:24:22 0 d-------- C:\Program Files\DNA 2008-05-27 15:24:22 0 d-------- C:\Program Files\BitTorrent 2008-05-27 15:24:22 0 d-------- C:\Documents and Settings\Mark\Application Data\DNA 2008-05-25 18:38:02 0 d-------- C:\Documents and Settings\Mark\Application Data\Macromedia 2008-05-25 18:25:54 0 d-------- C:\WINDOWS\CAVTemp 2008-05-25 10:04:17 0 d-------- C:\Documents and Settings\Mark\Application Data\CallingID 2008-05-25 10:03:33 0 d-------- C:\WINDOWS\Downloaded Installations 2008-05-25 10:03:22 6 --a------ C:\WINDOWS\system32\mkghj.dll 2008-05-25 10:02:47 0 d-------- C:\WINDOWS\rnapxs 2008-05-25 09:56:04 0 d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-05-25 09:35:24 0 d-------- C:\Program Files\Common Files\Control Panels 2008-05-25 09:33:21 0 d-------- C:\Documents and Settings\All Users\Application Data\ALM 2008-05-25 09:20:40 0 d-------- C:\Program Files\QuickTime 2008-05-25 09:10:47 0 d-------- C:\Documents and Settings\LocalService\Application Data\Macromedia 2008-05-25 09:07:44 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-05-25 09:04:45 0 d-------- C:\Program Files\Bonjour 2008-05-25 09:01:44 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-05-25 09:01:31 0 d-------- C:\Documents and Settings\Mark\Application Data\Adobe 2008-05-25 08:57:27 0 d-------- C:\Program Files\Common Files\Adobe 2008-05-25 08:55:11 313856 --a------ C:\WINDOWS\system32\andt.sys 2008-05-25 08:54:51 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine> 2008-05-25 08:54:51 0 d-------- C:\Documents and Settings\Mark\Application Data\Vso 2008-05-25 08:54:51 47360 --a------ C:\Documents and Settings\Mark\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine> 2008-05-25 08:54:49 217127 --a------ C:\WINDOWS\system32\drv43260.dll <Not Verified; RealNetworks, Inc.; RealVideo 9 (32-bit)> 2008-05-25 08:54:49 208935 --a------ C:\WINDOWS\system32\drv33260.dll <Not Verified; RealNetworks, Inc.; RealVideo 8 (32-bit)> 2008-05-25 08:54:49 176165 --a------ C:\WINDOWS\system32\drv23260.dll <Not Verified; RealNetworks, Inc.; RealVideo G2 (32-bit)> 2008-05-25 08:54:48 0 d-------- C:\Program Files\VSO 2008-05-25 08:50:44 0 d-------- C:\Documents and Settings\Mark\Application Data\WinRAR 2008-05-25 08:13:31 0 d-------- C:\Program Files\Microsoft Works 2008-05-25 08:13:19 0 d-------- C:\Program Files\MSBuild 2008-05-25 08:12:08 0 d-------- C:\Program Files\Microsoft.NET 2008-05-25 08:10:00 0 d-------- C:\WINDOWS\SHELLNEW 2008-05-25 08:09:42 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-25 08:09:29 0 dr-h----- C:\MSOCache 2008-05-25 08:06:59 0 d-------- C:\Program Files\Windows Media Connect 2 2008-05-25 08:06:15 0 d-------- C:\WINDOWS\system32\LogFiles 2008-05-25 08:06:15 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-05-25 08:03:08 0 d-------- C:\WINDOWS\pss 2008-05-25 08:01:57 0 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-25 08:01:53 0 d-------- C:\Documents and Settings\Mark\Contacts 2008-05-25 08:01:13 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-05-25 07:59:58 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-25 07:59:55 0 d-------- C:\Program Files\Windows Live 2008-05-25 07:59:49 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-24 21:11:11 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-05-24 20:58:21 0 d-------- C:\WINDOWS\Prefetch 2008-05-24 20:55:15 0 d-------- C:\WINDOWS\system32\scripting 2008-05-24 20:55:14 0 d-------- C:\WINDOWS\system32\en 2008-05-24 20:55:14 0 d-------- C:\WINDOWS\l2schemas 2008-05-24 20:53:12 0 d-------- C:\WINDOWS\network diagnostic 2008-05-24 20:19:07 0 d-------- C:\Documents and Settings\LocalService\Start Menu 2008-05-24 20:06:48 0 d-------- C:\WINDOWS\peernet 2008-05-24 20:06:47 0 d-------- C:\WINDOWS\provisioning 2008-05-24 20:05:51 0 d-------- C:\WINDOWS\ServicePackFiles 2008-05-24 20:03:37 0 d-------- C:\WINDOWS\EHome 2008-05-24 19:54:48 0 d---s---- C:\WINDOWS\system32\Microsoft 2008-05-24 19:54:48 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2008-05-24 15:31:26 0 d-------- C:\WINDOWS\system32\bits 2008-05-24 15:29:26 0 d-------- C:\Documents and Settings\Mark\Application Data\ATI 2008-05-24 15:22:07 0 d--h----- C:\BJPrinter 2008-05-24 15:21:08 0 d-------- C:\Program Files\Canon 2008-05-24 15:20:14 0 d--h----- C:\CanonMP 2008-05-24 14:59:08 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-05-24 14:58:59 0 d--hs---- C:\Documents and Settings\Mark\UserData 2008-05-24 14:48:55 0 d-------- C:\WINDOWS\RegisteredPackages 2008-05-24 14:47:11 0 d-------- C:\WINDOWS\system32\URTTemp 2008-05-24 14:46:26 516096 -----n--- C:\WINDOWS\system32\ati2sgag.exe <Not Verified; ; ATI Smart> 2008-05-24 14:46:08 0 d-------- C:\Program Files\ATI Technologies 2008-05-24 14:44:47 0 d-------- C:\Program Files\AMD 2008-05-24 14:43:54 40448 -----n--- C:\WINDOWS\system32\ChCfg.exe 2008-05-24 14:43:53 208896 -----n--- C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Update Application for Realtek AC'97> 2008-05-24 14:43:53 139264 -----n--- C:\WINDOWS\alcrmv.