[Closed] Please help me to understand more

Computer forums for help with removing malicious software (malware) and improving computer security

grin Welcome to What the Tech! ( Log In | Register ) What tech support ought to be... Fast, friendly and free! Once registered - you'll have the ability to post your question in the appropriate forum below. Additionally, if you can assist another member by sharing your tech knowledge, please post a reply! Best of all - Registration and all assistance is FREE! Once you've completed registration, simply choose the appropriate forum below, click on the "new topic" button, and post your question! What are you waiting for? Register today! *Registered users see NO ADVERTISING.

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

2 Pages

1 2 >

[Closed] Please help me to understand more

Options

beroo View Member Profile	Jun 5 2009, 05:38 PM Post #1
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:15:00 AM, on 6/6/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\idt\wdm\stacsv.exe C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\sttray.exe C:\WINDOWS\system32\AESTFltr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Internet Explorer\iexplore.exe c:\program files\aol\aol toolbar 5.0\AolTbServer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [IDTSysTrayApp] sttray.exe O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe /TrayMode O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-MY\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\stacsv.exe -- End of file - 7176 bytes

SpySentinel View Member Profile	Jun 5 2009, 07:05 PM Post #2
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi beroo, My name is SpySentinel and I will be helping you with your computer problem. Step #1 Please download Malwarebytes' Anti-Malware Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Step #2 Download Rooter.exe to your desktop Then doubleclick it to start the tool A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here Step #3 Download OTL to your desktop. Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Check the boxes beside LOP Check and Purity Check. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2. Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. Post the OTL, Rooter, and Malwarebytes' Logs in your next reply.

beroo View Member Profile	Jun 8 2009, 11:55 PM Post #3
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	Rooter Microsoft Windows XP Home Edition (5.1.2600) Service Pack 3 C:\ [Fixed] - NTFS - (Total:76308 Mo/Free:2629 Mo) Tue 06/09/2009\|13:51 ----------------------\\ Processes.. --Locked-- [System Process] ---------- System ---------- \SystemRoot\System32\smss.exe ---------- \??\C:\WINDOWS\system32\csrss.exe ---------- \??\C:\WINDOWS\system32\winlogon.exe ---------- C:\WINDOWS\system32\services.exe ---------- C:\WINDOWS\system32\lsass.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\spoolsv.exe ---------- c:\program files\idt\wdm\stacsv.exe ---------- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ---------- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\alg.exe ---------- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe ---------- C:\WINDOWS\Explorer.EXE ---------- C:\WINDOWS\system32\igfxtray.exe ---------- C:\WINDOWS\system32\hkcmd.exe ---------- C:\WINDOWS\system32\igfxpers.exe ---------- C:\WINDOWS\system32\igfxsrvc.exe ---------- C:\Program Files\IDT\WDM\sttray.exe ---------- C:\WINDOWS\system32\AESTFltr.exe ---------- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ---------- C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe ---------- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe ---------- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe ---------- C:\WINDOWS\system32\wbem\wmiprvse.exe ---------- C:\WINDOWS\system32\ctfmon.exe ---------- C:\Program Files\Windows Live\Messenger\msnmsgr.exe ---------- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe ---------- C:\Program Files\Windows Live\Contacts\wlcomm.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- c:\program files\aol\aol toolbar 5.0\AolTbServer.exe ---------- C:\WINDOWS\system32\wuauclt.exe ---------- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe ---------- C:\WINDOWS\system32\cmd.exe ---------- C:\Rooter$\RK.exe ----------------------\\ Search.. ----------------------\\ ROOTKIT !! 1 - "C:\Rooter$\Rooter_1.txt" - Tue 06/09/2009\|13:52 ----------------------\\ Scan completed at 13:52

beroo View Member Profile	Jun 8 2009, 11:59 PM Post #4
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	Malwarebytes' Anti-Malware 1.37 Database version: 2250 Windows 5.1.2600 Service Pack 3 6/9/2009 1:57:03 PM mbam-log-2009-06-09 (13-57-03).txt Scan type: Quick Scan Objects scanned: 85690 Time elapsed: 8 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