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Removing Tool> 2008-05-24 14:43:32 40817 --a------ C:\WINDOWS\system32\ali5minst.exe <Not Verified; ALi Coporation; Install Program for Windows 2000/Xp Drivers> 2008-05-24 14:43:31 25600 --a------ C:\WINDOWS\system32\uninst.exe <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> 2008-05-24 14:43:31 7168 --a------ C:\WINDOWS\system32\drivers\aliperf.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> 2008-05-24 14:43:31 7040 --a------ C:\WINDOWS\system32\drivers\aliidex.sys <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> 2008-05-24 14:43:31 0 d-------- C:\Program Files\ALi 2008-05-24 14:43:27 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2008-05-24 14:43:12 28672 -----n--- C:\WINDOWS\system32\UnLAN.exe 2008-05-24 14:43:12 35587 -----n--- C:\WINDOWS\system32\rmlan.exe <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> 2008-05-24 14:43:12 34307 -----n--- C:\WINDOWS\system32\drivers\Install.EXE <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> 2008-05-24 14:42:58 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-05-24 14:42:57 28672 -----n--- C:\WINDOWS\system32\unagp.exe 2008-05-24 14:42:57 35587 -----n--- C:\WINDOWS\system32\rmagp.exe <Not Verified; Windows ® 2000 DDK provider; Windows ® 2000 DDK driver> 2008-05-24 14:42:57 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-05-24 14:42:46 0 d-------- C:\Program Files\Common Files\InstallShield 2008-05-24 14:42:37 5824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-05-24 14:41:16 0 d--hs---- C:\WINDOWS\Installer 2008-05-24 14:41:14 0 d-------- C:\Documents and Settings\Mark\Application Data\Identities 2008-05-24 14:41:06 0 d--h----- C:\Documents and Settings\Mark\Templates 2008-05-24 14:41:06 0 dr------- C:\Documents and Settings\Mark\Start Menu 2008-05-24 14:41:06 0 dr-h----- C:\Documents and Settings\Mark\SendTo 2008-05-24 14:41:06 0 dr-h----- C:\Documents and Settings\Mark\Recent 2008-05-24 14:41:06 0 d--h----- C:\Documents and Settings\Mark\PrintHood 2008-05-24 14:41:06 2097152 --ah----- C:\Documents and Settings\Mark\NTUSER.DAT 2008-05-24 14:41:06 0 d--h----- C:\Documents and Settings\Mark\NetHood 2008-05-24 14:41:06 0 dr------- C:\Documents and Settings\Mark\My Documents 2008-05-24 14:41:06 0 d--h----- C:\Documents and Settings\Mark\Local Settings 2008-05-24 14:41:06 0 dr------- C:\Documents and Settings\Mark\Favorites 2008-05-24 14:41:06 0 d-------- C:\Documents and Settings\Mark\Desktop 2008-05-24 14:41:06 0 d--hs---- C:\Documents and Settings\Mark\Cookies 2008-05-24 14:41:06 0 dr-h----- C:\Documents and Settings\Mark\Application Data 2008-05-24 14:40:24 0 d--hs---- C:\System Volume Information 2008-05-24 14:40:22 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings 2008-05-24 14:40:22 0 d---s---- C:\Documents and Settings\NetworkService\Cookies 2008-05-24 14:40:22 0 d-------- C:\Documents and Settings\NetworkService\Application Data 2008-05-24 14:40:22 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft 2008-05-24 14:40:22 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT 2008-05-24 14:40:22 0 d--h----- C:\Documents and Settings\LocalService\Local Settings 2008-05-24 14:40:22 0 d--hs---- C:\Documents and Settings\LocalService\Cookies 2008-05-24 14:40:22 0 d-------- C:\Documents and Settings\LocalService\Application Data 2008-05-24 14:40:22 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft 2008-05-24 14:40:21 262144 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT 2008-05-24 14:37:58 0 d-------- C:\WINDOWS\system32\xircom 2008-05-24 14:37:58 0 d-------- C:\Program Files\microsoft frontpage 2008-05-24 14:37:55 262144 --ah----- C:\Documents and Settings\Default User\NTUSER.DAT 2008-05-24 14:37:47 0 -rahs---- C:\MSDOS.SYS 2008-05-24 14:37:47 0 -rahs---- C:\IO.SYS 2008-05-24 14:37:47 0 --a------ C:\CONFIG.SYS 2008-05-24 14:37:47 0 --a------ C:\AUTOEXEC.BAT 2008-05-24 14:37:01 0 d--hs---- C:\Documents and Settings\All Users\DRM 2008-05-24 14:36:55 0 dr------- C:\WINDOWS\Offline Web Pages 2008-05-24 14:36:55 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-05-24 14:36:35 0 d-------- C:\WINDOWS\srchasst 2008-05-24 14:36:30 0 d-------- C:\WINDOWS\system32\Macromed 2008-05-24 14:36:30 0 d-------- C:\WINDOWS\system32\DirectX 2008-05-24 14:36:19 0 d-------- C:\Program Files\Movie Maker 2008-05-24 14:35:58 0 d-------- C:\WINDOWS\system32\Restore 2008-05-24 14:35:53 0 d-------- C:\WINDOWS\PCHEALTH 2008-05-24 14:35:48 0 d---s---- C:\WINDOWS\Tasks 2008-05-24 14:35:46 0 d-------- C:\Program Files\Common Files\MSSoap 2008-05-24 14:35:37 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-05-24 14:35:22 0 d-------- C:\WINDOWS\Registration 2008-05-24 14:34:59 0 d--h----- C:\Program Files\WindowsUpdate 2008-05-24 14:34:59 0 d-------- C:\Program Files\Online Services 2008-05-24 14:34:53 0 d-------- C:\Program Files\Messenger 2008-05-24 14:34:45 0 d-------- C:\Program Files\MSN Gaming Zone 2008-05-24 14:34:38 0 d-------- C:\Program Files\Windows NT 2008-05-24 14:34:29 0 d-------- C:\WINDOWS\system32\MsDtc 2008-05-24 14:34:27 0 d-------- C:\WINDOWS\system32\Com 2008-05-24 10:24:17 0 d-------- C:\Program Files\Common Files\ODBC 2008-05-24 10:24:15 0 dr------- C:\Program Files 2008-05-24 10:24:15 0 d-------- C:\Program Files\Common Files 2008-05-24 10:24:15 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-05-24 10:23:56 0 d--h----- C:\Documents and Settings\Default User\Templates 2008-05-24 10:23:56 0 dr------- C:\Documents and Settings\Default User\Start Menu 2008-05-24 10:23:56 0 dr-h----- C:\Documents and Settings\Default User\SendTo 2008-05-24 10:23:56 0 d--h----- C:\Documents and Settings\Default User\Recent 2008-05-24 10:23:56 0 d--h----- C:\Documents and Settings\Default User\PrintHood 2008-05-24 10:23:56 0 d--h----- C:\Documents and Settings\Default User\NetHood 2008-05-24 10:23:56 0 d-------- C:\Documents and Settings\Default User\My Documents 2008-05-24 10:23:56 0 dr-h----- C:\Documents and Settings\Default User\Local Settings 2008-05-24 10:23:56 0 d-------- C:\Documents and Settings\Default User\Favorites 2008-05-24 10:23:56 0 d-------- C:\Documents and Settings\Default User\Desktop 2008-05-24 10:23:56 0 d---s---- C:\Documents and Settings\Default User\Cookies 2008-05-24 10:23:56 0 d--h----- C:\Documents and Settings\All Users\Templates 2008-05-24 10:23:56 0 dr------- C:\Documents and Settings\All Users\Start Menu 2008-05-24 10:23:56 0 d-------- C:\Documents and Settings\All Users\Favorites 2008-05-24 10:23:56 0 dr------- C:\Documents and Settings\All Users\Documents 2008-05-24 10:23:56 0 d-------- C:\Documents and Settings\All Users\Desktop 2008-05-24 10:23:45 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-05-24 10:23:45 0 d-------- C:\WINDOWS\system32\CatRoot 2008-05-24 10:23:40 0 dr-h----- C:\Documents and Settings\Default User\Application Data 2008-05-24 10:23:40 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft 2008-05-24 10:23:39 0 dr-h----- C:\Documents and Settings\All Users\Application Data 2008-05-24 10:23:39 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft 2008-05-24 10:23:04 0 d-------- C:\Documents and Settings 2008-05-24 10:19:36 0 d-------- C:\WINDOWS 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\WinSxS 2008-05-24 10:19:36 0 dr------- C:\WINDOWS\Web 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\twain_32 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\wins 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\wbem 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\usmt 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\spool 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\ShellExt 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\Setup 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\ras 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\oobe 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\npp 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\mui 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\inetsrv 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\IME 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\icsxml 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\ias 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\export 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\drivers 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-05-24 10:19:36 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\dhcp 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\config 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\3076 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\2052 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1054 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1042 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1041 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1037 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1033 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1031 