beroo View Member Profile	Jun 9 2009, 12:10 AM Post #5
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	OTL Extras logfile created on: 6/9/2009 2:02:14 PM - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DTSLYD8J Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 1015.23 Mb Total Physical Memory \| 458.25 Mb Available Physical Memory \| 45.14% Memory free 2.38 Gb Paging File \| 1.94 Gb Available in Paging File \| 81.36% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 74.52 Gb Total Space \| 66.57 Gb Free Space \| 89.33% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PC183754137168 Current User Name: Kelly chen Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall" = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] %windir%\Network Diagnostic\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\wlcsdk.exe::Enabled:Windows Live Call (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] %windir%\Network Diagnostic\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) C:\Program Files\Common Files\AOL\Loader\aolload.exe::Enabled:AOL Loader (AOL LLC) C:\Program Files\Windows Live\Messenger\wlcsdk.exe::Enabled:Windows Live Call (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger (Microsoft Corporation) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR "{0517F875-BBB2-4812-A63E-733B33CEF215}" = Roxio Instant Restore "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer "{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{275E7C8F-5407-4E2D-9506-0DC5BC59B14E}" = MigoMobile DESKTOP 4 "{2B682751-E749-441C-A4B3-1F538E26E56E}" = Roxio Instant Restore Recovery Disk "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7 "{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}" = Roxio BackOnTrack "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant "{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update "{4F2AF17E-94F0-4F22-943D-216CE46AC502}" = HP Mobile Broadband Setup Utility "{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack "{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail "{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2 "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility "{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com "{87A83C6F-F53C-448A-B078-FF00E3EAEB29}" = Roxio Disaster Recovery "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system "{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI "{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support "{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9 "{B5B25043-42A0-4490-A425-C7A6284213E6}" = HP User Guides 0130 "{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials "{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp "{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call "553D07C7937AEF19AECBF1E27F5709BCDA84B2C7" = Windows Driver Package - SMSC LAN9500 USB 2.0 to Ethernet 10/100 Adapter x86 Driver (05/12/2008 1.52.0000.0000) "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "AIM_6" = AIM 6 "AOL Toolbar" = AOL Toolbar 5.0 "Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter "com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com "HDMI" = Intel® Graphics Media Accelerator Driver "HijackThis" = HijackThis 2.0.2 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "MSNINST" = MSN "NIS" = Norton Internet Security "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "SynTPDeinstKey" = Synaptics Pointing Device Driver "ViewpointMediaPlayer" = Viewpoint Media Player "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "WinLiveSuite_Wave3" = Windows Live Essentials "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 ========== Last 10 Event Log Errors ========== [ System Events ] Error - 6/2/2009 9:41:25 AM \| Computer Name = PC183754137168 \| Source = Windows Update Agent \| ID = 16 Description = Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection. Error - 6/4/2009 11:22:33 AM \| Computer Name = PC183754137168 \| Source = Dhcp \| ID = 1000 Description = Your computer has lost the lease to its IP address 192.168.1.143 on the Network Card with network address 00242B7F8DCF. Error - 6/4/2009 11:27:51 AM \| Computer Name = PC183754137168 \| Source = Service Control Manager \| ID = 7009 Description = Timeout (30000 milliseconds) waiting for the crd service to connect. Error - 6/4/2009 11:27:51 AM \| Computer Name = PC183754137168 \| Source = Service Control Manager \| ID = 7000 Description = The crd service failed to start due to the following error: %%1053 Error - 6/4/2009 10:21:00 PM \| Computer Name = PC183754137168 \| Source = PlugPlayManager \| ID = 12 Description = The device 'Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller' (PCI\VEN_11AB&DEV_4354&SUBSYS_361A103C&REV_00\4&23c6fc68&0&00E1) disappeared from the system without first being prepared for removal. Error - 6/5/2009 7:04:37 PM \| Computer Name = PC183754137168 \| Source = Dhcp \| ID = 1002 Description = The IP address lease 192.168.1.104 for the Network Card with network address 00248140A083 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). Error - 6/9/2009 1:30:24 AM \| Computer Name = PC183754137168 \| Source = Dhcp \| ID = 1002 Description = The IP address lease 192.168.1.33 for the Network Card with network address 00248140A083 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). < End of report > OTL logfile created on: 6/9/2009 2:02:14 PM - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DTSLYD8J Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 1015.23 Mb Total Physical Memory \| 458.25 Mb Available Physical Memory \| 45.14% Memory free 2.38 Gb Paging File \| 1.94 Gb Available in Paging File \| 81.36% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 74.52 Gb Total Space \| 66.57 Gb Free Space \| 89.33% Space Free \| Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PC183754137168 Current User Name: Kelly chen Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe (Sonic Solutions) PRC - c:\program files\idt\wdm\stacsv.exe (IDT, Inc.) PRC - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe () PRC - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation) PRC - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) PRC - C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation) PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.) PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation) PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.) PRC - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.) PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe () PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - c:\program files\aol\aol toolbar 5.0\AolTbServer.exe (AOL LLC) PRC - C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DTSLYD8J\OTL[2].exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 [Auto \| Running]) -- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe () SRV - (aspnet_state [On_Demand \| Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (BOTService [Auto \| Running]) -- C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe (Sonic Solutions) SRV - (clr_optimization_v2.0.50727_32 [On_Demand \| Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (helpsvc [Auto \| Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (hpqwmiex [On_Demand \| Running]) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.) SRV - (IDriverT [On_Demand \| Stopped]) -- c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (Norton Internet Security [Auto \| Running]) -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation) SRV - (STacSV [Auto \| Running]) -- c:\program files\idt\wdm\stacsv.exe (IDT, Inc.) SRV - (WMPNetworkSvc [On_Demand \| Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) SRV - (spupdsvc [Auto \| Stopped]) -- C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (AESTAud [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation) DRV - (AliIde [Boot \| Running]) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (amdagp [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (asc [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550 [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (BCM43XX [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\bcmwl5.sys (Broadcom Corporation) DRV - (BHDrvx86 [System \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\BHDrvx86.sys (Symantec Corporation) DRV - (ccHP [System \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\ccHPx86.sys (Symantec Corporation) DRV - (CmdIde [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (dac2w2k [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (eeCtrl [System \| Running]) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv [On_Demand \| Running]) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (HDAudBus [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (ialm [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\igxpmp32.sys (Intel Corporation) DRV - (IDSxpx86 [System \| Running]) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090604.001\IDSxpx86.sys (Symantec Corporation) DRV - (mraid35x [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (NAVENG [On_Demand \| Running]) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.033\NAVENG.SYS (Symantec Corporation) DRV - (NAVEX15 [On_Demand \| Running]) -- C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.033\NAVEX15.SYS (Symantec Corporation) DRV - (Ptilink [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot \| Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (ql1080 [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql12160 [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1280 [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (SahdIa32 [Boot \| Running]) -- C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions) DRV - (SaibIa32 [Boot \| Running]) -- C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions) DRV - (SaibVd32 [System \| Running]) -- C:\WINDOWS\System32\Drivers\SaibVd32.sys (Sonic Solutions) DRV - (Secdrv [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (sisagp [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation) DRV - (Sparrow [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (SRTSP [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSP.SYS (Symantec Corporation) DRV - (SRTSPX [System \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSPX.SYS (Symantec Corporation) DRV - (STHDA [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.) DRV - (symc810 [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (symc8xx [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (SYMDNS [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMDNS.SYS (Symantec Corporation) DRV - (SymEFA [Boot \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMEFA.SYS (Symantec Corporation) DRV - (SymEvent [On_Demand \| Running]) -- C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (SYMFW [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMFW.SYS (Symantec Corporation) DRV - (SYMIDS [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMIDS.SYS (Symantec Corporation) DRV - (SymIM [On_Demand \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\SymIM.sys (Symantec Corporation) DRV - (SymIMMP [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\SymIM.sys (Symantec Corporation) DRV - (SYMNDIS [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMNDIS.SYS (Symantec Corporation) DRV - (SYMREDRV [On_Demand \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMREDRV.SYS (Symantec Corporation) DRV - (SYMTDI [System \| Running]) -- C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMTDI.SYS (Symantec Corporation) DRV - (sym_hi [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (sym_u3 [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (SynTP [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics, Inc.) DRV - (SysCow [Boot \| Running]) -- C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions) DRV - (ultra [Disabled \| Stopped]) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (yukonwxp [On_Demand \| Running]) -- C:\WINDOWS\system32\DRIVERS\yk51x86.sys (Marvell) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {7BA52691-1876-45ce-9EE6-54BCB3B04BBC}:3.0 FF - prefs.js..extensions.enabledItems: {8545daff-ad1e-493f-a37e-eed1ac79682b}:1.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/06/05 12:56:09 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/06/05 12:54:48 \| 00,000,000 \| ---D \| M] [2009/06/05 13:07:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\mozilla\Extensions [2009/06/05 13:07:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/05 13:07:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\mozilla\Firefox\Profiles\8h0gatt6.default\extensions [2009/06/09 13:26:26 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions [2009/06/05 12:54:49 \| 00,000,000 \| ---D \| M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/04/24 12:38:30 \| 00,023,032 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/04/24 12:38:32 \| 00,134,648 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2009/04/24 08:39:08 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/04/24 08:39:08 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/04/24 08:39:08 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/04/24 08:39:08 \| 00,002,343 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/04/24 08:39:08 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/04/24 08:39:08 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/04/24 08:39:08 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - Reg Error: Key error. File not found O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL (Symantec Corporation) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated) O4 - HKLM..