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1028 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system32\1025 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\system 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\security 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Resources 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\repair 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\mui 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\msapps 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\msagent 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Media 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\java 2008-05-24 10:19:36 0 d--h----- C:\WINDOWS\inf 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\ime 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Help 2008-05-24 10:19:36 0 dr--s---- C:\WINDOWS\Fonts 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Driver Cache 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Debug 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Cursors 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Connection Wizard 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\Config 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\AppPatch 2008-05-24 10:19:36 0 d-------- C:\WINDOWS\addins -- Find3M Report --------------------------------------------------------------- 2008-05-25 08:54:54 34 --a------ C:\Documents and Settings\Mark\Application Data\pcouffin.log 2008-05-25 08:54:51 1144 --a------ C:\Documents and Settings\Mark\Application Data\pcouffin.inf 2008-05-25 08:54:51 7887 --a------ C:\Documents and Settings\Mark\Application Data\pcouffin.cat 2008-05-25 08:33:22 36602 --a------ C:\Documents and Settings\Mark\Application Data\Comma Separated Values (Windows).ADR 2008-05-24 10:23:56 62 --ahs---- C:\Documents and Settings\Mark\Application Data\desktop.ini -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [27/07/2004 05:01 PM C:\WINDOWS\SOUNDMAN.EXE] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [22/02/2005 09:05 PM] "@"="" [] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [22/02/2005 10:21 PM] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [27/10/2006 12:47 AM] "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [11/01/2008 07:54 PM] "Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [20/03/2007 04:40 PM] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10/01/2007 01:59 AM] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [29/01/2008 05:38 PM] "iRiver Updater"="\Updater.exe" [01/07/2004 05:20 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [13/04/2008 08:12 PM] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [27/05/2008 03:24 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "Microsoft"=wplayer.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "<NO NAME>"= "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2/22/2005 10:21:26 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc *Newly Created Service* - COMHOST -- Hosts ----------------------------------------------------------------------- 64.14.244.60 travelsow.com -- End of Deckard's System Scanner: finished at 2008-06-02 20:50:58 ------------ Extra.txt Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 3.0 Architecture: X86; Language: English CPU 0: AMD Athlon™ 64 Processor 3200+ Percentage of Memory in Use: 50% Physical Memory (total/avail): 1023.23 MiB / 508.31 MiB Pagefile Memory (total/avail): 2459.47 MiB / 2041.19 MiB Virtual Memory (total/avail): 2047.88 MiB / 1897.5 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 37.26 GiB total, 10.76 GiB free. D: is Removable (No Media) E: is CDROM (No Media) F: is CDROM (No Media) \\.\PHYSICALDRIVE0 - WDC WD400JB-00ENA0 - 37.27 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 37.26 GiB - C: \\.\PHYSICALDRIVE1 - Canon MP Memory Card USB Device -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Mark\Application Data CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=LEAFEN ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Mark LOGONSERVER=\\LEAFEN NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\Common Files\Nero\Lib\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 10, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=040a ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Mark\LOCALS~1\Temp TMP=C:\DOCUME~1\Mark\LOCALS~1\Temp USERDOMAIN=LEAFEN USERNAME=Mark USERPROFILE=C:\Documents and Settings\Mark windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Mark (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL --> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL --> C:\WINDOWS\UNRecode.exe /UNINSTALL --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {926CC8AE-8414-43DF-8EB4-CF26D9C3C663} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Add or Remove Adobe Creative Suite 3 Master Collection --> C:\Program Files\Common Files\Adobe\Installers\5ac697db6c6103f6f8b5198d25f73f7\Setup.exe Adobe After Effects CS3 --> MsiExec.exe /I{EB0202F7-016A-410C-ADE4-40F848CCC661} Adobe After Effects CS3 Presets --> MsiExec.exe /I{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285} Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95} Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61} Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394} Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23} Adobe BridgeTalk Plugin CS3 --> MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E} Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C} Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C} Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E} Adobe Color Common Settings --> C:\Program Files\Common Files\Adobe\Installers\6c8e2cb4fd241c55406016127a6ab2e\Setup.exe Adobe Color Common Settings --> MsiExec.exe /I{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF} Adobe Color EU Extra Settings --> MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8} Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029} Adobe Color NA Recommended Settings --> MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5} Adobe Contribute CS3 --> MsiExec.exe /I{FC9E08AA-CD59-4C59-BEF9-87E05B9E37D7} Adobe Creative Suite 3 Master Collection --> MsiExec.exe /I{0CEC06EF-5052-4CE8-8256-74AE363A4238} Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D} Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD} Adobe Dreamweaver CS3 --> MsiExec.exe /I{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25} Adobe Encore CS3 --> MsiExec.exe /I{54B2EAD9-A110-43F7-B010-2859A1BD2AFE} Adobe Encore CS3 Codecs --> MsiExec.exe /I{B8B7A4D8-80E1-4DAE-BD33-7FD535BA3931} Adobe ExtendScript Toolkit 2 --> C:\Program Files\Common Files\Adobe\Installers\3e054d2218e7aa282c2369d939e58ff\Setup.exe Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{24D7346D-D4B4-45E8-98EA-75EC14B42DD8} Adobe Extension Manager CS3 --> MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3} Adobe Fireworks CS3 --> MsiExec.exe /I{7DFC1012-D346-46CE-B03E-FF79125AE029} Adobe Flash CS3 --> MsiExec.exe /I{6B52140A-F189-4945-BFFC-DB3F00B8C589} Adobe Flash Player 9 ActiveX --> MsiExec.exe /X{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C} Adobe Flash Player 9 Plugin --> MsiExec.exe /X{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9} Adobe Flash Video Encoder --> MsiExec.exe /I{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2} Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B} Adobe Help Viewer CS3 --> MsiExec.exe /I{7ACFB90E-8FD0-4397-AD3A-5195412623A3} Adobe Illustrator CS3 --> MsiExec.exe /I{F08E8D2E-F132-4742-9C87-D5FF223A016A} Adobe InDesign CS3 --> MsiExec.exe /I{CB3F8375-B600-4B9F-83C9-238ED1E583FD} Adobe InDesign CS3 Icon Handler --> MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E} Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078} Adobe MotionPicture Color Files --> MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77} Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C} Adobe Photoshop CS3 --> MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05} Adobe Premiere Pro CS3 --> MsiExec.exe /I{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA} Adobe Premiere Pro CS3 Functional Content --> MsiExec.exe /I{50F102CA-4BE2-41A9-9810-5BB05EB91B9A} Adobe Premiere Pro CS3 Third Party Content --> MsiExec.exe /I{485ACF57-F364-440A-8496-E1E81C8FA1AA} Adobe Setup --> MsiExec.exe /I{1DDB76B6-9B33-47DE-8577-78EBFD3E2FF3} Adobe Setup --> MsiExec.exe /I{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1} Adobe Setup --> MsiExec.exe /I{B3C02EC1-A7B0-4987-9A43-8789426AAA7D} Adobe SING CS3 --> MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2} Adobe Soundbooth CS3 --> MsiExec.exe /I{A6B23EFA-6590-482C-A11F-5ACE1B91F5B9} Adobe Soundbooth CS3 Codecs --> MsiExec.exe /I{0327FA9D-975C-448C-A086-577D57BB25B8} Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183} Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312} Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8} Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5} Adobe Version Cue CS3 Server {ko_KR} --> MsiExec.exe /I{1D58229F-C505-45CA-8223-F35F3A34B963} Adobe Video Profiles --> MsiExec.exe /I{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC} Adobe WAS CS3 --> MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE} Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6} Adobe XMP DVA Panels CS3 --> MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F} Adobe XMP Panels CS3 --> MsiExec.exe /I{D5A31AB1-345D-47C7-A87B-036A669F6DF1} AHV content for Acrobat and Flash --> MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD} ALi mini IDE driver --> C:\WINDOWS\System32\ALi5minst.exe C:\WINDOWS\inf\mshdc.inf PCI\VEN_10B9&DEV_5229 1 AppCore --> MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B} Athlon 64 Processor Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x9 ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Catalyst Control Center --> MsiExec.exe /I{4B892137-6FB6-4622-B568-488E38F2E727} ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe" ATI Display Driver --> rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46FB-A6C6-4F8862742947}\setup.exe" AV --> MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA} BitTorrent --> C:\Program Files\BitTorrent\uninst.exe Canon MP Drivers --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58F8C6D9-5B55-486A-A322-4E8D87670031}\Setup.exe" -l0x9 -Uninstall Canon MP Toolbox 4.1.1.0.mp10 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4669544E-20E4-4E56-8B44-2E6E1200051F}\Setup.exe" -l0x9 -Uninstall ccCommon --> MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3} ConvertXtoDVD 2.2.3.258 --> "C:\Program Files\VSO\ConvertXtoDVD\unins000.exe" DNA --> "C:\Program Files\DNA\btdna.exe" /UNINSTALL GearDrvs --> MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09} iriver Music Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{072D2077-9E22-4F7F-B817-A92CA6CCC843}\Setup.exe" -l0x9 anything iRiver Updater --> \uninst.exe LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U LiveUpdate Notice (Symantec Corporation) --> MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8} Magic ISO Maker v5.4 (build 0239) --> C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE} Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE} Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE} Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE} Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE} Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE} Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE} Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE} Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE} Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE} Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Nero 8 --> MsiExec.exe /X{D6D5CB84-0E6E-4E69-B300-C690B6911033} neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} Norton 360 --> MsiExec.exe /I{21829177-4DED-4209-AD08-490B3AC9C01A} Norton 360 --> MsiExec.exe /I{2D617065-1C52-4240-B5BC-C0AE12157777} Norton 360 --> MsiExec.exe /I{63A6E9A9-A190-46D4-9430-2DB28654AFD8} Norton 360 --> MsiExec.exe /I{F413B69D-4AD6-42ab-AEA5-0548989FAD50} Norton 360 (Symantec Corporation) --> "C:\Program Files\Common Files\Symantec Shared\SymSetup\{2D617065-1C52-4240-B5BC-C0AE12157777}_1_0_0_184\{2D617065-1C52-4240-B5BC-C0AE12157777}.exe" /X Norton 360 Help --> MsiExec.exe /I{1CA941F1-5006-487E-9FD4-09F812A7D6B8} Norton Confidential Browser Component --> MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164} Norton Confidential Web Authentification Component --> MsiExec.exe /I{3074EB89-1BCA-4AEF-AFF4-EFB4634C1923} Norton Confidential Web Protection Component --> MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A} PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5} Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE Security Update for Excel 2007 (KB946974) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E} Security Update for Microsoft Office Publisher 2007 (KB950114) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85} Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00} Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9} Security Update for Office 2007 (KB947801) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E} Security Update for Outlook 2007 (KB946983) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3} SPBBC 32bit --> MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56} SuppSoft --> MsiExec.exe /I{022DA2C3-81C7-4003-A6BC-1BB147B20097} Symantec Technical Support Controls --> MsiExec.exe /I{92B1B3CC-EC78-45B8-96D0-8B3F11495864} SymNet --> MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2} ULi AGP Driver 2.20 --> C:\WINDOWS\System32\UnAGP.EXE RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DD0650C-5113-4FEE-BDDA-AC0B76FD0BD1}\Setup.exe" -uninst ULi LAN Driver --> C:\WINDOWS\System32\UnLAN.EXE RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{143BE018-D8F8-4014-8CB6-AF63F5799D21}\Setup.exe" -uninst Update for Office 2007 (KB946691) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278} Update for Outlook 2007 Junk Email Filter (kb950378) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F6296086-AED5-4EC0-938B-08EA0254F20E} VCRedistSetup --> MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027} Windows Live installer --> MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320} Windows Live Mail --> MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7} Windows Live Messenger --> MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0} Windows Live Photo Gallery --> MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C} Windows Live Sign-in Assistant --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows XP Service Pack 3 --> "C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type563 / Success Event Submitted/Written: 06/02/2008 04:44:30 PM Event ID/Source: 12001 / usnjsvc Event Description: The Messenger Sharing USN Journal Reader service started successfully. Event Record #/Type535 / Success Event Submitted/Written: 06/02/2008 04:36:25 PM Event ID/Source: 12001 / usnjsvc Event Description: The Messenger Sharing USN Journal Reader service started successfully. Event Record #/Type534 / Error Event Submitted/Written: 06/02/2008 04:02:04 PM Event ID/Source: 5000 / Microsoft Office 12 Event Description: EventType officelifeboathang, P1 winword.exe, P2 12.0.6308.5000, P3 ntdll.dll, P4 5.1.2600.5512, P5 NIL, P6 NIL, P7 NIL, P8 NIL, P9 officelifeboathang0, P10 officelifeboathang1. Event Record #/Type389 / Success Event Submitted/Written: 05/27/2008 05:59:04 AM Event ID/Source: 25 / UmxCfg Event Description: Service started Event Record #/Type385 / Success Event Submitted/Written: 05/27/2008 05:57:52 AM Event ID/Source: 2 / UmxAgent Event Description: Service stopped -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type998 / Warning Event Submitted/Written: 06/02/2008 04:39:25 PM Event ID/Source: 1003 / Dhcp Event Description: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 000B6ACB5FB6. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Event Record #/Type960 / Error Event Submitted/Written: 06/01/2008 07:41:59 PM Event ID/Source: 59 / SideBySide Event Description: Generate Activation Context failed for C:\Program Files\Common Files\Nero\AudioPlugins\MSAxp.dll. Reference error message: The operation completed successfully. . Event Record #/Type959 / Error Event Submitted/Written: 06/01/2008 07:41:59 PM Event ID/Source: 58 / SideBySide Event Description: Syntax error in manifest or policy file "Manifest Parse Error : An Invalid character was found in text content. 1" on line Manifest Parse Error : An Invalid character was found in text content. 2. Event Record #/Type958 / Error Event Submitted/Written: 06/01/2008 07:41:59 PM Event ID/Source: 59 / SideBySide Event Description: Generate Activation Context failed for C:\Program Files\Common Files\Nero\AudioPlugins\msa.dll. Reference error message: The operation completed successfully. . Event Record #/Type957 / Error Event Submitted/Written: 06/01/2008 07:41:59 PM Event ID/Source: 58 / SideBySide Event Description: Syntax error in manifest or policy file "Manifest Parse Error : An Invalid character was found in text content. 1" on line Manifest Parse Error : An Invalid character was found in text content. 2. -- End of Deckard's System Scanner: finished at 2008-06-02 20:50:58 ------------ Thank you for any help |
 |
 
|
|
Jun 10 2008, 11:06 AM
Post
#2
|
|
 Forum God  Group: Classroom Teacher Posts: 11,293 Joined: 3-December 04 From: Darien, Connecticut Member No.: 19,436 Operating System: Win 7 Ultimate Win Xp Home SP3 
|
Hello leafen
Welcome to the Whatthetech Malware Removal Forum Sorry for the delay in responding but with the amount of people posting with infected computers there are not enough hours in the day You have many infections on this system, one being a downloader that downloads other garbage while your online so I strongly urge you outside of posting here to stay off the internet until we give you the all clear sign. This first tool will remove the SDBot worm and to be effective it has to be run from Safemode. So download it to your desktop then boot to safemode to run it. QUOTE To Enter Safemode
Tutorial if you need it How to boot into Safemode Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
Then reboot and make sure you save the log, I need to see it and lets run the free version of Malwarebytes. Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application.
Lets not use DSS right now, after you run both these programs then download and install Hijackthis by Trendmicro and post the log. Download Trendmicros Hijackthis to your desktop. Double click it to install Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required. This is what I need. 1. SDFix log 2. Malwarebytes log 3. Hijackthis log by Trendmicro |
|
|
|
|
Jun 10 2008, 04:26 PM
Post
#3
|
|
|
New Member Group: New Member Posts: 5 Joined: 2-June 08 Member No.: 79,419 Operating System: XP |
Here is the SDX LOG b]SDFix: Version 1.190 [/b] Run by Mark on 10/06/2008 at 05:46 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-10 18:15:33 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS] "StateIndex"=dword:00000001 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe" "C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"="C:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe:*:Enabled:Adobe Version Cue CS3 Server" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" Remaining Files : Files with Hidden Attributes : Thu 5 Jun 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Tue 3 Jun 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4f79e01ce8ee10a7556514a051f797f4\BIT5.tmp" Tue 10 Jun 2008 8,914,472 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f4af55d0bd88e56475d53154fd62d5a0\BIT9.tmp" Tue 10 Jun 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\339908b7528b426712407aa3c98876a1\download\BITC.tmp" Finished! |
|
|
|
|
Jun 10 2008, 04:45 PM
Post
#4
|
|
|
New Member Group: New Member Posts: 5 Joined: 2-June 08 Member No.: 79,419 Operating System: XP |
Here is the MBam Log
Malwarebytes' Anti-Malware 1.17 Database version: 846 6:42:07 PM 10/06/2008 mbam-log-6-10-2008 (18-42-07).txt Scan type: Quick Scan Objects scanned: 39726 Time elapsed: 5 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:44:44 PM, on 10/06/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\PROGRA~1\AVG\AVG8\avgfws8.exe C:\Program Files\DNA\btdna.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgam.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.canada.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 9088 bytes |
|
|
|
|
Jun 10 2008, 06:51 PM
Post
#5
|
|
|
New Member Group: New Member Posts: 5 Joined: 2-June 08 Member No.: 79,419 Operating System: XP |
I am unable to messenger a member...any ideas. I do not wish to reply in the message but I would rather message him instead. If that makes sense?.
See " Involuntarily Music/voices in background " (Hijacking) |
|
|
|
|
Jun 10 2008, 07:15 PM
Post
#6
|
|
|
Forum God Group: Classroom Teacher Posts: 11,293 Joined: 3-December 04 From: Darien, Connecticut Member No.: 19,436 Operating System: Win 7 Ultimate Win Xp Home SP3
|
Hello,
Looks like SDFix got it all , all the markers on your log for the SDBot worm are gone along with many other entries. Please download ATF Cleaner by Atribune to your desktop.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up How are things running now??? |
|
|
|
|
Jun 11 2008, 03:02 AM
Post
#7
|
|
|
Forum God Group: Classroom Teacher Posts: 11,293 Joined: 3-December 04 From: Darien, Connecticut Member No.: 19,436 Operating System: Win 7 Ultimate Win Xp Home SP3
|
Hello,
QUOTE I am unable to messenger a member...any ideas. I do not wish to reply in the message but I would rather message him instead. If that makes sense?. Not sure what you want to do here, we only fix computers through the forum and not by PMThe forum prohibits PMs until you have about 5 or 6 replies added to your account. How are things running now??? |
|
|
|
|
Jun 18 2008, 06:39 AM
Post
#8
|
|
|
Forum God Group: Classroom Teacher Posts: 11,293 Joined: 3-December 04 From: Darien, Connecticut Member No.: 19,436 Operating System: Win 7 Ultimate Win Xp Home SP3
|
Due to inactivity this topic will be closed.
If you need help please start a new thread and post a new HJT log |
|
|
|
|
Similar Topics
| Topic Title | Replies | Topic Starter | Views | Last Action | |||
|---|---|---|---|---|---|---|---|
 |
7 | mollzzfirstsn | 153 | Today, 10:54 AM Last post by: CatByte |
|||
|
10 | larryri42 | 156 | Today, 10:51 AM Last post by: CatByte |
|||
 |
17 | mojomojo | 290 | Today, 10:28 AM Last post by: ken545 |
|||
|
12 | dandylion | 150 | Today, 10:27 AM Last post by: ken545 |
|||
|
Time is now: 18th March 2010 - 01:32 PM |
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy