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg (Andrea Electronics Corporation) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe /TrayMode (Hewlett-Packard Company) O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [IDTSysTrayApp] sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE (Microsoft Corporation) O4 - HKLM..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 (Microsoft Corporation) O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC () O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName (Microsoft Corporation) O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC (Microsoft Corporation) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe (IDT, Inc.) O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (Microsoft Corporation) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-MY\local\search.html () O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: () - * [2009/06/06 07:14:36 \| 00,000,000 \| ---D \| M] ========== Files/Folders - Created Within 30 Days ========== [36 C:\WINDOWS\System32\.tmp files] [2009/06/09 13:51:28 \| 00,000,000 \| ---D \| C] -- C:\Rooter$ [2009/06/09 13:46:14 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Malwarebytes [2009/06/09 13:46:07 \| 00,000,696 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/09 13:46:02 \| 00,040,160 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/06/09 13:45:55 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/06/09 13:45:54 \| 00,019,096 \| ---- \| C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/06/09 13:45:53 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/06/09 13:37:16 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\ie7updates [2009/06/09 13:36:42 \| 00,000,150 \| ---- \| C] () -- C:\WINDOWS\System32\spupdsvc.inf [2009/06/09 13:27:58 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\LastGood [2009/06/07 23:51:31 \| 00,268,648 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2009/06/07 23:51:31 \| 00,208,744 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\muweb.dll [2009/06/07 23:51:31 \| 00,027,496 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2009/06/06 07:14:36 \| 00,001,734 \| ---- \| C] () -- C:\Documents and Settings\Kelly chen\Desktop\HijackThis.lnk [2009/06/06 07:14:34 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Trend Micro [2009/06/05 18:16:10 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Documents\microsoft [2009/06/05 14:00:14 \| 00,138,496 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\afd.sys [2009/06/05 14:00:14 \| 00,138,496 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\afd.sys [2009/06/05 13:57:41 \| 00,284,160 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pdh.dll [2009/06/05 13:57:40 \| 00,401,408 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll [2009/06/05 13:57:40 \| 00,035,328 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\sc.exe [2009/06/05 13:57:40 \| 00,035,328 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sc.exe [2009/06/05 13:57:39 \| 00,473,600 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll [2009/06/05 13:57:39 \| 00,227,840 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe [2009/06/05 13:57:39 \| 00,110,592 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\services.exe [2009/06/05 13:57:39 \| 00,110,592 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\services.exe [2009/06/05 13:57:38 \| 00,453,120 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll [2009/06/05 13:57:37 \| 00,729,088 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\lsasrv.dll [2009/06/05 13:57:37 \| 00,729,088 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll [2009/06/05 13:57:37 \| 00,714,752 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\ntdll.dll [2009/06/05 13:57:37 \| 00,714,752 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntdll.dll [2009/06/05 13:57:37 \| 00,617,472 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\advapi32.dll [2009/06/05 13:57:37 \| 00,617,472 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\advapi32.dll [2009/06/05 13:57:35 \| 02,145,280 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\ntoskrnl.exe [2009/06/05 13:57:35 \| 02,145,280 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2009/06/05 13:57:33 \| 02,189,056 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2009/06/05 13:57:32 \| 02,023,936 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\ntkrnlpa.exe [2009/06/05 13:57:32 \| 02,023,936 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2009/06/05 13:50:01 \| 00,337,408 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll [2009/06/05 13:46:02 \| 00,002,560 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll [2009/06/05 13:46:01 \| 01,203,922 \| ---- \| C] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb [2009/06/05 13:46:00 \| 00,215,552 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wordpad.exe [2009/06/05 13:44:59 \| 00,272,128 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthport.sys [2009/06/05 13:44:59 \| 00,272,128 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys [2009/06/05 13:40:16 \| 00,765,952 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vgx.dll [2009/06/05 13:27:37 \| 00,203,136 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rmcast.sys [2009/06/05 13:27:37 \| 00,203,136 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rmcast.sys [2009/06/05 13:27:04 \| 00,455,296 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\mrxsmb.sys [2009/06/05 13:27:04 \| 00,455,296 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys [2009/06/05 13:25:08 \| 00,333,952 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\srv.sys [2009/06/05 13:25:08 \| 00,333,952 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys [2009/06/05 13:24:00 \| 00,331,776 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msadce.dll [2009/06/05 13:21:25 \| 00,691,712 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll [2009/06/05 13:15:22 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Microsoft [2009/06/05 13:14:54 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Windows Live SkyDrive [2009/06/05 13:14:18 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Windows Live [2009/06/05 13:07:05 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Mozilla [2009/06/05 13:04:18 \| 00,247,326 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\strmdll.dll [2009/06/05 13:04:18 \| 00,247,326 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\strmdll.dll [2009/06/05 13:01:40 \| 00,000,591 \| ---- \| C] () -- C:\Documents and Settings\Kelly chen\Desktop\Shortcut to KMPlayer.lnk [2009/06/05 13:01:22 \| 00,000,000 \| ---D \| C] -- C:\Program Files\KMP [2009/06/05 12:56:43 \| 01,106,944 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msxml3.dll [2009/06/05 12:56:12 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\nsreg.dat [2009/06/05 12:55:01 \| 00,001,602 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk [2009/06/05 12:54:40 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Mozilla Firefox [2009/06/05 12:51:47 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Windows Live [2009/06/05 00:13:07 \| 00,000,000 \| R--D \| C] -- C:\Documents and Settings\Kelly chen\My Documents\My Videos [2009/06/05 00:13:07 \| 00,000,000 \| R--D \| C] -- C:\Documents and Settings\All Users\Documents\My Videos [2009/06/05 00:12:57 \| 00,000,782 \| ---- \| C] () -- C:\Documents and Settings\Kelly chen\Desktop\Windows Media Player.lnk [2009/06/05 00:12:22 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage [2009/06/05 00:11:12 \| 00,026,368 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\USBSTOR.SYS [2009/06/04 23:23:23 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\System32\PreInstall [2009/06/02 22:07:38 \| 00,202,776 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuweb.dll [2009/06/02 22:07:35 \| 00,323,608 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll [2009/06/02 22:07:34 \| 01,809,944 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaueng.dll [2009/06/02 22:07:34 \| 00,213,528 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuaucpl.cpl [2009/06/02 22:07:33 \| 00,051,224 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuauclt.exe [2009/06/02 22:07:32 \| 00,561,688 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll [2009/06/02 22:07:31 \| 00,092,696 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\cdm.dll [2009/05/30 22:44:30 \| 00,000,205 \| ---- \| C] () -- C:\Documents and Settings\Kelly chen\Desktop\HP Battery Check.lnk [2009/05/30 21:05:12 \| 00,035,888 \| R--- \| C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SymIM.sys [2009/05/30 21:05:03 \| 00,060,808 \| ---- \| C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL [2009/05/30 21:05:02 \| 00,124,464 \| ---- \| C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS [2009/05/30 21:05:02 \| 00,010,635 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT [2009/05/30 21:05:02 \| 00,000,806 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF [2009/05/30 21:05:01 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Symantec [2009/05/30 21:05:01 \| 00,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Symantec Shared [2009/05/30 01:09:26 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\Kelly chen\Application Data\desktop.ini [2009/05/30 01:09:25 \| 00,000,081 \| -HS- \| C] () -- C:\Documents and Settings\Kelly chen\My Documents\desktop.ini [2009/05/30 01:09:25 \| 00,000,062 \| -HS- \| C] () -- C:\Documents and Settings\Kelly chen\Local Settings\desktop.ini [2009/05/30 01:09:24 \| 00,000,084 \| -HS- \| C] () -- C:\Documents and Settings\Kelly chen\Start Menu\Programs\Startup\desktop.ini [2009/05/30 01:09:24 \| 00,000,000 \| --SD \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Microsoft [2009/05/30 01:09:24 \| 00,000,000 \| R--D \| C] -- C:\Documents and Settings\Kelly chen\My Documents\My Pictures [2009/05/30 01:09:24 \| 00,000,000 \| R--D \| C] -- C:\Documents and Settings\Kelly chen\My Documents\My Music [2009/05/30 01:09:24 \| 00,000,000 \| -HSD \| C] -- C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files [2009/05/30 01:09:24 \| 00,000,000 \| -HSD \| C] -- C:\Documents and Settings\Kelly chen\Local Settings\History [2009/05/30 01:09:24 \| 00,000,000 \| -H-D \| C] -- C:\Documents and Settings\Kelly chen\Local Settings\Application Data [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Local Settings\Temp [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\TMP [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Sun [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\MigoMobile [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Macromedia [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\InstallShield [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Identities [2009/05/30 01:09:24 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Kelly chen\Application Data\Adobe [2009/05/29 10:21:54 \| 00,221,184 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\wmpns.dll [2009/05/29 10:20:49 \| 03,170,304 \| RHS- \| C] () -- C:\Boot.sdi [2009/05/29 10:20:49 \| 00,333,203 \| RHS- \| C] () -- C:\bootmgr [2009/05/29 10:20:49 \| 00,259,584 \| RHS- \| C] (Microsoft Corporation) -- C:\BCDEDIT.EXE [2009/05/29 10:20:49 \| 00,259,584 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\bcdedit.exe [2009/05/29 10:20:49 \| 00,102,400 \| RHS- \| C] (Microsoft Corporation) -- C:\bootsect.exe [2009/05/29 10:20:10 \| 18,356,0527 \| RHS- \| C] () -- C:\BootENU.wim [2009/05/29 10:20:10 \| 00,000,000 \| -HSD \| C] -- C:\Boot [2009/05/29 10:20:05 \| 00,000,282 \| ---- \| C] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job [2009/05/29 10:19:51 \| 00,111,680 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\BootSect.exe [2009/05/29 10:19:43 \| 00,001,931 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\eBay.com.my.lnk [2009/05/29 10:19:41 \| 00,001,851 \| ---- \| C] () -- C:\Documents and Settings\All Users\Desktop\My HP Games.lnk [2009/05/29 10:19:10 \| 00,873,134 \| ---- \| C] () -- C:\WINDOWS\System32\oem1.inf [2009/05/29 10:14:28 \| 00,000,000 \| ---D \| C] -- C:\WINDOWS\Prefetch [2009/05/29 10:11:27 \| 00,571,392 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\TINTLGNT.IME [2009/05/29 10:11:27 \| 00,021,504 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\CINTLGNT.IME [2009/05/29 10:11:26 \| 00,079,360 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\winar30.ime [2009/05/29 10:11:26 \| 00,079,360 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\phon.ime [2009/05/29 10:11:26 \| 00,078,848 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dayi.ime [2009/05/29 10:11:26 \| 00,078,336 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\chajei.ime [2009/05/29 10:11:26 \| 00,077,824 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\quick.ime [2009/05/29 10:11:26 \| 00,076,288 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\uniime.dll [2009/05/29 10:11:26 \| 00,065,536 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\winime.ime [2009/05/29 10:11:26 \| 00,065,024 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\unicdime.ime [2009/05/29 10:11:26 \| 00,026,112 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\romanime.ime [2009/05/29 10:11:26 \| 00,011,776 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\miniime.tpl [2009/05/29 10:11:24 \| 00,482,304 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\PINTLGNT.IME [2009/05/29 10:11:23 \| 00,218,112 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\c_g18030.dll [2009/05/29 10:11:23 \| 00,156,672 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\WINZM.IME [2009/05/29 10:11:23 \| 00,156,672 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\WINSP.IME [2009/05/29 10:11:23 \| 00,156,672 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\WINPY.IME [2009/05/29 10:11:23 \| 00,094,720 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\imekr61.ime [2009/05/29 10:11:23 \| 00,072,704 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\WINGB.IME [2009/05/29 10:11:23 \| 00,007,168 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdibm02.dll [2009/05/29 10:11:23 \| 00,007,168 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\f3ahvoas.dll [2009/05/29 10:11:23 \| 00,006,656 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdlk41a.dll [2009/05/29 10:11:23 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdlk41j.dll [2009/05/29 10:11:23 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd106n.dll [2009/05/29 10:11:22 \| 00,811,064 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\imjp81k.dll [2009/05/29 10:11:22 \| 00,340,023 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\imjp81.ime [2009/05/29 10:11:22 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdax2.dll [2009/05/29 10:11:22 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd101.dll [2009/05/29 10:11:20 \| 00,185,344 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\Thawbrkr.dll [2009/05/29 10:11:20 \| 00,066,594 \| ---- \| C] () -- C:\WINDOWS\System32\c_864.nls [2009/05/29 10:11:20 \| 00,066,594 \| ---- \| C] () -- C:\WINDOWS\System32\c_720.nls [2009/05/29 10:11:20 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\c_708.nls [2009/05/29 10:11:20 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\C_28596.NLS [2009/05/29 10:11:20 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\c_10004.nls [2009/05/29 10:11:20 \| 00,010,752 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\c_iscii.dll [2009/05/29 10:11:20 \| 00,005,632 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdusa.dll [2009/05/29 10:11:19 \| 00,066,594 \| ---- \| C] () -- C:\WINDOWS\System32\c_862.nls [2009/05/29 10:11:19 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\c_10005.nls [2009/05/29 10:11:18 \| 01,875,968 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\msir3jp.lex [2009/05/29 10:11:18 \| 01,677,824 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\chsbrkr.dll [2009/05/29 10:11:18 \| 01,158,818 \| ---- \| C] () -- C:\WINDOWS\System32\korwbrkr.lex [2009/05/29 10:11:18 \| 00,838,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\chtbrkr.dll [2009/05/29 10:11:18 \| 00,098,304 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\msir3jp.dll [2009/05/29 10:11:18 \| 00,070,656 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\korwbrkr.dll [2009/05/29 10:11:18 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\c_10021.nls [2009/05/29 10:11:18 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\ftlx041e.dll [2009/05/29 10:11:18 \| 00,002,060 \| ---- \| C] () -- C:\WINDOWS\System32\noise.jpn [2009/05/29 10:11:18 \| 00,001,486 \| ---- \| C] () -- C:\WINDOWS\System32\noise.kor [2009/05/29 10:11:14 \| 00,211,938 \| ---- \| C] () -- C:\WINDOWS\System32\lcphrase.tbl [2009/05/29 10:11:14 \| 00,195,618 \| ---- \| C] () -- C:\WINDOWS\System32\c_10002.nls [2009/05/29 10:11:14 \| 00,146,126 \| ---- \| C] () -- C:\WINDOWS\System32\array30.tab [2009/05/29 10:11:14 \| 00,116,285 \| ---- \| C] () -- C:\WINDOWS\System32\msdayi.tbl [2009/05/29 10:11:14 \| 00,110,566 \| ---- \| C] () -- C:\WINDOWS\System32\arphr.tbl [2009/05/29 10:11:14 \| 00,082,172 \| ---- \| C] () -- C:\WINDOWS\System32\bopomofo.nls [2009/05/29 10:11:14 \| 00,066,728 \| ---- \| C] () -- C:\WINDOWS\System32\big5.nls [2009/05/29 10:11:14 \| 00,044,370 \| ---- \| C] () -- C:\WINDOWS\System32\acode.tbl [2009/05/29 10:11:14 \| 00,044,370 \| ---- \| C] () -- C:\WINDOWS\System32\a234.tbl [2009/05/29 10:11:14 \| 00,043,242 \| ---- \| C] () -- C:\WINDOWS\System32\phoncode.tbl [2009/05/29 10:11:14 \| 00,024,114 \| ---- \| C] () -- C:\WINDOWS\System32\lcptr.tbl [2009/05/29 10:11:14 \| 00,018,600 \| ---- \| C] () -- C:\WINDOWS\System32\arrayhw.tab [2009/05/29 10:11:14 \| 00,016,312 \| ---- \| C] () -- C:\WINDOWS\System32\arptr.tbl [2009/05/29 10:11:14 \| 00,016,254 \| ---- \| C] () -- C:\WINDOWS\System32\PINTLPAE.HLP [2009/05/29 10:11:14 \| 00,014,821 \| ---- \| C] () -- C:\WINDOWS\System32\PINTLPAD.HLP [2009/05/29 10:11:14 \| 00,004,071 \| ---- \| C] () -- C:\WINDOWS\System32\phon.tbl [2009/05/29 10:11:14 \| 00,002,714 \| ---- \| C] () -- C:\WINDOWS\System32\phonptr.tbl [2009/05/29 10:11:14 \| 00,001,460 \| ---- \| C] () -- C:\WINDOWS\System32\a15.tbl [2009/05/29 10:11:14 \| 00,000,700 \| ---- \| C] () -- C:\WINDOWS\System32\dayiptr.tbl [2009/05/29 10:11:14 \| 00,000,520 \| ---- \| C] () -- C:\WINDOWS\System32\dayiphr.tbl [2009/05/29 10:11:11 \| 01,783,864 \| ---- \| C] () -- C:\WINDOWS\System32\WINPY.MB [2009/05/29 10:11:11 \| 01,564,868 \| ---- \| C] () -- C:\WINDOWS\System32\WINSP.MB [2009/05/29 10:11:11 \| 01,223,500 \| ---- \| C] () -- C:\WINDOWS\System32\WINZM.MB [2009/05/29 10:11:11 \| 00,173,602 \| ---- \| C] () -- C:\WINDOWS\System32\c_10008.nls [2009/05/29 10:11:11 \| 00,083,748 \| ---- \| C] () -- C:\WINDOWS\System32\prcp.nls [2009/05/29 10:11:11 \| 00,083,748 \| ---- \| C] () -- C:\WINDOWS\System32\prc.nls [2009/05/29 10:11:11 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd101a.dll [2009/05/29 10:11:06 \| 00,189,986 \| ---- \| C] () -- C:\WINDOWS\System32\c_1361.nls [2009/05/29 10:11:06 \| 00,177,698 \| ---- \| C] () -- C:\WINDOWS\System32\c_10003.nls [2009/05/29 10:11:06 \| 00,047,066 \| ---- \| C] () -- C:\WINDOWS\System32\ksc.nls [2009/05/29 10:11:06 \| 00,009,216 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdnecAT.dll [2009/05/29 10:11:06 \| 00,007,680 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdnecNT.dll [2009/05/29 10:11:06 \| 00,007,168 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdnec95.dll [2009/05/29 10:10:58 \| 00,180,770 \| ---- \| C] () -- C:\WINDOWS\System32\c_20932.nls [2009/05/29 10:10:58 \| 00,180,258 \| ---- \| C] () -- C:\WINDOWS\System32\c_20000.nls [2009/05/29 10:10:58 \| 00,177,698 \| ---- \| C] () -- C:\WINDOWS\System32\c_20949.nls [2009/05/29 10:10:58 \| 00,173,602 \| ---- \| C] () -- C:\WINDOWS\System32\c_20936.nls [2009/05/29 10:10:58 \| 00,162,850 \| ---- \| C] () -- C:\WINDOWS\System32\c_10001.nls [2009/05/29 10:10:58 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\c_21027.nls [2009/05/29 10:10:58 \| 00,066,082 \| ---- \| C] () -- C:\WINDOWS\System32\c_20290.nls [2009/05/29 10:10:58 \| 00,028,288 \| ---- \| C] () -- C:\WINDOWS\System32\xjis.nls [2009/05/29 10:10:58 \| 00,006,656 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\c_is2022.dll [2009/05/29 10:10:55 \| 00,008,704 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdjpn.dll [2009/05/29 10:10:55 \| 00,008,192 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbdkor.dll [2009/05/29 10:10:55 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd106.dll [2009/05/29 10:10:55 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd101c.dll [2009/05/29 10:10:55 \| 00,005,632 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd103.dll [2009/05/29 10:10:51 \| 00,006,144 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\kbd101b.dll [2009/05/29 10:08:38 \| 10,646,20032 \| -HS- \| C] () -- C:\hiberfil.sys [2009/02/01 02:54:32 \| 00,028,510 \| ---- \| C] () -- C:\WINDOWS\System32\oeminfo.ini [2009/02/01 02:30:39 \| 00,147,456 \| ---- \| C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll [2008/06/25 01:48:20 \| 00,000,061 \| ---- \| C] () -- C:\WINDOWS\smscfg.ini [2008/06/25 01:25:40 \| 00,000,507 \| ---- \| C] () -- C:\WINDOWS\win.ini [2008/06/24 18:06:38 \| 00,000,231 \| ---- \| C] () -- C:\WINDOWS\system.ini ========== Files - Modified Within 30 Days ========== [36 C:\WINDOWS\System32\.tmp files] [2009/06/09 13:46:07 \| 00,000,696 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/09 13:42:19 \| 00,001,355 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2009/06/09 13:36:42 \| 00,000,150 \| ---- \| M] () -- C:\WINDOWS\System32\spupdsvc.inf [2009/06/09 13:30:58 \| 00,401,632 \| ---- \| M] () -- C:\WINDOWS\System32\perfh009.dat [2009/06/09 13:30:58 \| 00,062,746 \| ---- \| M] () -- C:\WINDOWS\System32\perfc009.dat [2009/06/09 13:30:57 \| 00,471,150 \| ---- \| M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/06/09 13:27:03 \| 00,000,282 \| ---- \| M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job [2009/06/09 13:26:53 \| 00,000,062 \| -HS- \| M] () -- C:\Documents and Settings\Kelly chen\Local Settings\desktop.ini [2009/06/09 13:26:21 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2009/06/09 13:26:18 \| 00,001,158 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2009/06/09 13:26:13 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2009/06/09 13:26:09 \| 10,646,20032 \| -HS- \| M] () -- C:\hiberfil.sys [2009/06/06 07:14:36 \| 00,001,734 \| ---- \| M] () -- C:\Documents and Settings\Kelly chen\Desktop\HijackThis.lnk [2009/06/05 19:18:39 \| 00,231,184 \| ---- \| M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/06/05 13:01:40 \| 00,000,591 \| ---- \| M] () -- C:\Documents and Settings\Kelly chen\Desktop\Shortcut to KMPlayer.lnk [2009/06/05 12:56:12 \| 00,000,000 \| ---- \| M] () -- C:\WINDOWS\nsreg.dat [2009/06/05 12:55:01 \| 00,001,602 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk [2009/06/05 00:12:58 \| 00,000,782 \| ---- \| M] () -- C:\Documents and Settings\Kelly chen\Desktop\Windows Media Player.lnk [2009/05/30 22:44:30 \| 00,000,205 \| ---- \| M] () -- C:\Documents and Settings\Kelly chen\Desktop\HP Battery Check.lnk [2009/05/30 21:05:02 \| 00,124,464 \| ---- \| M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS [2009/05/30 21:05:02 \| 00,010,635 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT [2009/05/30 21:05:02 \| 00,000,806 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF [2009/05/30 21:05:01 \| 00,060,808 \| ---- \| M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL [2009/05/30 21:04:57 \| 00,001,984 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\Norton Internet Security.lnk [2009/05/30 01:10:00 \| 00,000,081 \| -HS- \| M] () -- C:\Documents and Settings\Kelly chen\My Documents\desktop.ini [2009/05/29 10:20:49 \| 18,356,0527 \| RHS- \| M] () -- C:\BootENU.wim [2009/05/29 10:20:49 \| 03,170,304 \| RHS- \| M] () -- C:\Boot.sdi [2009/05/29 10:20:49 \| 00,333,203 \| RHS- \| M] () -- C:\bootmgr [2009/05/29 10:20:49 \| 00,259,584 \| RHS- \| M] (Microsoft Corporation) -- C:\BCDEDIT.EXE [2009/05/29 10:20:49 \| 00,259,584 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\bcdedit.exe [2009/05/29 10:20:49 \| 00,102,400 \| RHS- \| M] (Microsoft Corporation) -- C:\bootsect.exe [2009/05/29 10:19:41 \| 00,001,851 \| ---- \| M] () -- C:\Documents and Settings\All Users\Desktop\My HP Games.lnk [2009/05/29 10:17:05 \| 00,038,471 \| ---- \| M] () -- C:\WINDOWS\System32\$winnt$.inf [2009/05/29 10:16:56 \| 00,000,211 \| RHS- \| M] () -- C:\boot.ini [2009/05/29 10:13:57 \| 00,005,208 \| ---- \| M] () -- C:\WINDOWS\System32\pid.PNF [2009/05/29 10:11:30 \| 00,000,231 \| ---- \| M] () -- C:\WINDOWS\system.ini [2009/05/26 13:20:08 \| 00,040,160 \| ---- \| M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/05/26 13:19:56 \| 00,019,096 \| ---- \| M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys ========== LOP Check ========== [2009/06/09 13:45:55 \| 00,000,000 \| RH-D \| M] -- C:\Documents and Settings\All Users\Application Data [2009/02/01 02:50:28 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Adobe [2009/02/01 02:55:17 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\AOL [2009/02/01 02:45:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\InstallShield [2009/06/09 13:45:55 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/06/05 13:15:03 \| 00,000,000 \| --SD \| M] -- C:\Documents and Settings\All Users\Application Data\Microsoft [2009/05/30 21:05:38 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Norton [2009/02/01 02:12:27 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\NortonInstaller [2009/02/01 02:46:54 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Sonic [2009/02/01 02:47:07 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Uninstall [2009/02/01 02:51:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2009/06/05 00:12:22 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage [2009/06/09 13:46:14 \| 00,000,000 \| RH-D \| M] -- C:\Documents and Settings\Kelly chen\Application Data [2009/02/01 02:50:40 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Adobe [2009/02/01 17:58:02 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Identities [2009/02/01 02:43:46 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\InstallShield [2009/02/01 02:50:41 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Macromedia [2009/06/09 13:46:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Malwarebytes [2009/06/05 18:40:34 \| 00,000,000 \| --SD \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Microsoft [2009/02/01 02:56:33 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\MigoMobile [2009/06/05 13:07:06 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Mozilla [2009/02/01 02:47:37 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\Sun [2009/02/01 02:32:04 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Kelly chen\Application Data\TMP [2009/06/09 13:27:03 \| 00,000,282 \| ---- \| M] () -- C:\WINDOWS\Tasks\BackOnTrack Instant Restore Idle.job [2008/04/15 12:00:00 \| 00,000,065 \| RH-- \| M] () -- C:\WINDOWS\Tasks\desktop.ini [2009/06/09 13:26:21 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\Tasks\SA.DAT ========== Purity Check ========== < End of report >

SpySentinel View Member Profile	Jun 10 2009, 02:45 PM Post #6
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi beroo, Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This changed from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 I suggest you remove the program now. Click on start > run > and then paste the following into the "open" field: appwiz.cpl and press OK. From within Add or Remove Programs uninstall the following if they exist: Viewpoint, Viewpoint Manager, Viewpoint Media Player. Run OTL.exe Under the Custom Scans/Fixes box at the bottom, paste in the following CODE :OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm :Commands [purity] [emptytemp] [start explorer] [Reboot] Then click the Run Fix button at the top Let the program run unhindered, reboot when it is done

beroo View Member Profile	Jun 10 2009, 09:42 PM Post #7
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	SpySentinel, I had done all and finish this result. Is it ok? Thanks for helping me Thanks so much ========== OTL ========== HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\CustomizeSearch\| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant\| /E : value set successfully! ========== COMMANDS ========== File delete failed. C:\Documents and Settings\Kelly chen\Local Settings\Temp\etilqs_adDVZXCGgMoWXjeonMfE scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\JETE956.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4a8.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 06112009_113210 Files moved on Reboot... File C:\Documents and Settings\Kelly chen\Local Settings\Temp\etilqs_adDVZXCGgMoWXjeonMfE not found! File C:\WINDOWS\temp\JETE956.tmp not found! File C:\WINDOWS\temp\Perflib_Perfdata_4a8.dat not found! Registry entries deleted on Reboot...

SpySentinel View Member Profile	Jun 12 2009, 03:24 PM Post #8
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi beroo, sorry for the delay. You did it perfectly Download and scan with SUPERAntiSpyware Free for Home Users Double-click SUPERAntiSpyware.exe and use the default settings for installation. An icon will be created on your desktop. Double-click that icon to launch the program. If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.) Under "Configuration and Preferences", click the Preferences button. Click the Scanning Control tab. Under Scanner Options make sure the following are checked (leave all others unchecked): Close browsers before scanning. Scan for tracking cookies. Terminate memory threats before quarantining. Click the "Close" button to leave the control center screen. Back on the main screen, under "Scan for Harmful Software" click Scan your computer. On the left, make sure you check C:\Fixed Drive. On the right, under "Complete Scan", choose Perform Complete Scan. Click "Next" to start the scan. Please be patient while it scans your computer. After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK". Make sure everything has a checkmark next to it and click "Next". A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu. If asked if you want to reboot, click "Yes". To retrieve the removal information after reboot, launch SUPERAntispyware again. o Click Preferences, then click the Statistics/Logs tab. o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. o Please copy and paste the Scan Log results in your next reply. Click Close to exit the program. Go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

beroo View Member Profile	Jun 13 2009, 06:52 AM Post #9
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 06/13/2009 at 08:39 PM Application Version : 4.26.1004 Core Rules Database Version : 3938 Trace Rules Database Version: 1881 Scan type : Complete Scan Total Scan Time : 01:42:08 Memory items scanned : 560 Memory threats detected : 0 Registry items scanned : 4368 Registry threats detected : 0 File items scanned : 45886 File threats detected : 11 Adware.Tracking Cookie C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@msnportal.112.2o7[1].txt C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@doubleclick[1].txt C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@atdmt[1].txt C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@apmebf[1].txt C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@mediaplex[1].txt C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@2o7[2].txt C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@2o7[2].txt C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@ads.admaxasia[1].txt C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@apmebf[1].txt C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@atdmt[1].txt C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@doubleclick[1].txt

beroo View Member Profile	Jun 13 2009, 09:42 AM Post #10
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	-------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Saturday, June 13, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Saturday, June 13, 2009 14:23:54 Records in database: 2339079 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ Scan statistics: Files scanned: 50971 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:38:08 No malware has been detected. The scan area is clean. The selected area was scanned.

SpySentinel View Member Profile	Jun 13 2009, 04:19 PM Post #11
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	Hi beroo, How is your computer running? Download TFC by OldTimer to your desktop Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). It will close all programs when run, so make sure you have saved all your work before you begin. Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion. Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean. Download random's system information tool (RSIT) by random/random from here and save it to your desktop. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

beroo View Member Profile	Jun 15 2009, 08:29 AM Post #12
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	Logfile of random's system information tool 1.06 (written by random/random) Run by Kelly chen at 2009-06-15 22:27:57 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 68 GB (89%) free of 76 GB Total RAM: 1015 MB (48% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:28:18 PM, on 6/15/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\idt\wdm\stacsv.exe C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\sttray.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\AESTFltr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe c:\program files\aol\aol toolbar 5.0\AolTbServer.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DXXT5QAJ\RSIT[1].exe C:\Program Files\Trend Micro\HijackThis\Kelly chen.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [IDTSysTrayApp] sttray.exe O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe /TrayMode O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-MY\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\stacsv.exe -- End of file - 7845 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll [2009-02-01 340848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL [2009-02-01 107896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-08-02 509328] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}] AOL Toolbar BHO - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2008-07-02 1185120] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll [2009-02-01 340848] {DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2008-07-02 1185120] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-02-15 135168] "HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-02-15 159744] "Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-02-15 131072] "IDTSysTrayApp"=C:\WINDOWS\sttray.exe [2008-09-11 446556] "SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-09-11 446556] "AESTFltr"=C:\WINDOWS\system32\AESTFltr.exe [2008-12-03 729088] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-12-05 1410344] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-08-02 144784] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672] "HP Mobile Broadband"=c:\SWsetup\HPQWWAN\HPMobileBroadband.exe [2008-07-08 439600] "hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2008-04-15 488752] "IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2008-04-15 208952] "IMEKRMIG6.1"=C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE [2008-04-15 44032] "MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2008-04-15 59392] "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-15 455168] "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-15 455168] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408] "SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-05-26 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxdev.dll [2008-02-15 208896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-19 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe::Enabled:AOL Loader" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe::Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe::Enabled:Windows Live Messenger" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe::Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" ======List of files/folders created in the last 1 months====== 2009-06-15 22:27:57 ----D---- C:\rsit 2009-06-15 22:19:15 ----A---- C:\WINDOWS\WORDPAD.INI 2009-06-13 18:43:57 ----D---- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2009-06-13 18:43:37 ----D---- C:\Program Files\SUPERAntiSpyware 2009-06-13 18:43:37 ----D---- C:\Documents and Settings\Kelly chen\Application Data\SUPERAntiSpyware.com 2009-06-13 18:42:59 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-06-13 18:41:15 ----D---- C:\WINDOWS\Sun 2009-06-11 11:32:10 ----D---- C:\_OTL 2009-06-09 13:52:20 ----A---- C:\Rooter.txt 2009-06-09 13:51:28 ----D---- C:\Rooter$ 2009-06-09 13:46:14 ----D---- C:\Documents and Settings\Kelly chen\Application Data\Malwarebytes 2009-06-09 13:45:55 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2009-06-09 13:45:53 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-06-09 13:42:25 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$ 2009-06-09 13:42:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$ 2009-06-09 13:41:55 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$ 2009-06-09 13:41:29 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$ 2009-06-09 13:41:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2009-06-09 13:41:01 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2009-06-09 13:40:32 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$ 2009-06-09 13:40:02 ----HDC---- C:\WINDOWS\$NtUninstallKB961503$ 2009-06-09 13:39:48 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$ 2009-06-09 13:37:16 ----D---- C:\WINDOWS\ie7updates 2009-06-09 13:36:49 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$ 2009-06-09 13:36:05 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$ 2009-06-09 13:35:49 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$ 2009-06-09 13:35:29 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$ 2009-06-09 13:35:16 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$ 2009-06-09 13:34:44 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$ 2009-06-09 13:34:30 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$ 2009-06-09 13:34:20 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$ 2009-06-09 13:34:06 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$ 2009-06-09 13:33:49 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$ 2009-06-09 13:33:26 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$ 2009-06-09 13:33:14 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$ 2009-06-09 13:32:43 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$ 2009-06-09 13:32:34 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$ 2009-06-09 13:31:57 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$ 2009-06-09 13:31:42 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$ 2009-06-09 13:31:21 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$ 2009-06-09 13:31:09 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$ 2009-06-09 13:30:56 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$ 2009-06-09 13:30:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$ 2009-06-09 13:30:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$ 2009-06-09 13:30:10 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2009-06-09 13:29:58 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2009-06-09 13:29:43 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$ 2009-06-09 13:29:27 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2009-06-09 13:29:16 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$ 2009-06-09 13:28:56 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$ 2009-06-09 13:28:04 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$ 2009-06-07 23:51:31 ----A---- C:\WINDOWS\system32\muweb.dll 2009-06-07 23:51:31 ----A---- C:\WINDOWS\system32\mucltui.dll.mui 2009-06-07 23:51:31 ----A---- C:\WINDOWS\system32\mucltui.dll 2009-06-06 07:14:34 ----D---- C:\Program Files\Trend Micro 2009-06-05 13:57:41 ----A---- C:\WINDOWS\system32\pdh.dll 2009-06-05 13:57:40 ----A---- C:\WINDOWS\system32\sc.exe 2009-06-05 13:57:40 ----A---- C:\WINDOWS\system32\rpcss.dll 2009-06-05 13:57:39 ----A---- C:\WINDOWS\system32\services.exe 2009-06-05 13:57:37 ----A---- C:\WINDOWS\system32\ntdll.dll 2009-06-05 13:57:37 ----A---- C:\WINDOWS\system32\lsasrv.dll 2009-06-05 13:57:37 ----A---- C:\WINDOWS\system32\advapi32.dll 2009-06-05 13:57:35 ----A---- C:\WINDOWS\system32\ntoskrnl.exe 2009-06-05 13:57:32 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe 2009-06-05 13:50:01 ----A---- C:\WINDOWS\system32\netapi32.dll 2009-06-05 13:46:02 ----N---- C:\WINDOWS\system32\xpsp4res.dll 2009-06-05 13:21:25 ----A---- C:\WINDOWS\system32\inetcomm.dll 2009-06-05 13:15:22 ----D---- C:\Program Files\Microsoft 2009-06-05 13:14:54 ----D---- C:\Program Files\Windows Live SkyDrive 2009-06-05 13:14:18 ----D---- C:\Program Files\Windows Live 2009-06-05 13:07:05 ----D---- C:\Documents and Settings\Kelly chen\Application Data\Mozilla 2009-06-05 13:04:18 ----A---- C:\WINDOWS\system32\strmdll.dll 2009-06-05 13:01:22 ----D---- C:\Program Files\KMP 2009-06-05 12:56:43 ----A---- C:\WINDOWS\system32\msxml3.dll 2009-06-05 12:54:40 ----D---- C:\Program Files\Mozilla Firefox 2009-06-05 12:51:47 ----D---- C:\Program Files\Common Files\Windows Live 2009-06-05 00:12:22 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2009-06-04 23:23:23 ----D---- C:\WINDOWS\system32\PreInstall 2009-06-04 23:23:15 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$ 2009-06-02 22:07:38 ----A---- C:\WINDOWS\system32\wuweb.dll 2009-06-02 22:07:35 ----A---- C:\WINDOWS\system32\wucltui.dll 2009-06-02 22:07:34 ----A---- C:\WINDOWS\system32\wuaueng.dll 2009-06-02 22:07:33 ----A---- C:\WINDOWS\system32\wuauclt.exe 2009-06-02 22:07:32 ----A---- C:\WINDOWS\system32\wuapi.dll 2009-06-02 22:07:31 ----A---- C:\WINDOWS\system32\cdm.dll 2009-05-30 21:05:03 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL 2009-05-30 21:05:01 ----D---- C:\Program Files\Symantec 2009-05-30 21:05:01 ----D---- C:\Program Files\Common Files\Symantec Shared 2009-05-30 01:09:26 ----ASH---- C:\Documents and Settings\Kelly chen\Application Data\desktop.ini 2009-05-30 01:09:24 ----SD---- C:\Documents and Settings\Kelly chen\Application Data\Microsoft 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\TMP 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\Sun 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\MigoMobile 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\Macromedia 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\InstallShield 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\Identities 2009-05-30 01:09:24 ----D---- C:\Documents and Settings\Kelly chen\Application Data\Adobe 2009-05-29 10:21:54 ----A---- C:\WINDOWS\system32\wmpns.dll 2009-05-29 10:20:49 ----RASH---- C:\bootsect.exe 2009-05-29 10:20:49 ----RASH---- C:\BCDEDIT.EXE 2009-05-29 10:20:49 ----A---- C:\WINDOWS\system32\bcdedit.exe 2009-05-29 10:20:10 ----SHD---- C:\Boot 2009-05-29 10:19:51 ----A---- C:\WINDOWS\system32\BootSect.exe 2009-05-29 10:14:28 ----D---- C:\WINDOWS\Prefetch 2009-05-29 10:11:26 ----A---- C:\WINDOWS\system32\uniime.dll 2009-05-29 10:11:23 ----A---- C:\WINDOWS\system32\kbdlk41j.dll 2009-05-29 10:11:23 ----A---- C:\WINDOWS\system32\kbdlk41a.dll 2009-05-29 10:11:23 ----A---- C:\WINDOWS\system32\kbdibm02.dll 2009-05-29 10:11:23 ----A---- C:\WINDOWS\system32\kbd106n.dll 2009-05-29 10:11:23 ----A---- C:\WINDOWS\system32\f3ahvoas.dll 2009-05-29 10:11:23 ----A---- C:\WINDOWS\system32\c_g18030.dll 2009-05-29 10:11:22 ----A---- C:\WINDOWS\system32\kbdax2.dll 2009-05-29 10:11:22 ----A---- C:\WINDOWS\system32\kbd101.dll 2009-05-29 10:11:22 ----A---- C:\WINDOWS\system32\imjp81k.dll 2009-05-29 10:11:20 ----A---- C:\WINDOWS\system32\Thawbrkr.dll 2009-05-29 10:11:20 ----A---- C:\WINDOWS\system32\kbdusa.dll 2009-05-29 10:11:20 ----A---- C:\WINDOWS\system32\c_iscii.dll 2009-05-29 10:11:18 ----A---- C:\WINDOWS\system32\msir3jp.dll 2009-05-29 10:11:18 ----A---- C:\WINDOWS\system32\korwbrkr.dll 2009-05-29 10:11:18 ----A---- C:\WINDOWS\system32\ftlx041e.dll 2009-05-29 10:11:18 ----A---- C:\WINDOWS\system32\chtbrkr.dll 2009-05-29 10:11:18 ----A---- C:\WINDOWS\system32\chsbrkr.dll 2009-05-29 10:11:11 ----A---- C:\WINDOWS\system32\kbd101a.dll 2009-05-29 10:11:06 ----A---- C:\WINDOWS\system32\kbdnecNT.dll 2009-05-29 10:11:06 ----A---- C:\WINDOWS\system32\kbdnecAT.dll 2009-05-29 10:11:06 ----A---- C:\WINDOWS\system32\kbdnec95.dll 2009-05-29 10:10:58 ----A---- C:\WINDOWS\system32\c_is2022.dll 2009-05-29 10:10:55 ----A---- C:\WINDOWS\system32\kbdkor.dll 2009-05-29 10:10:55 ----A---- C:\WINDOWS\system32\kbdjpn.dll 2009-05-29 10:10:55 ----A---- C:\WINDOWS\system32\kbd106.dll 2009-05-29 10:10:55 ----A---- C:\WINDOWS\system32\kbd103.dll 2009-05-29 10:10:55 ----A---- C:\WINDOWS\system32\kbd101c.dll 2009-05-29 10:10:51 ----A---- C:\WINDOWS\system32\kbd101b.dll ======List of files/folders modified in the last 1 months====== 2009-06-15 22:28:01 ----D---- C:\WINDOWS\temp 2009-06-15 22:27:16 ----D---- C:\WINDOWS\system32 2009-06-15 22:27:16 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-06-15 22:23:20 ----SD---- C:\WINDOWS\Tasks 2009-06-15 22:21:52 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-06-15 22:19:15 ----D---- C:\WINDOWS 2009-06-15 21:35:24 ----D---- C:\WINDOWS\system32\CatRoot2 2009-06-15 21:03:34 ----D---- C:\WINDOWS\Network Diagnostic 2009-06-15 20:48:48 ----HD---- C:\WINDOWS\inf 2009-06-13 19:10:00 ----SHD---- C:\System Volume Information 2009-06-13 19:09:14 ----D---- C:\WINDOWS\Registration 2009-06-13 18:43:46 ----SHD---- C:\WINDOWS\Installer 2009-06-13 18:43:37 ----RD---- C:\Program Files 2009-06-13 18:42:59 ----D---- C:\Program Files\Common Files 2009-06-13 18:31:25 ----HD---- C:\WINDOWS\$hf_mig$ 2009-06-09 14:24:31 ----D---- C:\Program Files\Internet Explorer 2009-06-09 14:24:29 ----D---- C:\WINDOWS\system32\wbem 2009-06-09 14:24:27 ----D---- C:\WINDOWS\AppPatch 2009-06-09 13:46:02 ----D---- C:\WINDOWS\system32\drivers 2009-06-09 13:42:30 ----RSHD---- C:\WINDOWS\system32\dllcache 2009-06-09 13:42:19 ----A---- C:\WINDOWS\imsins.BAK 2009-06-09 13:38:19 ----D---- C:\WINDOWS\system32\en-US 2009-06-09 13:35:51 ----D---- C:\WINDOWS\WinSxS 2009-06-05 13:15:03 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft 2009-06-05 13:15:03 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-06-05 13:14:28 ----RSD---- C:\WINDOWS\Fonts 2009-06-05 12:12:00 ----D---- C:\WINDOWS\Microsoft.NET 2009-06-05 12:11:59 ----RSD---- C:\WINDOWS\assembly 2009-06-05 00:20:47 ----SHD---- C:\RECYCLER 2009-06-02 22:10:12 ----D---- C:\WINDOWS\SoftwareDistribution 2009-06-02 22:07:40 ----D---- C:\WINDOWS\Help 2009-06-02 21:59:17 ----D---- C:\WINDOWS\system32\ias 2009-06-02 21:42:23 ----A---- C:\WINDOWS\setuplog.txt 2009-05-30 21:05:38 ----D---- C:\Documents and Settings\All Users\Application Data\Norton 2009-05-30 01:09:54 ----A---- C:\WINDOWS\OEWABLog.txt 2009-05-30 01:09:24 ----D---- C:\Documents and Settings 2009-05-29 15:19:53 ----D---- C:\Program Files\Hewlett-Packard 2009-05-29 10:22:59 ----D---- C:\WINDOWS\system32\config 2009-05-29 10:22:57 ----HD---- C:\System.sav 2009-05-29 10:22:57 ----AD---- C:\SwSetup 2009-05-29 10:21:15 ----D---- C:\WINDOWS\repair 2009-05-29 10:21:06 ----D---- C:\WINDOWS\system32\Restore 2009-05-29 10:20:10 ----SHD---- C:\System Rollback Data 2009-05-29 10:19:47 ----RD---- C:\Program Files\Online Services 2009-05-29 10:17:00 ----D---- C:\WINDOWS\system32\oobe 2009-05-29 10:16:56 ----RASH---- C:\boot.ini 2009-05-29 10:14:52 ----D---- C:\WINDOWS\security 2009-05-29 10:11:30 ----A---- C:\WINDOWS\system.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\BHDrvx86.sys [] R1 ccHP;Symantec Hash Provider; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\ccHPx86.sys [] R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [] R1 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090610.006\IDSxpx86.sys [] R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-15 36352] R1 SaibVd32;Virtual Disk Driver; C:\WINDOWS\System32\Drivers\SaibVd32.sys [2008-12-11 25584] R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [] R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [] R1 SRTSPX;SRTSPX; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSPX.SYS [] R1 SYMTDI;SYMTDI; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMTDI.SYS [] R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832] R3 AESTAud;AE Audio Service; C:\WINDOWS\system32\drivers\AESTAud.sys [2008-12-03 112128] R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2009-02-01 1294200] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952] R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-15 144384] R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-02-15 5854752] R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090613.003\NAVENG.SYS [] R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090613.003\NAVEX15.SYS [] R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [] R3 SRTSP;SRTSP; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSP.SYS [] R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2008-09-11 1390323] R3 SYMDNS;SYMDNS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMDNS.SYS [] R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [] R3 SYMFW;SYMFW; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMFW.SYS [] R3 SYMIDS;SYMIDS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMIDS.SYS [] R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-02-01 35888] R3 SYMNDIS;SYMNDIS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMNDIS.SYS [] R3 SYMREDRV;SYMREDRV; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMREDRV.SYS [] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-12-05 204976] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608] R3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984] R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008] R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2008-06-27 289024] S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-15 60800] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880] S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-15 61824] S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-15 79232] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232] S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-02-01 35888] S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-29 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-29 82944] S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368] S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928] S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752] S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008] S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952] S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960] S4 sr;System Restore Filter Driver; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-15 73472] S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service; C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2008-12-11 125424] R2 BOTService;BOTService; C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2008-12-25 203248] R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [2009-02-01 115560] R2 STacSV;Audio Service; c:\program files\idt\wdm\stacsv.exe [2008-09-11 237650] R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2008-04-16 165192] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-19 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336] -----------------EOF-----------------

beroo View Member Profile	Jun 15 2009, 08:31 AM Post #13
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	info.txt logfile of random's system information tool 1.06 2009-06-15 22:28:25 ======Uninstall list====== -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Acrobat.com-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07} Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F} Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001} AIM 6-->C:\Program Files\AIM6\uninst.exe AOL Toolbar 5.0-->"C:\Program Files\AOL\AOL Toolbar 5.0\uninstall.exe" Broadcom 802.11 Wireless LAN Adapter-->"C:\Program Files\Broadcom\Broadcom 802.11\Driver\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Broadcom\Broadcom 802.11\Driver" Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E} Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} Critical Update for Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe" HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Hotfix for Windows XP (KB949764)-->"C:\WINDOWS\$NtUninstallKB949764$\spuninst\spuninst.exe" Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" HP BatteryCheck 2.10 A2-->"C:\Program Files\InstallShield Installation Information\{69DAC00A-7665-4E9B-B441-093D40736429}\Setup.exe" -runfromtemp -l0x0009 -removeonly uninst HP Doc Viewer-->MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F} HP Help and Support-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}\setup.exe" -l0x9 -removeonly HP Mobile Broadband Setup Utility-->MsiExec.exe /I{4F2AF17E-94F0-4F22-943D-216CE46AC502} HP User Guides 0130-->MsiExec.exe /X{B5B25043-42A0-4490-A425-C7A6284213E6} HP Wireless Assistant-->MsiExec.exe /I{9ADABDDE-9644-461B-9E73-83FA3EFCAB50} IDT Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}\setup.exe" -l0x9 -remove -removeonly Intel® Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall Java™ 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3} Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B} Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Kernel-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe" Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE} Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8} MigoMobile DESKTOP 4-->MsiExec.exe /X{275E7C8F-5407-4E2D-9506-0DC5BC59B14E} Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 6.0 Parser-->MsiExec.exe /I{909B62B0-8ACA-4061-A83B-09CAEF609619} Norton Internet Security-->C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\16.0.0.125\InstStub.exe /X Roxio BackOnTrack-->C:\Documents and Settings\All Users\Application Data\Uninstall\{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}\setup.exe /x {32F9BACF-FCD3-4B6A-AD85-255A449B6FA5} Roxio BackOnTrack-->MsiExec.exe /I{5A06423A-210C-49FB-950E-CB0EB8C5CEC7} Roxio Disaster Recovery-->MsiExec.exe /I{87A83C6F-F53C-448A-B078-FF00E3EAEB29} Roxio Instant Restore Recovery Disk-->MsiExec.exe /I{2B682751-E749-441C-A4B3-1F538E26E56E} Roxio Instant Restore-->MsiExec.exe /I{0517F875-BBB2-4812-A63E-733B33CEF215} Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E} Security Update for Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe" Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe" Security Update for Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe" Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe" Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe" Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe" Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe" Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe" Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe" Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe" Security Update for Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe" Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe" Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe" Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe" Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe" Security Update for Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe" Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7} SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe" Update for Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe" Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe" Windows Backup Utility-->MsiExec.exe /I{76EFFC7C-17A6-479D-9E47-8E658C1695AE} Windows Driver Package - SMSC LAN9500 USB 2.0 to Ethernet 10/100 Adapter x86 Driver (05/12/2008 1.52.0000.0000)-->C:\PROGRA~1\DIFX\335EFD92411812DC\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\net9500-x8_8CECCF3B6A7FEEACAEF12BF75CF81F511ABC2E6A\net9500-x86-n51m.inf Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE} Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52} Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe Windows Live Essentials-->MsiExec.exe /I{C6CA8874-5F22-4AF0-9BE3-016BF299C536} Windows Live Mail-->MsiExec.exe /I{63C1109E-D977-49ED-BCE3-D00D0BF187D6} Windows Live Messenger-->MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C} Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5} Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238} Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" ======Security center information====== AV: Norton Internet Security FW: Norton Internet Security ======System event log====== Computer Name: PC183754137168 Event Code: 20169 Message: Unable to contact a DHCP server. The Automatic Private IP Address 169.254.20.39 will be assigned to dial-in clients. Clients may be unable to access resources on the network. Record Number: 131 Source Name: RemoteAccess Time Written: 20090602215856.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 16 Message: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection. Record Number: 125 Source Name: Windows Update Agent Time Written: 20090602214125.000000+480 Event Type: error User: Computer Name: PC183754137168 Event Code: 240 Message: A request to suspend power was denied by winlogon.exe. Record Number: 80 Source Name: Win32k Time Written: 20090530210726.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 240 Message: A request to suspend power was denied by winlogon.exe. Record Number: 79 Source Name: Win32k Time Written: 20090530210723.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 240 Message: A request to suspend power was denied by winlogon.exe. Record Number: 78 Source Name: Win32k Time Written: 20090530210719.000000+480 Event Type: warning User: =====Application event log===== Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 49 Source Name: RstLogonComponent Time Written: 20090530223541.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 40 Source Name: RstLogonComponent Time Written: 20090530210434.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 29 Source Name: RstLogonComponent Time Written: 20090530100825.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 17 Source Name: RstLogonComponent Time Written: 20090530010941.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 6 Source Name: RstLogonComponent Time Written: 20090529151539.000000+480 Event Type: warning User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\ "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 28 Stepping 2, GenuineIntel "PROCESSOR_REVISION"=1c02 "NUMBER_OF_PROCESSORS"=2 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "OnlineServices"=Online Services "Platform"=MCD "PCBRAND"=Pavilion -----------------EOF-----------------

beroo View Member Profile	Jun 15 2009, 08:42 AM Post #14
New Member Group: Authentic Member Posts: 12 Joined: 5-June 09 Member No.: 86,139 Operating System: XP	I am afraid my laptop is still having a anoying file in shared documents C:\Documents and Settings\All Users\Documents microsoft/IdentityCRL/Production = but this file has 0 bytes Everytime this deleted file just keep show up again and again no matter how many times i delete it. haiz..... Do you know wat is it? This post has been edited by beroo: Jun 15 2009, 08:44 AM

SpySentinel View Member Profile	Jun 16 2009, 01:18 PM Post #15
Trusted Group: Malware Team Posts: 554 Joined: 26-January 08 From: The United States Member No.: 76,329 Operating System: Windows XP SP2	QUOTE I am afraid my laptop is still having a anoying file in shared documents C:\Documents and Settings\All Users\Documents microsoft/IdentityCRL/Production = but this file has 0 bytes Everytime this deleted file just keep show up again and again no matter how many times i delete it. haiz..... Do you know wat is it? Yes it is malicious, we will go ahead and remove it. Please download the OTM by OldTimer. Save it to your desktop. Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator). Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE :processes explorer.exe :Files C:\Documents and Settings\All Users\Documents\microsoft/IdentityCRL/Production :commands [purity] [emptytemp] [start explorer] Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste. Click the red Moveit! button. Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply. Close OTM3 Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter .log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles* folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems Upgrading Java: Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 14. Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u14-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u14-windows-i586.exe and select "Run as an Administrator.")

« Next Oldest · Infections Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies	Topic Starter	Views	Last Action
Infections Removal [Closed] Removal of Antivirus System Pro malware	2	Ceil	37	Today, 05:02 AM Last post by: CatByte
Infections Removal [Closed] virus removal tools	2	deaiden08	48	Today, 05:02 AM Last post by: CatByte
Infections Removal [Closed] File replicating on my desktop hundreds and hundreds... help&	2	Barbzzz	58	Today, 05:01 AM Last post by: CatByte
Infections Removal [Closed] Malwarebytes Targeted, Same problem as before despite new har 1234	58	Mirrodin	967	Today, 05:00 AM Last post by: CatByte