What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Search redirects and no updates

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I had Windows Live OneCare protecting my system but noticed redirects from searches. Infrequently at first and then more often. Found that I cannot run windows updates and cannot access to microsoft online chat to get online help. Firefox no longer will run. Crashes on start up. Windows Live OneCare detected no issues. Removed OneCare and tried to install alternate antivirus and it would not install. Ran Panda online scan and it found but could not remove all objects. Installed BitDefender and it also found objects originally that it could not remove. Now shows clean but still redirected and cannot run updates. Cannot open DOS from Start >Run> CMD. Parsed HJT log and it indicated mutliple hot items in log. No changes nade. I have an external drive Maxtor but cannot access to it any longer from this computer. Moved Maxtor to another PC on home netowrk and can view all files/photos on backup from there.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:27:01 AM, on 4/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CSHelper.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaServer.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…arm1=seconduser
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CocaCola Media Manager Tray] "C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe" /CustomId:CocaCola
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivesca…s/as2stubie.cab
O16 - DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} (Auctiva Image Uploader Control) - http://www.auctiva.com/Aurigma/ImageUploader55.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://seppukuspoint.spaces.live.com/Photo…ad/MsnPUpld.cab
O16 - DPF: {C56BF45D-4722-4EFD-AA14-9DB1E92661E3} (CocaCola Class) - http://coke.mycokerewards.com/cabs/CocaCola_1_0_0_9.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} (MediaControl Class) - http://coke.mycokerewards.com/cabs/Entriq_…0_15_Silent.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F8711D3D-9D7D-4653-B38A-E02931182F9F}: NameServer = 205.171.3.65,205.171.2.65
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\WINDOWS\system32\CSHelper.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

–
End of file - 10811 bytes


Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

4/11/2009 1:20:03 AM
mbam-log-2009-04-11 (01-20-03).txt

Scan type: Quick Scan
Objects scanned: 79204
Time elapsed: 9 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\cpbrkpie.coupon6ctrl.1 (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{87255c51-cd7d-4506-b9ad-97606daf53f3} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\CouponPrinter.ocx (Adware.Coupons) -> Quarantined and deleted successfully.
C:\WINDOWS\cpnprt2.cid (Adware.Agent) -> Quarantined and deleted successfully.

I'm ready to start fixing. Thanks,
Joe
Post #2
Hello & Welcome to What the Tech
Apologies for the delay, as you can appreciate the board is very busy.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Options, then click Track this topic. Make sure it is set to Immediate Email Notification, then click Proceed.

In the meantime please note the following:
  • Any recommendations made are for your computer problems only and should NOT be used on any other computer.
  • Please DO NOT run any scans/tools or other fixes unless I ask you to. This is very important for several reasons. Here are just two of them:
    1. The tools that we use are very powerful and can cause >>irreparable damage<< to your computer if not used correctly.
    2. Commercial scanners, for the most part can not completely remove some of the more "resistant" infections. This makes it much more difficult to get rid of completely.
  • If you get stuck or are unsure of something please ask for a further explanation, do not guess.
  • It will require more than one round to properly clean your system. Continue to respond to this thread until I give you the All Clean! even if symptoms seemingly abate.
Please note that the forum is very busy and if I don't hear from you within five days this thread will be closed.
If for any reason you cannot complete instructions within that time, that's fine, just put a post here so that I know you're still here. We get a lot of people who simply leave & if there is no contact for that amount of time I will have to assume you have abandoned your topic.

Thanks

DDS
Download DDS.scr by sUBs from one of the following links & save it to your desktop.
http://www.techsupportforum.com/sectools/sUBs/dds
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds
  • Double-Click on dds.scr and a command window will appear. This is normal
  • Shortly after two logs will appear, DDS.txt & Attach.txt
  • A window will open instructing you save & post the logs
  • Save the logs to a convenient place such as your desktop
  • Copy the contents of both logs & post in your next reply
RootRepeal
Download RootRepeal.zip from here & unzip it to your Desktop.
  • Double click RootRepeal.exe to start the program
  • Click the Report tab at the bottom of the program window
  • Click the Scan button
  • In the Select Scan dialog, check:
    • Drivers
      Files
      Processes
      SSDT
      Stealth Objects
      Hidden Services
  • Click the OK button
  • In the next dialog, select all drives showing
  • Click OK to start the scan
Note: The scan can take some time. DO NOT run any other programs while the scan is running
  • When the scan is complete, the Save Report button will become available
  • Click this and save the report to your Desktop as RootRepeal.txt
  • Go to File then Exit to close the program
To post in next reply:
Contents of DDS log
Contents of Attach.txt
Contents of RootRepeal log
Post #3
Problems with DDS portion:

First link http://www.techsupportforum.com/sectools/sUBs/dds goes to a HTTP 404 not found
2nd link http://download.bleepingcomputer.com/sUBs/dds.scr goes to an entirely blank page and says Done in bottom left of IE
3rd link http://www.forospyware.com/sUBs/dds shows and entirely blank page and pops up a window File Download -Security Warning Do you want to run of save this file? Name: dds.pif Type: Shortcut to MS_DOS program, 351KB From: www.forospyware.com

I can see the download status window behind this and has a blank download status bar. When I click Run, I get the 2nd Internet Explorer Security Warning for the unknown publisher and I click Run again. The download status window disappears and a black, maybe DOS, window appears for a fraction of a second and disappears. Nothing else comes up. I tried going to bleepingcomputer.com manually typing or starting at the base site thinkng I would guide myself to the download. www.bleepingcomputer.com will not display on this computer.

Here is what I got from RoorRepeal:

ROOTREPEAL © AD, 2007-2008
==================================================
Scan Time: 2009/04/12 19:41
Program Version: Version 1.2.3.0
Windows Version: Windows XP Media Center Edition SP3
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xECDDC000 Size: 98304 File Visible: No
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B2E000 Size: 8192 File Visible: No
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB8374000 Size: 45056 File Visible: No
Status: -

Hidden/Locked Files
——————-
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\Documents and Settings\HP_Administrator\LuResult.t鱒t
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\HP_Administrator\nt鱒ser.dat.LOG
Status: Invisible to the Windows API!

Path: C:\Documents and Settings\HP_Administrator\LuResult.txt
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\HP_Administrator\ntuser.dat.LOG
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF8656.tmp
Status: Allocation size mismatch (API: 24576, Raw: 0)

Path: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF928A.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF30AE.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF48BF.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: C:\Documents and Settings\HP_Administrator\Local Settings\Temp\~DF5336.tmp
Status: Allocation size mismatch (API: 32768, Raw: 16384)

Path: D:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP421\change.log.1
Status: Allocation size mismatch (API: 16384, Raw: 8192)

SSDT
——————-
#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys" at address 0xb7ae9c90

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys" at address 0xb7ae9d7e

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys" at address 0xb7ae9bf4

#: 258 Function Name: NtTerminateThread
Status: Hooked by "C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys" at address 0xb7ae9ec4

Stealth Objects
——————-
Object: Hidden Module [Name: System.Windows.Forms.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x04e40000 Size: 5033984

Object: Hidden Module [Name: Intuit.Spc.Foundations.Portability.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03020000 Size: 471040

Object: Hidden Module [Name: Intuit.Spc.Esd.WinClient.Application.UpdateService.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00a00000 Size: 36864

Object: Hidden Module [Name: Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00c40000 Size: 28672

Object: Hidden Module [Name: Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00e00000 Size: 61440

Object: Hidden Module [Name: Intuit.Spc.Esd.Client.Common.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00e40000 Size: 86016

Object: Hidden Module [Name: Intuit.Spc.Esd.Core.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00ea0000 Size: 233472

Object: Hidden Module [Name: Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00ef0000 Size: 36864

Object: Hidden Module [Name: Intuit.Spc.Foundations.Primary.Logging.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x00f10000 Size: 53248

Object: Hidden Module [Name: System.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x034b0000 Size: 3158016

Object: Hidden Module [Name: Intuit.Spc.Foundations.Primary.ExceptionHandling.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x031a0000 Size: 77824

Object: Hidden Module [Name: Intuit.Spc.Foundations.Primary.Config.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x031e0000 Size: 86016

Object: Hidden Module [Name: System.configuration.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03210000 Size: 438272

Object: Hidden Module [Name: System.XML.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03290000 Size: 2060288

Object: Hidden Module [Name: Intuit.Spc.Esd.WinClient.Api.Net.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03c10000 Size: 413696

Object: Hidden Module [Name: System.Data.SQLite.DLL]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03f70000 Size: 778240

Object: Hidden Module [Name: Intuit.Spc.Esd.Client.BusinessLogic.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03f20000 Size: 143360

Object: Hidden Module [Name: Intuit.Spc.Esd.Client.DataAccess.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x03ec0000 Size: 135168

Object: Hidden Module [Name: System.Data.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x04040000 Size: 2961408

Object: Hidden Module [Name: System.Transactions.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x043b0000 Size: 270336

Object: Hidden Module [Name: Intuit.Spc.Map.Reporter.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x044a0000 Size: 479232

Object: Hidden Module [Name: System.EnterpriseServices.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x04660000 Size: 266240

Object: Hidden Module [Name: System.Runtime.Remoting.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x04be0000 Size: 307200

Object: Hidden Module [Name: System.Drawing.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x05410000 Size: 634880

Object: Hidden Module [Name: Intuit.Spc.Map.WindowsFirewallUtilities.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x055c0000 Size: 1077248

Object: Hidden Module [Name: System.ServiceProcess.dll]
Process: IntuitUpdateService.exe (PID: 2264) Address: 0x05730000 Size: 126976
Post #4
Hi

When I click Run, I get the 2nd Internet Explorer Security Warning for the unknown publisher and I click Run again.

You need to Save DDS first. So instead of clicking Run click Save & save it to your desktop, then try running it.
Let me know how you go.
Post #5
I now have it saved on the desktop. When I select to Run it from the desktop, a window pops up for a split second and then disappears and nothing else happens. I've rebooted and tried running it again from the desktop and had the same result. No indication that anything else occurs.
Post #6
Hi

Never heard of this happening with DDS… strange.

Ok, try this scanner:
Random's System Information Tool (RSIT)
  • Download Random's System Information Tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run the tool
  • Click Continue at the disclaimer screen
  • Once it has finished, two logs will open, log.txt (<info.txt (<
  • Copy & paste the contents of both logs in your next reply
If info.txt does not minimise to the Task Bar, you will find it in C:\rsit
Post #7
info.txt logfile of random's system information tool 1.06 2009-04-13 21:01:41

======Uninstall list======

–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu
–>c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
–>c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
–>c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
–>c:\WINDOWS\system32\\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
Agere Systems PCI Soft Modem–>agrsmdel
Amazon MP3 Downloader 1.0.3–>C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe
AnswerWorks 5.0 English Runtime–>MsiExec.exe /I{9E5A03E3-6246-4920-9630-0527D5DA9B07}
Apple Mobile Device Support–>MsiExec.exe /I{162B71B8-8464-4680-A086-601D555B331D}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArtistScope Plugin IE–>"C:\Program Files\Internet Explorer\plugins\uninstall.exe" "/U:C:\Program Files\Internet Explorer\plugins\Uninstall\uninstall.xml"
ATI Catalyst Control Center–>MsiExec.exe /I{9A945BB0-FB9C-4DAA-9C72-789E4B97C595}
ATI Display Driver–>rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Audacity 1.2.6–>"C:\Program Files\Audacity\unins000.exe"
Barnyard Invasion from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\049D60AF-B425-4F8A-BD66-9D8C1B519D59\Uninstall.exe"
Bejeweled 2 Deluxe from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\47D5A62B-1B41-4DB1-8267-ADA434FA782B\Uninstall.exe"
Big Kahuna Reef from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\D77E8A46-BEB4-49ED-B2D3-B77180169FA3\Uninstall.exe"
BitDefender Internet Security 2009–>MsiExec.exe /X{0801DB64-A004-4640-BF13-F05D75409627}
Blackhawk Striker 2 from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\758619C0-7C97-42BB-B1E9-775F72FDAD1E\Uninstall.exe"
Blasterball 2 from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\D2DACBCD-E1FE-4C32-A49B-1EB0743D1E79\Uninstall.exe"
Blasterball 2 Holidays from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\1B497FAA-E53E-420D-8408-FFDD3278CD50\Uninstall.exe"
Boggle Supreme from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\90EA5584-4290-407B-B8F2-D6E6D65A4796\Uninstall.exe"
Bonjour–>MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Bookworm Deluxe from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\E59F75D0-A38B-40F4-ABA2-CA35A7735473\Uninstall.exe"
Bounce Symphony from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\5DAA9E44-1B31-41CD-88A8-228EDED6E36E\Uninstall.exe"
Coupon Printer for Windows–>"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml"
Critical Update for Windows Media Player 11 (KB959772)–>"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Crystal Maze from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\3D61540E-C88C-4358-B6A1-DC26648F2A3D\Uninstall.exe"
Digby's Donuts from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\A51671BD-9BE5-4944-AC62-A2A0B6FF5E54\Uninstall.exe"
Entriq MediaSphere 3.6.0.15–>"C:\Program Files\Entriq\MediaSphere\unins000.exe"
FATE Demo from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\B68BB501-10CD-46E2-BB45-075A2ABFD242\Uninstall.exe"
Flip Words from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\1280194E-E9D5-4253-95E7-40169E2A4848\Uninstall.exe"
GemMaster Mystic–>"C:\Program Files\GemMaster\uninstallgemmaster.exe"
High Definition Audio Driver Package - KB888111–>"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2–>"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)–>C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)–>C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915800-v4)–>"C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB961118)–>"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
HP Boot Optimizer–>MsiExec.exe /I{3BA95526-6AE0-4B87-A62D-17187EF565FC}
HP Deskjet Printer Preload–>MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP DigitalMedia Archive–>MsiExec.exe /I{F80239D8-7811-4D5E-B033-0D0BBFE32920}
HP Document Viewer 5.3–>C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP Game Console and games–>C:\Program Files\WildTangent\Apps\hpuninstall.exe
HP Image Zone 5.3–>C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP Image Zone for Media Center PC–>c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u
HP Imaging Device Functions 5.3–>C:\Program Files\HP\Digital Imaging\DigitalImagingMonitor\hpzscr01.exe -datfile hpqbud01.dat
HP Multimedia Keyboard Software–>C:\HP\KBD\KBD.EXE uninstalled
HP Photosmart 330,380,420,470,7800,8000,8200 Series–>C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart Cameras 5.0–>C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP PSC & OfficeJet 5.3.B–>"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Software Update–>MsiExec.exe /X{ECFDD6BD-E0C0-41CC-A171-E6D6AF4C0E93}
HP Solution Center & Imaging Support Tools 5.3–>C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Tunes–>MsiExec.exe /X{D54193B7-D2DF-4977-B546-86CA48DB214E}
HPTunesAddIn–>MsiExec.exe /I{69CF01AD-9E35-4BD7-9036-7B8478BEB839}
ieSpell–>"C:\Program Files\ieSpell\uninst.exe"
Insaniquarium Deluxe from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\A09026AE-8F16-4929-B4E6-1825535844DB\Uninstall.exe"
Intel® PRO Network Connections Drivers–>Prounstl.exe
IntelliMover Data Transfer Demo–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{14589F05-C658-4594-9429-D437BA688686}\Setup.exe" -l0x9
InterVideo WinDVD Player–>"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
iTunes–>MsiExec.exe /I{C26B06A9-27BB-45B0-9873-9C623EC2BA38}
J2SE Runtime Environment 5.0–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Java™ 6 Update 13–>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Jewel Quest from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\A73FAC36-8925-465D-8FA2-4DA98BD9B441\Uninstall.exe"
Mah Jong Quest from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\538B9061-0C77-4FB2-903F-EC42A1FF5DD8\Uninstall.exe"
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MathPlayer–>C:\Program Files\Design Science\MathPlayer\Setup.exe -u
Maxtor Manager–>"C:\Program Files\InstallShield Installation Information\{4D36E953-4456-4F8F-BC44-90BC4AA59889}\setup.exe" -runfromtemp -l0x0409 -removeonly
Maxtor Manager–>MsiExec.exe /I{4D36E953-4456-4F8F-BC44-90BC4AA59889}
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 2–>MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2–>MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1–>C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1–>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Base Smart Card Cryptographic Service Provider Package–>"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Easy Assist–>MsiExec.exe /I{4FC19392-E4A5-4CCB-B45A-AB7E8126D3C9}
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Money 2005–>C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Outlook Connector for MSN–>MsiExec.exe /X{DC4DD556-DD03-422A-926B-470746D8B50D}
Microsoft Office Standard Edition 2003–>MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft Picture It! Express 9–>C:\WINDOWS\system32\msiexec.exe /i {DBA8B9E1-C6FF-4624-9598-73D3B41A0900}
Microsoft Picture It! Library 9–>C:\WINDOWS\system32\msiexec.exe /i {9F7FC79B-3059-4264-9450-39EB368E3220}
Microsoft Silverlight–>MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]–>MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works–>MsiExec.exe /I{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}
Mozilla Firefox (3.0.5)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSN Encarta Plus Support Files–>MsiExec.exe /I{00000000-785F-478A-BAA2-87F1A136068C}
MSN–>C:\Program Files\MSN\MsnInstaller\msniadm.exe /Action:ARP
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)–>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
muvee autoProducer 4.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2C3D719A-92C7-4323-89CC-C937D0267B84}\setup.exe" -l0x9
muvee autoProducer unPlugged 1.1 - HPD–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B1931B3A-29E9-4F91-9B61-BE2CF05E84F1}\setup.exe" -l0x9
My Coke Rewards Media Manager 1.0.0.9–>"C:\Program Files\My Coke Rewards Media Manager\MediaSphere\unins000.exe"
Office 2003 Tour–>MsiExec.exe /I{BE9FEFBA-F2F8-468B-A108-4356F73A3E9C}
OpenOffice.org Installer 1.0–>MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
Otto–>"C:\Program Files\EnglishOtto\uninstallotto.exe"
Panda ActiveScan 2.0–>C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
PC-Doctor 5 for Windows–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{AB61A692-5543-4C48-979B-8CEA1C52FE9C} /l1033
Polar Bowler from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\1FFA88DF-0AC3-4D9E-9139-5FF98813C12C\Uninstall.exe"
Polar Golfer from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\55275778-F7D9-4BA0-95F4-DEFD71ADDFD9\Uninstall.exe"
PS2–>C:\WINDOWS\system32\ps2.exe uninstall
Puzzle Express from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\0814ADC6-5B36-4144-A8EA-439C36B1BB11\Uninstall.exe"
Python 2.2 pywin32 extensions (build 203)–>"C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
Python 2.2.3–>C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
Quicken 2005–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{2DBE41DD-2129-4C65-A3D3-5647236A60F3} anything
QuickTime–>MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
RealPlayer–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver–>RtlUpd.exe -r -m
Ricochet Lost Worlds from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\0AA27562-3C4E-4860-8742-7ADEBE2EFC43\Uninstall.exe"
Safari–>MsiExec.exe /I{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}
SCRABBLE Blast from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\2BA80327-9385-4EC8-9796-47C49BD73352\Uninstall.exe"
SCRABBLE from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\B7217206-A362-446B-A0F7-A2622B82F821\Uninstall.exe"
SCRABBLE Rack Attack from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\EC03679F-C9F0-46E8-864D-FCCF83F4EB86\Uninstall.exe"
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Step By Step Interactive Training (KB923723)–>"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)–>"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)–>"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)–>"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB961260)–>"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)–>"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)–>"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954459)–>"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)–>"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)–>"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)–>"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)–>"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)–>"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)–>"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)–>"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)–>"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)–>"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)–>"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958690)–>"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)–>"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960715)–>"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Shrek 2 Ogre Bowler from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\581538B9-2ED3-45E2-96CB-22AD8F811D2A\Uninstall.exe"
Slingo Deluxe from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\E0998E52-9D08-4AEE-A4F5-0BB1D8537F6E\Uninstall.exe"
Slyder from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\600C800C-5985-4E74-AFE7-571001AC3FA4\Uninstall.exe"
Sonic Encoders–>MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Sonic Express Labeler–>MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus–>MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio–>MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy–>MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data–>MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager–>MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Super Granny from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\0C20CAB1-F8BC-4AC1-A796-535B005C1B83\Uninstall.exe"
Swarm from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\133F647D-B454-42BC-ADBE-387482A29B88\Uninstall.exe"
Tradewinds from HP Media Center (remove only)–>"C:\Program Files\WildTangent\Apps\GameChannel\Games\B3FF79F4-CDA8-4845-A7C0-9CE017719F36\Uninstall.exe"
TurboTax 2008 WinPerFedFormset–>MsiExec.exe /I{7570F1CA-016D-46AC-B586-CD74645EFB52}
TurboTax 2008 WinPerProgramHelp–>MsiExec.exe /I{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}
TurboTax 2008 WinPerReleaseEngine–>MsiExec.exe /I{88214092-836F-4E22-A5AC-569AC9EE6A0F}
TurboTax 2008 WinPerTaxSupport–>MsiExec.exe /I{B23726CF-68BF-41A6-A4EB-72F12F87FE05}
TurboTax 2008 WinPerUserEducation–>MsiExec.exe /I{29521505-F489-4822-ADFA-32C6DEE4F114}
TurboTax 2008 wrapper–>MsiExec.exe /I{B1DB1AD8-C07E-4052-81A1-D2930232BA70}
TurboTax 2008–>K:\Maxtor backup\JOE-OFFICE\C\Documents and Settings\TurTX08\TurboTax\Deluxe 2008\Installer\TurboTax 2008 Installer.exe /u /t /a
Update for Windows Media Player 10 (KB913800)–>"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB926251)–>"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
Update for Windows XP (KB943729)–>"C:\WINDOWS\$NtUninstallKB943729$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)–>"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)–>"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Windows Imaging Component–>"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Internet Explorer 8–>"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live installer–>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Mail–>MsiExec.exe /I{184E7118-0295-43C4-B72C-1D54AA75AAF7}
Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Photo Gallery–>MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}
Windows Live Sign-in Assistant–>MsiExec.exe /I{9422C8EA-B0C6-4197-B8FC-DC797658CA00}
Windows Live Writer–>MsiExec.exe /X{9176251A-4CC1-4DDB-B343-B487195EB397}
Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Search 4.0–>"C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB925766–>"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

======Security center information======

AV: BitDefender Antivirus
FW: BitDefender Firewall

======System event log======

Computer Name: MAIN
Event Code: 10
Message: The time provider 'NtpClient' returned an error when asked for time samples.
The error will be ignored. The error was: The handle is invalid. (0x80070006)

Record Number: 14022
Source Name: W32Time
Time Written: 20090401113641.000000-360
Event Type: warning
User:

Computer Name: MAIN
Event Code: 10
Message: The time provider 'NtpClient' returned an error when asked for time samples.
The error will be ignored. The error was: The handle is invalid. (0x80070006)

Record Number: 14021
Source Name: W32Time
Time Written: 20090401111936.000000-360
Event Type: warning
User:

Computer Name: MAIN
Event Code: 10
Message: The time provider 'NtpClient' returned an error when asked for time samples.
The error will be ignored. The error was: The handle is invalid. (0x80070006)

Record Number: 14020
Source Name: W32Time
Time Written: 20090401110232.000000-360
Event Type: warning
User:

Computer Name: MAIN
Event Code: 10
Message: The time provider 'NtpClient' returned an error when asked for time samples.
The error will be ignored. The error was: The handle is invalid. (0x80070006)

Record Number: 14019
Source Name: W32Time
Time Written: 20090401104528.000000-360
Event Type: warning
User:

Computer Name: MAIN
Event Code: 10
Message: The time provider 'NtpClient' returned an error when asked for time samples.
The error will be ignored. The error was: The handle is invalid. (0x80070006)

Record Number: 14018
Source Name: W32Time
Time Written: 20090401102824.000000-360
Event Type: warning
User:

=====Application event log=====

Computer Name: MAIN
Event Code: 8
Message: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.


Record Number: 2778
Source Name: crypt32
Time Written: 20080830190824.000000-360
Event Type: error
User:

Computer Name: MAIN
Event Code: 8
Message: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved


Record Number: 2777
Source Name: crypt32
Time Written: 20080830190824.000000-360
Event Type: error
User:

Computer Name: MAIN
Event Code: 4689
Message: The run-time environment has detected an inconsistency in its internal state. This indicates a potential instability in the process that could be caused by the custom components running in the COM+ application, the components they make use of, or other factors. Error in f:\xpsp3\com\com1x\src\comsvcs\package\cpackage.cpp(1184), hr = 8007041d: InitEventCollector failed
Record Number: 2773
Source Name: COM+
Time Written: 20080830095537.000000-360
Event Type: error
User:

Computer Name: MAIN
Event Code: 1517
Message: Windows saved user MAIN\HP_Administrator registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.


This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

Record Number: 2762
Source Name: Userenv
Time Written: 20080830095327.000000-360
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: MAIN
Event Code: 1524
Message: Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.



Record Number: 2761
Source Name: Userenv
Time Written: 20080830095326.000000-360
Event Type: warning
User: MAIN\HP_Administrator

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;c:\Python22;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0404
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"SonicCentral"=c:\Program Files\Common Files\Sonic Shared\Sonic Central\
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

—————–EOF—————–
Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-04-13 21:01:29
Microsoft Windows XP Professional Service Pack 3
System drive C: has 204 GB (88%) free of 230 GB
Total RAM: 1022 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:01:36 PM, on 4/13/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaServer.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CSHelper.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\HP_Administrator\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\HP_Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [CocaCola Media Manager Tray] "C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe" /CustomId:CocaCola
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog; This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/betaactivesca…s/as2stubie.cab
O16 - DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} (Auctiva Image Uploader Control) - http://www.auctiva.com/Aurigma/ImageUploader55.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://seppukuspoint.spaces.live.com/Photo…ad/MsnPUpld.cab
O16 - DPF: {C56BF45D-4722-4EFD-AA14-9DB1E92661E3} (CocaCola Class) - http://coke.mycokerewards.com/cabs/CocaCola_1_0_0_9.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} (MediaControl Class) - http://coke.mycokerewards.com/cabs/Entriq_…0_15_Silent.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F8711D3D-9D7D-4653-B38A-E02931182F9F}: NameServer = 205.171.3.65,205.171.2.65
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\WINDOWS\system32\CSHelper.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

–
End of file - 10880 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2009-03-24 95536]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]
"AlwaysReady Power Message APP"=C:\WINDOWS\ARPWRMSG.EXE [2005-08-03 77312]
"HPHUPD08"=c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe [2005-06-02 49152]
"PCDrProfiler"= []
"HPBootOp"=C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe [2005-02-25 245760]
"LSBWatcher"=c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe [2005-05-10 253952]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-10-25 16855552]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"Microsoft Works Update Detection"=C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [2003-09-13 50688]
"CocaCola Media Manager Tray"=C:\Program Files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe [2007-03-13 387152]
"mxomssmenu"=C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe [2008-07-21 169312]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2009-03-19 778240]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2009-02-23 69632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2005-08-09 46080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Kontiki\KService.exe"="C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%ProgramFiles%\iTunes\iTunes.exe"="%ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f148ab0-ce16-11dc-a806-001195f20da9}]
shell\open\command - %SystemRoot%\Explorer.exe /idlist,%I,%L


======List of files/folders created in the last 1 months======

2009-04-13 20:48:39 —-D—- C:\rsit
2009-04-11 01:07:28 —-D—- C:\Documents and Settings\HP_Administrator\Application Data\Malwarebytes
2009-04-11 01:07:21 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2009-04-11 01:07:21 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-04-10 22:22:51 —-D—- C:\Program Files\Trend Micro
2009-04-06 15:27:46 —-D—- C:\WINDOWS\pss
2009-04-04 23:05:05 —-A—- C:\WINDOWS\bdagent.INI
2009-04-03 20:26:04 —-D—- C:\Documents and Settings\HP_Administrator\Application Data\BitDefender
2009-04-03 20:25:31 —-D—- C:\Program Files\BitDefender
2009-04-03 20:25:31 —-D—- C:\Documents and Settings\All Users\Application Data\BitDefender
2009-04-03 20:14:05 —-D—- C:\Program Files\Common Files\BitDefender
2009-04-03 04:34:51 —-D—- C:\Program Files\Panda Security
2009-04-03 04:10:29 —-A—- C:\WINDOWS\system32\javaws.exe
2009-04-03 04:10:29 —-A—- C:\WINDOWS\system32\javaw.exe
2009-04-03 04:10:28 —-A—- C:\WINDOWS\system32\java.exe
2009-04-02 13:48:48 —-HDC—- C:\WINDOWS\ie8
2009-04-02 13:18:17 —-D—- C:\798613507f9fe19734c4
2009-04-01 23:36:02 —-D—- C:\Program Files\Microsoft Silverlight
2009-03-29 14:25:17 —-D—- C:\Program Files\Common Files\AnswerWorks 5.0
2009-03-29 14:14:34 —-D—- C:\Program Files\TurboTax
2009-03-15 18:29:09 —-D—- C:\Program Files\Maxtor
2009-03-15 18:29:09 —-D—- C:\Documents and Settings\All Users\Application Data\Maxtor
2009-03-15 18:18:05 —-HDC—- C:\WINDOWS\$NtUninstallKB943729$
2009-03-15 18:17:57 —-D—- C:\Documents and Settings\HP_Administrator\Application Data\Windows Desktop Search
2009-03-15 18:17:12 —-D—- C:\WINDOWS\system32\GroupPolicy
2009-03-15 18:17:12 —-D—- C:\Program Files\Windows Desktop Search
2009-03-15 18:16:54 —-HDC—- C:\WINDOWS\$NtUninstallKB940157$
2009-03-15 18:16:37 —-HDC—- C:\WINDOWS\$NtUninstallKB915800-v4$

======List of files/folders modified in the last 1 months======

2009-04-13 20:58:36 —-D—- C:\WINDOWS\system32
2009-04-13 20:58:35 —-D—- C:\WINDOWS\Temp
2009-04-13 20:58:11 —-D—- C:\WINDOWS\Registration
2009-04-13 20:57:54 —-D—- C:\WINDOWS\system32\CatRoot2
2009-04-13 20:57:49 —-D—- C:\WINDOWS
2009-04-13 20:48:46 —-D—- C:\WINDOWS\Prefetch
2009-04-13 18:40:44 —-A—- C:\WINDOWS\SchedLgU.Txt
2009-04-12 20:25:04 —-D—- C:\WINDOWS\system32\drivers
2009-04-11 01:07:21 —-D—- C:\Program Files
2009-04-07 10:41:01 —-D—- C:\WINDOWS\Help
2009-04-06 13:50:38 —-D—- C:\Program Files\Mozilla Firefox
2009-04-03 20:30:57 —-HD—- C:\Config.Msi
2009-04-03 20:26:31 —-SHD—- C:\WINDOWS\Installer
2009-04-03 20:26:17 —-HD—- C:\WINDOWS\inf
2009-04-03 20:14:05 —-D—- C:\Program Files\Common Files
2009-04-03 13:09:51 —-SD—- C:\WINDOWS\Downloaded Program Files
2009-04-03 04:25:19 —-SD—- C:\Documents and Settings\HP_Administrator\Application Data\Microsoft
2009-04-03 04:10:27 —-D—- C:\Program Files\Java
2009-04-02 23:07:37 —-D—- C:\WINDOWS\system32\config
2009-04-02 23:05:49 —-D—- C:\WINDOWS\network diagnostic
2009-04-02 22:57:37 —-D—- C:\WINDOWS\WinSxS
2009-04-02 22:55:14 —-SD—- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-04-02 22:52:44 —-DC—- C:\WINDOWS\system32\DRVSTORE
2009-04-02 17:37:29 —-D—- C:\WINDOWS\system32\en-US
2009-04-02 17:37:29 —-D—- C:\WINDOWS\Media
2009-04-02 17:37:29 —-D—- C:\Program Files\Internet Explorer
2009-04-02 17:37:28 —-RSHD—- C:\WINDOWS\system32\dllcache
2009-03-29 14:26:58 —-D—- C:\Documents and Settings\HP_Administrator\Application Data\Intuit
2009-03-29 14:23:38 —-D—- C:\Documents and Settings\All Users\Application Data\Intuit
2009-03-29 14:23:36 —-RSD—- C:\WINDOWS\assembly
2009-03-29 14:23:25 —-D—- C:\Program Files\Common Files\Intuit
2009-03-29 14:23:21 —-RSD—- C:\WINDOWS\Fonts
2009-03-29 03:18:26 —-D—- C:\Documents and Settings\HP_Administrator\Application Data\MSN6
2009-03-18 22:48:18 —-D—- C:\Program Files\Easy Internet signup
2009-03-15 19:02:49 —-D—- C:\WINDOWS\SxsCaPendDel
2009-03-15 18:59:10 —-D—- C:\WINDOWS\system32\ReinstallBackups
2009-03-15 18:54:28 —-D—- C:\WINDOWS\Downloaded Installations
2009-03-15 18:29:43 —-HD—- C:\Program Files\InstallShield Installation Information
2009-03-15 18:18:08 —-D—- C:\WINDOWS\system32\wbem
2009-03-15 18:17:28 —-A—- C:\WINDOWS\imsins.BAK
2009-03-15 18:17:23 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys []
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB); C:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 547744]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2007-10-30 1201632]
R3 aracpi;aracpi; C:\WINDOWS\system32\DRIVERS\aracpi.sys [2005-08-03 22784]
R3 arhidfltr;MS Ar HID Filter Driver; C:\WINDOWS\system32\DRIVERS\arhidfltr.sys [2005-08-03 19200]
R3 arkbcfltr;Microsoft PS2 Keyboard Filter; C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys [2005-08-03 5376]
R3 armoucfltr;Microsoft PS2 Mouse Filter; C:\WINDOWS\system32\DRIVERS\armoucfltr.sys [2005-08-03 4992]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ARPolicy;ARPolicy; C:\WINDOWS\system32\DRIVERS\arpolicy.sys [2005-08-03 10112]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-09 1273856]
R3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2008-09-18 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2009-02-12 104328]
R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-12-10 242184]
R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2009-01-15 23848]
R3 hcwPP2;Hauppauge WinTV PVR PCI II ([23|25|26]xxx); C:\WINDOWS\system32\DRIVERS\hcwPP2.sys [2005-07-28 156800]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidIr;Microsoft Infrared HID Driver; C:\WINDOWS\system32\DRIVERS\hidir.sys [2008-04-13 19200]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-10-25 4623872]
R3 IrBus;Infrared bus filter driver for eHome remote controls; C:\WINDOWS\system32\DRIVERS\IrBus.sys [2008-04-13 46592]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 Ps2;PS2; C:\WINDOWS\system32\DRIVERS\PS2.sys [2005-07-04 26624]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 E100B;Intel® PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2004-10-14 155648]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 MXOPSWD;Maxtor OneTouch Security Driver; C:\WINDOWS\system32\DRIVERS\mxopswd.sys [2007-05-03 22152]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys []
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-06 132424]
R2 ARSVC;ARSVC; C:\WINDOWS\arservice.exe [2005-08-03 58880]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-09 380928]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 CSHelper;CopySafe Helper Service; C:\WINDOWS\system32\CSHelper.exe [2009-03-08 266240]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 IntuitUpdateService;Intuit Update Service; C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [2008-10-10 13088]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 KService;KService; C:\Program Files\Kontiki\KService.exe [2007-03-09 3068352]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-07-25 53248]
R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2009-03-24 415024]
R2 Maxtor Sync Service;Maxtor Service; C:\Program Files\Maxtor\Sync\SyncServices.exe [2008-07-21 193888]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe [2009-03-27 1626112]
R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-03-12 656168]
S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2009-01-20 172032]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

—————–EOF—————–
Post #8
Hi

GooredFix
Download GooredFix from one of the locations below & save it to your Desktop
Download Mirror #1
Download Mirror #2
  • Double-click GooredFix.exe to run it
  • Select 1. Find Goored (no fix) by typing 1 & pressing Enter
  • A log will open, post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt)
Note: Do not run Option #2 yet

Combofix
Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

**IMPORTANT !!! Rename ComboFix.exe to Commy.exe BEFORE saving it to your Desktop**

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    A guide to do this can be found here
  • Double click on ComboFix.exe & follow the prompts
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

To post in next reply:
Gooredfix log
Combofix log
Update on how the computer is running
Post #9 last edited
GooredFix v1.92 by jpshortstuff
Log created at 20:05 on 14/04/2009 running Option #1 (HP_Administrator)
Firefox version 3.0.5 (en-US)

=====Suspect Goored Entries=====

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\BitDefender\BitDefender 2009\FFToolbar\"


ComboFix 09-04-15.04 - HP_Administrator 04/14/2009 20:26.1 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\Commy.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated)
FW: BitDefender Firewall *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\Downloaded Program Files\ODCTOOLS
c:\windows\Downloaded Program Files\ODCTOOLS\ef6b26db-344d-4ad3-ba24-aca0bdaa999a.cab
c:\windows\Downloaded Program Files\ODCTOOLS\f04d289f-c60a-422b-8396-6c372047042e.cab
c:\windows\IE4 Error Log.txt
c:\windows\wyvqo.klq
D:\Autorun.inf

—– BITS: Possible infected sites —–

hxxp://download.esd.intuit.com
.
((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.

2009-04-15 02:18 . 2009-04-15 02:18 850 —-a-w c:\windows\system32\ProductTweaks.xml
2009-04-15 02:18 . 2009-04-15 02:18 385 —-a-w c:\windows\system32\user_gensett.xml
2009-04-14 02:48 . 2009-04-14 03:01 ——– d—–w C:\rsit
2009-04-13 01:40 . 2009-04-13 01:40 0 —-a-w c:\documents and settings\HP_Administrator\settings.dat
2009-04-11 07:07 . 2009-04-11 07:07 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2009-04-11 07:07 . 2009-04-06 21:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 07:07 . 2009-04-06 21:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-11 07:07 . 2009-04-11 07:07 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-05 05:05 . 2009-04-05 05:05 121 —-a-w c:\windows\bdagent.INI
2009-04-04 06:59 . 2009-04-14 03:12 81984 —-a-w c:\windows\system32\bdod.bin
2009-04-04 06:55 . 2009-04-04 06:55 476 —-a-w c:\windows\system32\BDUpdateV1.xml
2009-04-04 02:26 . 2009-04-04 02:26 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\BitDefender
2009-04-04 02:25 . 2009-04-04 02:31 ——– d—–w c:\documents and settings\All Users\Application Data\BitDefender
2009-04-03 10:34 . 2008-06-19 22:24 28544 —-a-w c:\windows\system32\drivers\pavboot.sys
2009-04-03 02:22 . 2009-04-03 02:22 ——– d-sh–w c:\documents and settings\HP_Administrator\IECompatCache
2009-04-03 02:21 . 2009-04-03 02:21 ——– d-sh–w c:\documents and settings\HP_Administrator\PrivacIE
2009-04-02 23:40 . 2009-04-02 23:40 ——– d-sh–w c:\documents and settings\LocalService\IETldCache
2009-04-02 23:37 . 2009-04-02 23:37 ——– d-sh–w c:\documents and settings\HP_Administrator\IETldCache
2009-04-02 19:48 . 2009-04-02 19:50 ——– dc-h–w c:\windows\ie8
2009-04-02 19:18 . 2009-04-02 19:18 ——– d—–w C:\798613507f9fe19734c4
2009-03-29 20:27 . 2009-03-29 20:27 ——– d—–w c:\documents and settings\HP_Administrator\Local Settings\Application Data\Intuit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-11 07:07 . 2009-04-11 07:07 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 04:22 . 2009-04-11 04:22 ——– d—–w c:\program files\Trend Micro
2009-04-06 18:37 . 2009-04-06 19:30 208970 —-a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-04-04 02:39 . 2008-09-13 16:53 45316 —ha-w c:\windows\system32\mlfcache.dat
2009-04-04 02:25 . 2009-04-04 02:14 ——– d—–w c:\program files\Common Files\BitDefender
2009-04-04 02:25 . 2009-04-04 02:25 ——– d—–w c:\program files\BitDefender
2009-04-03 10:34 . 2009-04-03 10:34 ——– d—–w c:\program files\Panda Security
2009-04-03 10:10 . 2005-09-15 02:59 ——– d—–w c:\program files\Java
2009-04-02 05:36 . 2009-04-02 05:36 ——– d—–w c:\program files\Microsoft Silverlight
2009-03-29 20:27 . 2006-01-29 23:11 56544 —-a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-29 20:26 . 2008-01-17 07:47 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Intuit
2009-03-29 20:25 . 2009-03-29 20:25 ——– d—–w c:\program files\Common Files\AnswerWorks 5.0
2009-03-29 20:23 . 2005-09-15 03:46 ——– d—–w c:\documents and settings\All Users\Application Data\Intuit
2009-03-29 20:23 . 2005-09-15 03:47 ——– d—–w c:\program files\Common Files\Intuit
2009-03-29 20:14 . 2009-03-29 20:14 ——– d—–w c:\program files\TurboTax
2009-03-29 09:18 . 2005-12-05 07:05 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\MSN6
2009-03-19 04:48 . 2005-09-15 03:55 ——– d—–w c:\program files\Easy Internet signup
2009-03-16 00:58 . 2009-03-16 00:29 ——– d—–w c:\program files\Maxtor
2009-03-16 00:38 . 2009-03-16 00:29 ——– d—–w c:\documents and settings\All Users\Application Data\Maxtor
2009-03-16 00:29 . 2005-09-15 03:37 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-16 00:17 . 2009-03-16 00:17 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Windows Desktop Search
2009-03-16 00:17 . 2009-03-16 00:17 ——– d—–w c:\program files\Windows Desktop Search
2009-03-14 01:13 . 2009-03-14 01:13 ——– d—–w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-14 01:13 . 2009-03-14 01:13 ——– d—–w c:\program files\iTunes
2009-03-14 01:13 . 2009-03-14 01:13 ——– d—–w c:\program files\iPod
2009-03-14 01:13 . 2008-03-30 04:52 ——– d—–w c:\program files\Common Files\Apple
2009-03-14 01:11 . 2009-03-14 01:10 ——– d—–w c:\program files\QuickTime
2009-03-14 00:55 . 2008-07-29 23:33 ——– d—–w c:\program files\Safari
2009-03-14 00:52 . 2009-03-14 00:52 ——– d—–w c:\program files\Bonjour
2009-03-09 11:19 . 2009-03-06 04:02 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-08 20:09 . 2004-08-10 12:00 638816 —-a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 20:09 . 2004-08-10 12:00 391536 —-a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 18:28 . 2009-03-08 18:28 266240 —-a-w c:\windows\system32\CSHelper.exe
2009-03-08 18:28 . 2009-03-08 18:28 225280 —-a-w c:\windows\system32\CSInstru.DLL
2009-03-08 10:41 . 2004-08-10 12:00 5937152 —-a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-08 10:39 . 2008-01-17 08:58 11063808 —-a-w c:\windows\system32\dllcache\ieframe.dll
2009-03-08 10:34 . 2004-08-10 12:00 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 10:34 . 2004-08-10 12:00 914944 —-a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 10:34 . 2004-08-10 12:00 1206784 —-a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 10:34 . 2004-08-10 12:00 236544 —-a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 10:34 . 2004-08-10 12:00 43008 —-a-w c:\windows\system32\licmgr10.dll
2009-03-08 10:34 . 2004-08-10 12:00 43008 —-a-w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 10:34 . 2004-08-10 12:00 105984 —-a-w c:\windows\system32\dllcache\url.dll
2009-03-08 10:34 . 2004-08-10 12:00 193536 —-a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 10:34 . 2004-08-10 12:00 109568 —-a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 10:33 . 2004-08-10 12:00 759296 —-a-w c:\windows\system32\dllcache\VGX.dll
2009-03-08 10:33 . 2009-03-08 10:33 18944 ——w c:\windows\system32\dllcache\corpol.dll
2009-03-08 10:33 . 2004-08-10 12:00 18944 —-a-w c:\windows\system32\corpol.dll
2009-03-08 10:33 . 2004-08-10 12:00 25600 —-a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 10:33 . 2008-05-09 10:53 726528 —-a-w c:\windows\system32\dllcache\jscript.dll
2009-03-08 10:33 . 2004-08-10 12:00 229376 —-a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 10:33 . 2008-05-09 10:53 420352 —-a-w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 10:33 . 2004-08-10 12:00 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 10:33 . 2004-08-10 12:00 125952 —-a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 10:32 . 2004-08-10 12:00 72704 —-a-w c:\windows\system32\dllcache\admparse.dll
2009-03-08 10:32 . 2004-08-10 12:00 72704 —-a-w c:\windows\system32\admparse.dll
2009-03-08 10:32 . 2004-08-10 12:00 173056 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 10:32 . 2004-08-10 12:00 163840 —-a-w c:\windows\system32\dllcache\ieakui.dll
2009-03-08 10:32 . 2004-08-10 12:00 71680 —-a-w c:\windows\system32\iesetup.dll
2009-03-08 10:32 . 2004-08-10 12:00 71680 —-a-w c:\windows\system32\dllcache\iesetup.dll
2009-03-08 10:32 . 2004-08-10 12:00 55808 —-a-w c:\windows\system32\dllcache\iernonce.dll
2009-03-08 10:32 . 2004-08-10 12:00 128512 —-a-w c:\windows\system32\dllcache\advpack.dll
2009-03-08 10:32 . 2004-08-10 12:00 94720 —-a-w c:\windows\system32\dllcache\inseng.dll
2009-03-08 10:32 . 2008-01-17 08:58 594432 —-a-w c:\windows\system32\dllcache\msfeeds.dll
2009-03-08 10:32 . 2008-01-17 08:58 1985024 —-a-w c:\windows\system32\dllcache\iertutil.dll
2009-03-08 10:32 . 2004-08-10 12:00 611840 —-a-w c:\windows\system32\dllcache\mstime.dll
2009-03-08 10:24 . 2004-08-10 12:00 68608 —-a-w c:\windows\system32\dllcache\hmmapi.dll
2009-03-08 10:22 . 2004-08-10 12:00 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-08 10:22 . 2004-08-10 12:00 156160 —-a-w c:\windows\system32\dllcache\msls31.dll
2009-03-08 10:11 . 2008-01-17 08:58 445952 —-a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-02-09 11:13 . 2008-10-15 00:57 1846784 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-07 03:07 . 2008-01-17 08:58 3698584 —-a-w c:\windows\system32\dllcache\ieapfltr.dat
2007-03-11 20:48 . 2006-01-29 22:19 154 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2006-02-13 06:08 . 2006-02-13 06:08 251 —-a-w c:\program files\wt3d.ini
2005-12-14 05:02 . 2005-12-14 05:02 42656 —-a-w c:\program files\MC
2005-12-05 06:32 . 2008-01-17 07:47 139 —-a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat
2005-09-15 02:53 . 2005-09-15 02:53 136 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2009-03-06 00:2009-04-04 02:32 08:04 . c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"= "c:\windows\system32\ieframe.dll" [2009-03-08 11063808]

[HKEY_CLASSES_ROOT\clsid\{cfbfae00-17a6-11d0-99cb-00c04fd64497}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2009-03-09 11:18 35840 —-a-w c:\program files\Java\jre6\bin\jp2ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2009-03-09 11:18 73728 —-a-w c:\program files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"= "c:\windows\system32\ieframe.dll" [2009-03-08 11063808]

[HKEY_CLASSES_ROOT\clsid\{f2cf5485-4e02-4f68-819c-b92de9277049}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2005-05-11 253952]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-09-14 50688]
"CocaCola Media Manager Tray"="c:\program files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe" [2007-03-13 387152]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-03-19 778240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-03 77312]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-10-25 16855552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"= {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - c:\windows\system32\webcheck.dll [2009-03-08 236544]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2009-01-21 172032]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
S2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-10-07 82696]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2009-03-08 266240]
S2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [2008-10-10 13088]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\DRIVERS\A3AB.sys [2007-05-23 547744]
S3 bdfm;bdfm;c:\windows\system32\drivers\bdfm.sys [2008-09-18 111112]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\bdfndisf.sys [2009-02-12 104328]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f148ab0-ce16-11dc-a806-001195f20da9}]
\shell\open\command - %SystemRoot%\Explorer.exe /idlist,%I,%L

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-04-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 18:34]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PCDrProfiler - (no file)
SSODL-CDBurn-{fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll


.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=Q405&bd;=pavilion&pf;=desktop&parm1;=seconduser
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: {{E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
IE: {{e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {{FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\Messenger\msmsgs.exe
TCP: {F8711D3D-9D7D-4653-B38A-E02931182F9F} = 205.171.3.65,205.171.2.65
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\program files\Common Files\System\Ole DB\MSDAIPP.DLL
Handler: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - c:\windows\system32\msvidctl.dll
DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} - hxxp://www.auctiva.com/Aurigma/ImageUploader55.cab
DPF: {C56BF45D-4722-4EFD-AA14-9DB1E92661E3} - hxxp://coke.mycokerewards.com/cabs/CocaCola_1_0_0_9.cab
DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - hxxp://coke.mycokerewards.com/cabs/Entriq_3_6_0_15_Silent.cab
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\vl6og035.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?wl=true
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 20:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(864)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1960)
c:\windows\system32\ieframe.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\arservice.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Kontiki\KService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Maxtor\Sync\SyncServices.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dllhost.exe
c:\hp\KBD\kbd.exe
.
**************************************************************************
.
Completion time: 2009-04-15 20:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 02:37

Pre-Run: 213,464,211,456 bytes free
Post-Run: 213,484,617,728 bytes free

294
Post #10
The performance is better. I have now run Windows Updates and it worked. I can reach DOS and was able to browse to antivirus repair sites I couldn't reach earlier such as the bleepingcomputer link you provided. I have not seen a redirect yet in very limited use of Google. Is there something in these logs that stands out to tell us what was causing the problem? One thing I have noticed on reboot is that there is a message that pops up "The instruction at 0x0012e619" could not be written to 0x00000000. The part in quotes is exact but the rest is a guess as it disappeared as the computer shut down.
Post #11
Hi

One thing I have noticed on reboot is that there is a message that pops up "The instruction at 0x0012e619" could not be written to 0x00000000. The part in quotes is exact but the rest is a guess as it disappeared as the computer shut down.

We'll make sure the machine is clean before looking at this. Though a quick Google search was pointing toward possibly hardware issues ie RAM.

Is there something in these logs that stands out to tell us what was causing the problem?

Your computer was not that badly infected but this: c:\windows\wyvqo.klq was definitely a baddy.

CFScript
Close any open browsers.
Open notepad and copy/paste the text in the code box below into it:

DirLook::
C:\798613507f9fe19734c4
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f148ab0-ce16-11dc-a806-001195f20da9}]
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

ATF Cleaner
Download ATF Cleaner here by Atribune.
Double-click ATF-Cleaner.exe to run the program
Under Main choose: Select All
Click the Empty Selected button
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button
NOTE: If you would like to keep your saved passwords, please click No at the prompt
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button
NOTE: If you would like to keep your saved passwords, please click No at the prompt
Click Exit on the Main menu to close the program.

Kaspersky Online Scan
Do an online scan with >Kaspersky Online Scanner<
  • Read through the requirements and privacy statement and click on Accept button
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run
  • When the downloads have finished, click on Settings
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan
  • Once the scan is complete, it will display the results. Click on View Scan Report
  • You will see a list of infected items there. Click on Save Report As…
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button
  • Please post this log in your next reply
To post in next reply:
Combofix log
Kaspersky Scan log
Post #12
ComboFix 09-04-15.04 - HP_Administrator 04/15/2009 22:43.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.427 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Commy.exe
Command switches used :: c:\documents and settings\HP_Administrator\Desktop\CFScript.txt
AV: BitDefender Antivirus *On-access scanning enabled* (Updated)
FW: BitDefender Firewall *enabled*
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2009-03-16 to 2009-04-16 )))))))))))))))))))))))))))))))
.

2009-04-15 03:10 . 2009-04-15 03:10 ——– d—–w c:\windows\ie8updates
2009-04-15 03:09 . 2009-04-15 03:09 ——– d—–w c:\windows\LastGood
2009-04-15 03:09 . 2009-02-28 04:55 105984 ——w c:\windows\system32\dllcache\iecompat.dll
2009-04-15 02:52 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 02:52 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 02:52 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 02:52 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 02:52 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 02:52 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 02:52 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 02:52 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 02:52 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 02:51 . 2009-03-27 06:58 1203922 ——w c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 02:51 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 02:51 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe
2009-04-15 02:18 . 2009-04-15 02:18 850 —-a-w c:\windows\system32\ProductTweaks.xml
2009-04-15 02:18 . 2009-04-15 02:18 385 —-a-w c:\windows\system32\user_gensett.xml
2009-04-14 02:48 . 2009-04-14 03:01 ——– d—–w C:\rsit
2009-04-13 01:40 . 2009-04-13 01:40 0 —-a-w c:\documents and settings\HP_Administrator\settings.dat
2009-04-11 07:07 . 2009-04-11 07:07 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2009-04-11 07:07 . 2009-04-06 21:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 07:07 . 2009-04-06 21:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-11 07:07 . 2009-04-11 07:07 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-05 05:05 . 2009-04-05 05:05 121 —-a-w c:\windows\bdagent.INI
2009-04-04 06:59 . 2009-04-16 04:39 81984 —-a-w c:\windows\system32\bdod.bin
2009-04-04 06:55 . 2009-04-16 04:39 340 —-a-w c:\windows\system32\BDUpdateV1.xml
2009-04-04 02:26 . 2009-04-04 02:26 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\BitDefender
2009-04-04 02:25 . 2009-04-04 02:31 ——– d—–w c:\documents and settings\All Users\Application Data\BitDefender
2009-04-03 10:34 . 2008-06-19 22:24 28544 —-a-w c:\windows\system32\drivers\pavboot.sys
2009-04-03 02:22 . 2009-04-03 02:22 ——– d-sh–w c:\documents and settings\HP_Administrator\IECompatCache
2009-04-03 02:21 . 2009-04-03 02:21 ——– d-sh–w c:\documents and settings\HP_Administrator\PrivacIE
2009-04-02 23:40 . 2009-04-02 23:40 ——– d-sh–w c:\documents and settings\LocalService\IETldCache
2009-04-02 23:37 . 2009-04-02 23:37 ——– d-sh–w c:\documents and settings\HP_Administrator\IETldCache
2009-04-02 19:48 . 2009-04-02 19:50 ——– dc-h–w c:\windows\ie8
2009-04-02 19:18 . 2009-04-02 19:18 ——– d—–w C:\798613507f9fe19734c4
2009-03-29 20:27 . 2009-03-29 20:27 ——– d—–w c:\documents and settings\HP_Administrator\Local Settings\Application Data\Intuit
2009-03-21 14:06 . 2009-03-21 14:06 989696 ——w c:\windows\system32\dllcache\kernel32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-15 03:09 . 2005-12-05 06:32 ——– d—–w c:\program files\Microsoft
2009-04-11 07:07 . 2009-04-11 07:07 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 04:22 . 2009-04-11 04:22 ——– d—–w c:\program files\Trend Micro
2009-04-06 18:37 . 2009-04-06 19:30 208970 —-a-w c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-04-04 02:39 . 2008-09-13 16:53 45316 —ha-w c:\windows\system32\mlfcache.dat
2009-04-04 02:25 . 2009-04-04 02:14 ——– d—–w c:\program files\Common Files\BitDefender
2009-04-04 02:25 . 2009-04-04 02:25 ——– d—–w c:\program files\BitDefender
2009-04-03 10:34 . 2009-04-03 10:34 ——– d—–w c:\program files\Panda Security
2009-04-03 10:10 . 2005-09-15 02:59 ——– d—–w c:\program files\Java
2009-04-02 05:36 . 2009-04-02 05:36 ——– d—–w c:\program files\Microsoft Silverlight
2009-03-29 20:27 . 2006-01-29 23:11 56544 —-a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-29 20:26 . 2008-01-17 07:47 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Intuit
2009-03-29 20:25 . 2009-03-29 20:25 ——– d—–w c:\program files\Common Files\AnswerWorks 5.0
2009-03-29 20:23 . 2005-09-15 03:46 ——– d—–w c:\documents and settings\All Users\Application Data\Intuit
2009-03-29 20:23 . 2005-09-15 03:47 ——– d—–w c:\program files\Common Files\Intuit
2009-03-29 20:14 . 2009-03-29 20:14 ——– d—–w c:\program files\TurboTax
2009-03-29 09:18 . 2005-12-05 07:05 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\MSN6
2009-03-19 04:48 . 2005-09-15 03:55 ——– d—–w c:\program files\Easy Internet signup
2009-03-16 00:58 . 2009-03-16 00:29 ——– d—–w c:\program files\Maxtor
2009-03-16 00:38 . 2009-03-16 00:29 ——– d—–w c:\documents and settings\All Users\Application Data\Maxtor
2009-03-16 00:29 . 2005-09-15 03:37 ——– d–h–w c:\program files\InstallShield Installation Information
2009-03-16 00:17 . 2009-03-16 00:17 ——– d—–w c:\documents and settings\HP_Administrator\Application Data\Windows Desktop Search
2009-03-16 00:17 . 2009-03-16 00:17 ——– d—–w c:\program files\Windows Desktop Search
2009-03-14 01:13 . 2009-03-14 01:13 ——– d—–w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-14 01:13 . 2009-03-14 01:13 ——– d—–w c:\program files\iTunes
2009-03-14 01:13 . 2009-03-14 01:13 ——– d—–w c:\program files\iPod
2009-03-14 01:13 . 2008-03-30 04:52 ——– d—–w c:\program files\Common Files\Apple
2009-03-14 01:11 . 2009-03-14 01:10 ——– d—–w c:\program files\QuickTime
2009-03-14 00:55 . 2008-07-29 23:33 ——– d—–w c:\program files\Safari
2009-03-14 00:52 . 2009-03-14 00:52 ——– d—–w c:\program files\Bonjour
2009-03-09 11:19 . 2009-03-06 04:02 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-08 20:09 . 2004-08-10 12:00 638816 —-a-w c:\windows\system32\dllcache\iexplore.exe
2009-03-08 20:09 . 2004-08-10 12:00 391536 —-a-w c:\windows\system32\dllcache\iedkcs32.dll
2009-03-08 18:28 . 2009-03-08 18:28 266240 —-a-w c:\windows\system32\CSHelper.exe
2009-03-08 18:28 . 2009-03-08 18:28 225280 —-a-w c:\windows\system32\CSInstru.DLL
2009-03-08 10:41 . 2004-08-10 12:00 5937152 —-a-w c:\windows\system32\dllcache\mshtml.dll
2009-03-08 10:39 . 2008-01-17 08:58 11063808 —-a-w c:\windows\system32\dllcache\ieframe.dll
2009-03-08 10:34 . 2004-08-10 12:00 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 10:34 . 2004-08-10 12:00 914944 —-a-w c:\windows\system32\dllcache\wininet.dll
2009-03-08 10:34 . 2004-08-10 12:00 1206784 —-a-w c:\windows\system32\dllcache\urlmon.dll
2009-03-08 10:34 . 2004-08-10 12:00 236544 —-a-w c:\windows\system32\dllcache\webcheck.dll
2009-03-08 10:34 . 2004-08-10 12:00 43008 —-a-w c:\windows\system32\licmgr10.dll
2009-03-08 10:34 . 2004-08-10 12:00 43008 —-a-w c:\windows\system32\dllcache\licmgr10.dll
2009-03-08 10:34 . 2004-08-10 12:00 105984 —-a-w c:\windows\system32\dllcache\url.dll
2009-03-08 10:34 . 2004-08-10 12:00 193536 —-a-w c:\windows\system32\dllcache\msrating.dll
2009-03-08 10:34 . 2004-08-10 12:00 109568 —-a-w c:\windows\system32\dllcache\occache.dll
2009-03-08 10:33 . 2004-08-10 12:00 759296 —-a-w c:\windows\system32\dllcache\VGX.dll
2009-03-08 10:33 . 2009-03-08 10:33 18944 ——w c:\windows\system32\dllcache\corpol.dll
2009-03-08 10:33 . 2004-08-10 12:00 18944 —-a-w c:\windows\system32\corpol.dll
2009-03-08 10:33 . 2004-08-10 12:00 25600 —-a-w c:\windows\system32\dllcache\jsproxy.dll
2009-03-08 10:33 . 2008-05-09 10:53 726528 —-a-w c:\windows\system32\dllcache\jscript.dll
2009-03-08 10:33 . 2004-08-10 12:00 229376 —-a-w c:\windows\system32\dllcache\ieaksie.dll
2009-03-08 10:33 . 2008-05-09 10:53 420352 —-a-w c:\windows\system32\dllcache\vbscript.dll
2009-03-08 10:33 . 2004-08-10 12:00 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 10:33 . 2004-08-10 12:00 125952 —-a-w c:\windows\system32\dllcache\ieakeng.dll
2009-03-08 10:32 . 2004-08-10 12:00 72704 —-a-w c:\windows\system32\dllcache\admparse.dll
2009-03-08 10:32 . 2004-08-10 12:00 72704 —-a-w c:\windows\system32\admparse.dll
2009-03-08 10:32 . 2004-08-10 12:00 173056 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2009-03-08 10:32 . 2004-08-10 12:00 163840 —-a-w c:\windows\system32\dllcache\ieakui.dll
2009-03-08 10:32 . 2004-08-10 12:00 71680 —-a-w c:\windows\system32\iesetup.dll
2009-03-08 10:32 . 2004-08-10 12:00 71680 —-a-w c:\windows\system32\dllcache\iesetup.dll
2009-03-08 10:32 . 2004-08-10 12:00 55808 —-a-w c:\windows\system32\dllcache\iernonce.dll
2009-03-08 10:32 . 2004-08-10 12:00 128512 —-a-w c:\windows\system32\dllcache\advpack.dll
2009-03-08 10:32 . 2004-08-10 12:00 94720 —-a-w c:\windows\system32\dllcache\inseng.dll
2009-03-08 10:32 . 2008-01-17 08:58 594432 —-a-w c:\windows\system32\dllcache\msfeeds.dll
2009-03-08 10:32 . 2008-01-17 08:58 1985024 —-a-w c:\windows\system32\dllcache\iertutil.dll
2009-03-08 10:32 . 2004-08-10 12:00 611840 —-a-w c:\windows\system32\dllcache\mstime.dll
2009-03-08 10:24 . 2004-08-10 12:00 68608 —-a-w c:\windows\system32\dllcache\hmmapi.dll
2009-03-08 10:22 . 2004-08-10 12:00 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-08 10:22 . 2004-08-10 12:00 156160 —-a-w c:\windows\system32\dllcache\msls31.dll
2009-03-08 10:11 . 2008-01-17 08:58 445952 —-a-w c:\windows\system32\dllcache\ieapfltr.dll
2009-03-06 14:22 . 2004-08-10 12:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-02-09 12:10 . 2004-08-10 12:00 729088 —-a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-11 02:00 714752 —-a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-10 12:00 617472 —-a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-10 12:00 401408 —-a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2008-10-15 00:57 1846784 ——w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 12:00 1846784 —-a-w c:\windows\system32\win32k.sys
2009-02-08 01:02 . 2008-10-15 00:57 2066048 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-07 03:07 . 2008-01-17 08:58 3698584 —-a-w c:\windows\system32\dllcache\ieapfltr.dat
2009-02-06 11:11 . 2004-08-10 12:00 110592 —-a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 2008-10-15 00:57 2189056 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-06 11:06 . 2008-10-15 00:57 2145280 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-06 11:06 . 2004-08-10 12:00 2145280 —-a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-10 12:00 35328 —-a-w c:\windows\system32\sc.exe
2009-02-06 10:39 . 2004-08-10 12:00 35328 —-a-w c:\windows\system32\dllcache\sc.exe
2009-02-06 10:32 . 2008-10-15 00:57 2023936 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-06 10:32 . 2004-08-11 02:00 2023936 —-a-w c:\windows\system32\ntkrnlpa.exe
2009-02-03 19:59 . 2009-02-03 19:59 56832 ——w c:\windows\system32\dllcache\secur32.dll
2009-02-03 19:59 . 2004-08-10 12:00 56832 —-a-w c:\windows\system32\secur32.dll
2007-03-11 20:48 . 2006-01-29 22:19 154 —-a-w c:\documents and settings\HP_Administrator\Application Data\wklnhst.dat
2006-02-13 06:08 . 2006-02-13 06:08 251 —-a-w c:\program files\wt3d.ini
2005-12-14 05:02 . 2005-12-14 05:02 42656 —-a-w c:\program files\MC
2005-12-05 06:32 . 2008-01-17 07:47 139 —-a-w c:\documents and settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat
2005-09-15 02:53 . 2005-09-15 02:53 136 —-a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2009-03-06 00:2009-04-04 02:32 08:04 . c:\program files\mozilla firefox\components\FFComm.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\798613507f9fe19734c4 —-

2009-04-02 19:18 . 2009-04-02 19:18 788 —ha-w c:\798613507f9fe19734c4\$shtdwn$.req
2009-03-08 20:25 . 2009-03-08 20:25 10416 —-a-w c:\798613507f9fe19734c4\update\update.ver
2009-03-08 20:23 . 2009-03-08 20:23 47422 —-a-w c:\798613507f9fe19734c4\update\ie8.cat
2009-03-08 20:23 . 2009-03-08 20:23 58464 —-a-w c:\798613507f9fe19734c4\update\iecustom.dll
2009-03-08 20:23 . 2009-03-08 20:23 1113696 —-a-w c:\798613507f9fe19734c4\update\iesetup.exe
2009-03-08 20:23 . 2009-03-08 20:23 141408 —-a-w c:\798613507f9fe19734c4\update\sqmapi.dll
2009-03-08 20:22 . 2009-03-08 20:22 36864 —-a-w c:\798613507f9fe19734c4\iedvtool.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 12288 —-a-w c:\798613507f9fe19734c4\mshtml.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 1241088 —-a-w c:\798613507f9fe19734c4\ieframe.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 3584 —-a-w c:\798613507f9fe19734c4\inseng.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 5120 —-a-w c:\798613507f9fe19734c4\iernonce.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 2560 —-a-w c:\798613507f9fe19734c4\jsdebuggeride.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 7168 —-a-w c:\798613507f9fe19734c4\ieakeng.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 49152 —-a-w c:\798613507f9fe19734c4\msrating.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 2560 —-a-w c:\798613507f9fe19734c4\iertutil.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 11264 —-a-w c:\798613507f9fe19734c4\vbscript.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 2560 —-a-w c:\798613507f9fe19734c4\jsprofilercore.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 40960 —-a-w c:\798613507f9fe19734c4\webcheck.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 6144 —-a-w c:\798613507f9fe19734c4\winfxdocobj.exe.mui
2009-03-08 20:22 . 2009-03-08 20:22 3584 —-a-w c:\798613507f9fe19734c4\ieui.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 2560 —-a-w c:\798613507f9fe19734c4\mshta.exe.mui
2009-03-08 20:22 . 2009-03-08 20:22 20480 —-a-w c:\798613507f9fe19734c4\jsdbgui.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 12288 —-a-w c:\798613507f9fe19734c4\hmmapi.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 77824 —-a-w c:\798613507f9fe19734c4\iesetup.dll.mui
2009-03-08 20:22 . 2009-03-08 20:22 122880 —-a-w c:\798613507f9fe19734c4\inetcpl.cpl.mui
2009-03-08 20:22 . 2009-03-08 20:22 3584 —-a-w c:\798613507f9fe19734c4\admparse.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 53248 —-a-w c:\798613507f9fe19734c4\wininet.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 12288 —-a-w c:\798613507f9fe19734c4\iexplore.exe.mui
2009-03-08 20:21 . 2009-03-08 20:21 20480 —-a-w c:\798613507f9fe19734c4\occache.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 57344 —-a-w c:\798613507f9fe19734c4\mshtmler.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 4608 —-a-w c:\798613507f9fe19734c4\iepeers.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 2771706 —-a-w c:\798613507f9fe19734c4\inetres.adm
2009-03-08 20:21 . 2009-03-08 20:21 40960 —-a-w c:\798613507f9fe19734c4\urlmon.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 13460 —-a-w c:\798613507f9fe19734c4\inetcorp.iem
2009-03-08 20:21 . 2009-03-08 20:21 40960 —-a-w c:\798613507f9fe19734c4\ieaksie.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 2560 —-a-w c:\798613507f9fe19734c4\msfeedsbs.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 4096 —-a-w c:\798613507f9fe19734c4\licmgr10.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 10240 —-a-w c:\798613507f9fe19734c4\advpack.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 4096 —-a-w c:\798613507f9fe19734c4\ie4uinit.exe.mui
2009-03-08 20:21 . 2009-03-08 20:21 118784 —-a-w c:\798613507f9fe19734c4\ieakui.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 13312 —-a-w c:\798613507f9fe19734c4\jscript.dll.mui
2009-03-08 20:21 . 2009-03-08 20:21 37836 —-a-w c:\798613507f9fe19734c4\inetset.iem
2009-03-08 20:20 . 2009-03-08 20:20 8704 —-a-w c:\798613507f9fe19734c4\icardie.dll.mui
2009-03-08 20:20 . 2009-03-08 20:20 81920 —-a-w c:\798613507f9fe19734c4\iedkcs32.dll.mui
2009-03-08 20:20 . 2009-03-08 20:20 16384 —-a-w c:\798613507f9fe19734c4\jsprofilerui.dll.mui
2009-03-08 20:20 . 2009-03-08 20:20 10752 —-a-w c:\798613507f9fe19734c4\html.iec.mui
2009-03-08 20:09 . 2009-03-08 20:09 391536 —-a-w c:\798613507f9fe19734c4\iedkcs32.dll
2009-03-08 20:09 . 2009-03-08 20:09 638816 —-a-w c:\798613507f9fe19734c4\iexplore.exe
2009-03-08 20:08 . 2009-03-08 20:08 1474411 —-a-w c:\798613507f9fe19734c4\update\update.inf
2009-03-08 10:41 . 2009-03-08 10:41 5937152 —-a-w c:\798613507f9fe19734c4\mshtml.dll
2009-03-08 10:39 . 2009-03-08 10:39 11063808 —-a-w c:\798613507f9fe19734c4\ieframe.dll
2009-03-08 10:35 . 2009-03-08 10:35 742912 —-a-w c:\798613507f9fe19734c4\iedvtool.dll
2009-03-08 10:35 . 2009-03-08 10:35 233984 —-a-w c:\798613507f9fe19734c4\jsprofilerui.dll
2009-03-08 10:35 . 2009-03-08 10:35 385024 —-a-w c:\798613507f9fe19734c4\html.iec
2009-03-08 10:35 . 2009-03-08 10:35 144384 —-a-w c:\798613507f9fe19734c4\extexport.exe
2009-03-08 10:35 . 2009-03-08 10:35 2048 —-a-w c:\798613507f9fe19734c4\iecompat.dll
2009-03-08 10:35 . 2009-03-08 10:35 118272 —-a-w c:\798613507f9fe19734c4\jsprofilercore.dll
2009-03-08 10:35 . 2009-03-08 10:35 521216 —-a-w c:\798613507f9fe19734c4\jsdbgui.dll
2009-03-08 10:35 . 2009-03-08 10:35 121344 —-a-w c:\798613507f9fe19734c4\jsdebuggeride.dll
2009-03-08 10:34 . 2009-03-08 10:34 914944 —-a-w c:\798613507f9fe19734c4\wininet.dll
2009-03-08 10:34 . 2009-03-08 10:34 1206784 —-a-w c:\798613507f9fe19734c4\urlmon.dll
2009-03-08 10:34 . 2009-03-08 10:34 1469440 —-a-w c:\798613507f9fe19734c4\inetcpl.cpl
2009-03-08 10:34 . 2009-03-08 10:34 236544 —-a-w c:\798613507f9fe19734c4\webcheck.dll
2009-03-08 10:34 . 2009-03-08 10:34 208384 —-a-w c:\798613507f9fe19734c4\winfxdocobj.exe
2009-03-08 10:34 . 2009-03-08 10:34 43008 —-a-w c:\798613507f9fe19734c4\licmgr10.dll
2009-03-08 10:34 . 2009-03-08 10:34 105984 —-a-w c:\798613507f9fe19734c4\url.dll
2009-03-08 10:34 . 2009-03-08 10:34 193536 —-a-w c:\798613507f9fe19734c4\msrating.dll
2009-03-08 10:34 . 2009-03-08 10:34 109568 —-a-w c:\798613507f9fe19734c4\occache.dll
2009-03-08 10:33 . 2009-03-08 10:33 246784 —-a-w c:\798613507f9fe19734c4\ieproxy.dll
2009-03-08 10:33 . 2009-03-08 10:33 759296 —-a-w c:\798613507f9fe19734c4\vgx.dll
2009-03-08 10:33 . 2009-03-08 10:33 18944 —-a-w c:\798613507f9fe19734c4\corpol.dll
2009-03-08 10:33 . 2009-03-08 10:33 25600 —-a-w c:\798613507f9fe19734c4\jsproxy.dll
2009-03-08 10:33 . 2009-03-08 10:33 12288 —-a-w c:\798613507f9fe19734c4\xpshims.dll
2009-03-08 10:33 . 2009-03-08 10:33 726528 —-a-w c:\798613507f9fe19734c4\jscript.dll
2009-03-08 10:33 . 2009-03-08 10:33 229376 —-a-w c:\798613507f9fe19734c4\ieaksie.dll
2009-03-08 10:33 . 2009-03-08 10:33 420352 —-a-w c:\798613507f9fe19734c4\vbscript.dll
2009-03-08 10:33 . 2009-03-08 10:33 125952 —-a-w c:\798613507f9fe19734c4\ieakeng.dll
2009-03-08 10:32 . 2009-03-08 10:32 72704 —-a-w c:\798613507f9fe19734c4\admparse.dll
2009-03-08 10:32 . 2009-03-08 10:32 173056 —-a-w c:\798613507f9fe19734c4\ie4uinit.exe
2009-03-08 10:32 . 2009-03-08 10:32 163840 —-a-w c:\798613507f9fe19734c4\ieakui.dll
2009-03-08 10:32 . 2009-03-08 10:32 36864 —-a-w c:\798613507f9fe19734c4\ieudinit.exe
2009-03-08 10:32 . 2009-03-08 10:32 55808 —-a-w c:\798613507f9fe19734c4\iernonce.dll
2009-03-08 10:32 . 2009-03-08 10:32 71680 —-a-w c:\798613507f9fe19734c4\iesetup.dll
2009-03-08 10:32 . 2009-03-08 10:32 3072 —-a-w c:\798613507f9fe19734c4\ieudinit.exe.mui
2009-03-08 10:32 . 2009-03-08 10:32 128512 —-a-w c:\798613507f9fe19734c4\advpack.dll
2009-03-08 10:32 . 2009-03-08 10:32 94720 —-a-w c:\798613507f9fe19734c4\inseng.dll
2009-03-08 10:32 . 2009-03-08 10:32 594432 —-a-w c:\798613507f9fe19734c4\msfeeds.dll
2009-03-08 10:32 . 2009-03-08 10:32 1985024 —-a-w c:\798613507f9fe19734c4\iertutil.dll
2009-03-08 10:32 . 2009-03-08 10:32 611840 —-a-w c:\798613507f9fe19734c4\mstime.dll
2009-03-08 10:31 . 2009-03-08 10:31 183808 —-a-w c:\798613507f9fe19734c4\iepeers.dll
2009-03-08 10:31 . 2009-03-08 10:31 13312 —-a-w c:\798613507f9fe19734c4\msfeedssync.exe
2009-03-08 10:31 . 2009-03-08 10:31 59904 —-a-w c:\798613507f9fe19734c4\icardie.dll
2009-03-08 10:31 . 2009-03-08 10:31 55296 —-a-w c:\798613507f9fe19734c4\msfeedsbs.dll
2009-03-08 10:31 . 2009-03-08 10:31 348160 —-a-w c:\798613507f9fe19734c4\dxtmsft.dll
2009-03-08 10:31 . 2009-03-08 10:31 216064 —-a-w c:\798613507f9fe19734c4\dxtrans.dll
2009-03-08 10:31 . 2009-03-08 10:31 34816 —-a-w c:\798613507f9fe19734c4\imgutil.dll
2009-03-08 10:31 . 2009-03-08 10:31 46592 —-a-w c:\798613507f9fe19734c4\pngfilt.dll
2009-03-08 10:31 . 2009-03-08 10:31 66560 —-a-w c:\798613507f9fe19734c4\mshtmled.dll
2009-03-08 10:31 . 2009-03-08 10:31 48128 —-a-w c:\798613507f9fe19734c4\mshtmler.dll
2009-03-08 10:31 . 2009-03-08 10:31 45568 —-a-w c:\798613507f9fe19734c4\mshta.exe
2009-03-08 10:31 . 2009-03-08 10:31 1638912 —-a-w c:\798613507f9fe19734c4\mshtml.tlb
2009-03-08 10:30 . 2009-03-08 10:30 66560 —-a-w c:\798613507f9fe19734c4\tdc.ocx
2009-03-08 10:24 . 2009-03-08 10:24 68608 —-a-w c:\798613507f9fe19734c4\hmmapi.dll
2009-03-08 10:22 . 2009-03-08 10:22 164352 —-a-w c:\798613507f9fe19734c4\ieui.dll
2009-03-08 10:22 . 2009-03-08 10:22 156160 —-a-w c:\798613507f9fe19734c4\msls31.dll
2009-03-08 10:15 . 2009-03-08 10:15 57667 —-a-w c:\798613507f9fe19734c4\ieuinit.inf
2009-03-08 10:11 . 2009-03-08 10:11 445952 —-a-w c:\798613507f9fe19734c4\ieapfltr.dll
2009-03-08 09:45 . 2009-03-08 09:45 460 —-a-w c:\798613507f9fe19734c4\install.ins
2009-02-21 07:21 . 2009-02-21 07:21 529818 —-a-w c:\798613507f9fe19734c4\iexplore.chm
2009-02-13 04:20 . 2009-02-13 04:20 5630 —-a-w c:\798613507f9fe19734c4\update\eula.rtf
2009-02-07 03:07 . 2009-02-07 03:07 3698584 —-a-w c:\798613507f9fe19734c4\ieapfltr.dat
2009-01-12 03:05 . 2009-01-12 03:05 2649 —-a-w c:\798613507f9fe19734c4\ie8props.propdesc
2009-01-12 03:05 . 2009-01-12 03:05 12593 —-a-w c:\798613507f9fe19734c4\ieeula.chm
2009-01-12 03:05 . 2009-01-12 03:05 13874 —-a-w c:\798613507f9fe19734c4\iesupp.chm
2009-01-08 00:21 . 2009-01-08 00:21 781 —-a-w c:\798613507f9fe19734c4\update\update.exe.manifest
2009-01-08 00:21 . 2009-01-08 00:21 1876 —-a-w c:\798613507f9fe19734c4\msfeeds.mof
2009-01-08 00:21 . 2009-01-08 00:21 1938 —-a-w c:\798613507f9fe19734c4\msfeedsbs.mof
2009-01-08 00:21 . 2009-01-08 00:21 121856 —-a-w c:\798613507f9fe19734c4\support\xmllite.dll
2009-01-08 00:21 . 2009-01-08 00:21 755744 —-a-w c:\798613507f9fe19734c4\update\update.exe
2009-01-08 00:21 . 2009-01-08 00:21 382496 —-a-w c:\798613507f9fe19734c4\update\updspapi.dll
2009-01-08 00:21 . 2009-01-08 00:21 26144 —-a-w c:\798613507f9fe19734c4\spupdsvc.exe
2009-01-08 00:20 . 2009-01-08 00:20 16928 —-a-w c:\798613507f9fe19734c4\spmsg.dll
2009-01-08 00:20 . 2009-01-08 00:20 231456 —-a-w c:\798613507f9fe19734c4\spuninst.exe
2009-01-08 00:20 . 2009-01-08 00:20 134144 —-a-w c:\798613507f9fe19734c4\sqmapi.dll
2009-01-08 00:20 . 2009-01-08 00:20 1022976 —-a-w c:\798613507f9fe19734c4\browseui.dll
2009-01-08 00:20 . 2009-01-08 00:20 1497088 —-a-w c:\798613507f9fe19734c4\shdocvw.dll
2009-01-08 00:20 . 2009-01-08 00:20 474112 —-a-w c:\798613507f9fe19734c4\shlwapi.dll
2009-01-08 00:20 . 2009-01-08 00:20 24576 —-a-w c:\798613507f9fe19734c4\support\nlsdl.dll
2009-01-08 00:20 . 2009-01-08 00:20 26112 —-a-w c:\798613507f9fe19734c4\support\idndl.dll
2009-01-08 00:20 . 2009-01-08 00:20 23552 —-a-w c:\798613507f9fe19734c4\support\normaliz.dll
2009-01-08 00:20 . 2009-01-08 00:20 59342 —-a-w c:\798613507f9fe19734c4\support\normidna.nls
2009-01-08 00:20 . 2009-01-08 00:20 45794 —-a-w c:\798613507f9fe19734c4\support\normnfc.nls
2009-01-08 00:20 . 2009-01-08 00:20 39284 —-a-w c:\798613507f9fe19734c4\support\normnfd.nls
2009-01-08 00:20 . 2009-01-08 00:20 66384 —-a-w c:\798613507f9fe19734c4\support\normnfkc.nls
2009-01-08 00:20 . 2009-01-08 00:20 60294 —-a-w c:\798613507f9fe19734c4\support\normnfkd.nls
2009-01-08 00:20 . 2009-01-08 00:20 19884 —-a-w c:\798613507f9fe19734c4\feeddisc.wav
2009-01-08 00:20 . 2009-01-08 00:20 23308 —-a-w c:\798613507f9fe19734c4\infobar.wav
2009-01-08 00:20 . 2009-01-08 00:20 11340 —-a-w c:\798613507f9fe19734c4\navstart.wav
2009-01-08 00:20 . 2009-01-08 00:20 85548 —-a-w c:\798613507f9fe19734c4\popupblk.wav
2009-01-08 00:20 . 2009-01-08 00:20 8798 —-a-w c:\798613507f9fe19734c4\icrav03.rat
2009-01-08 00:20 . 2009-01-08 00:20 65 —-a-w c:\798613507f9fe19734c4\occache.ini
2009-01-08 00:20 . 2009-01-08 00:20 1988 —-a-w c:\798613507f9fe19734c4\ticrf.rat
2009-01-08 00:20 . 2009-01-08 00:20 65 —-a-w c:\798613507f9fe19734c4\webcheck.ini
2009-01-08 00:20 . 2009-01-08 00:20 54279 —-a-w c:\798613507f9fe19734c4\ieakmmc.chm
2009-01-08 00:20 . 2009-01-08 00:20 265720 —-a-w c:\798613507f9fe19734c4\msdbg2.dll
2009-01-08 00:20 . 2009-01-08 00:20 355832 —-a-w c:\798613507f9fe19734c4\pdm.dll


((((((((((((((((((((((((((((( SnapShot@2009-04-15_02.31.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-15 03:06 . 2009-04-15 03:06 16384 c:\windows\Temp\Perflib_Perfdata_868.dat
+ 2004-08-10 12:00 . 2009-02-03 19:59 56832 c:\windows\system32\secur32.dll
+ 2004-08-10 12:00 . 2009-02-06 10:39 35328 c:\windows\system32\sc.exe
+ 2005-07-02 13:28 . 2009-04-15 03:10 78786 c:\windows\system32\perfc009.dat
- 2005-07-02 13:28 . 2009-03-16 00:17 78786 c:\windows\system32\perfc009.dat
+ 2004-08-10 12:00 . 2008-06-12 14:23 91648 c:\windows\system32\mtxoci.dll
- 2004-08-10 12:00 . 2008-04-14 00:12 91648 c:\windows\system32\mtxoci.dll
- 2004-08-10 12:00 . 2008-04-14 00:12 66560 c:\windows\system32\mtxclu.dll
+ 2004-08-10 12:00 . 2008-06-12 14:23 66560 c:\windows\system32\mtxclu.dll
+ 2004-08-10 12:00 . 2008-06-12 14:23 58880 c:\windows\system32\msdtclog.dll
- 2004-08-10 12:00 . 2008-04-14 00:11 58880 c:\windows\system32\msdtclog.dll
+ 2009-02-03 19:59 . 2009-02-03 19:59 56832 c:\windows\system32\dllcache\secur32.dll
+ 2004-08-10 12:00 . 2009-02-06 10:39 35328 c:\windows\system32\dllcache\sc.exe
+ 2008-06-12 14:23 . 2008-06-12 14:23 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2008-06-12 14:23 . 2008-06-12 14:23 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2008-06-12 14:23 . 2008-06-12 14:23 58880 c:\windows\system32\dllcache\msdtclog.dll
- 2009-04-04 06:59 . 2009-04-14 03:12 81984 c:\windows\system32\bdod.bin
+ 2009-04-04 06:59 . 2009-04-16 04:39 81984 c:\windows\system32\bdod.bin
- 2005-09-15 03:42 . 2009-03-11 09:02 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-04-15 02:51 . 2008-05-03 11:55 2560 c:\windows\system32\xpsp4res.dll
+ 2005-09-15 03:42 . 2009-04-15 02:55 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-04-15 03:10 . 2009-03-08 10:35 2048 c:\windows\ie8updates\KB968220-IE8\iecompat.dll
- 2004-08-10 12:00 . 2008-04-14 00:12 354304 c:\windows\system32\winhttp.dll
+ 2004-08-10 12:00 . 2008-12-16 12:30 354304 c:\windows\system32\winhttp.dll
+ 2004-08-10 12:00 . 2009-02-06 10:10 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2004-08-10 12:00 . 2009-02-09 12:10 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2004-08-10 12:00 . 2009-02-09 12:10 473600 c:\windows\system32\wbem\fastprox.dll
+ 2004-08-10 12:00 . 2009-02-06 11:11 110592 c:\windows\system32\services.exe
+ 2004-08-10 12:00 . 2009-02-09 12:10 401408 c:\windows\system32\rpcss.dll
- 2005-07-02 13:28 . 2009-03-16 00:17 463510 c:\windows\system32\perfh009.dat
+ 2005-07-02 13:28 . 2009-04-15 03:10 463510 c:\windows\system32\perfh009.dat
- 2004-08-10 12:00 . 2008-04-14 00:12 284160 c:\windows\system32\pdh.dll
+ 2004-08-10 12:00 . 2009-03-06 14:22 284160 c:\windows\system32\pdh.dll
+ 2004-08-11 02:00 . 2009-02-09 12:10 714752 c:\windows\system32\ntdll.dll
+ 2004-08-10 12:00 . 2008-06-12 14:23 161792 c:\windows\system32\msdtcuiu.dll
- 2004-08-10 12:00 . 2008-04-14 00:11 161792 c:\windows\system32\msdtcuiu.dll
- 2004-08-10 12:00 . 2008-04-14 00:11 956928 c:\windows\system32\msdtctm.dll
+ 2004-08-10 12:00 . 2008-06-12 14:23 956928 c:\windows\system32\msdtctm.dll
+ 2004-08-10 12:00 . 2008-06-12 14:23 428032 c:\windows\system32\msdtcprx.dll
+ 2004-08-10 12:00 . 2009-02-09 12:10 729088 c:\windows\system32\lsasrv.dll
+ 2004-08-10 12:00 . 2009-03-21 14:06 989696 c:\windows\system32\kernel32.dll
- 2004-08-10 12:00 . 2008-04-14 00:11 989696 c:\windows\system32\kernel32.dll
+ 2009-04-15 02:51 . 2008-04-21 12:08 215552 c:\windows\system32\dllcache\wordpad.exe
+ 2009-04-15 02:52 . 2009-02-06 10:10 227840 c:\windows\system32\dllcache\wmiprvse.exe
+ 2009-04-15 02:52 . 2009-02-09 12:10 453120 c:\windows\system32\dllcache\wmiprvsd.dll
+ 2008-12-16 12:30 . 2008-12-16 12:30 354304 c:\windows\system32\dllcache\winhttp.dll
+ 2009-04-15 02:52 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\services.exe
+ 2009-04-15 02:52 . 2009-02-09 12:10 401408 c:\windows\system32\dllcache\rpcss.dll
+ 2009-04-15 02:52 . 2009-03-06 14:22 284160 c:\windows\system32\dllcache\pdh.dll
+ 2009-04-15 02:52 . 2009-02-09 12:10 714752 c:\windows\system32\dllcache\ntdll.dll
+ 2008-06-12 14:23 . 2008-06-12 14:23 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2008-06-12 14:23 . 2008-06-12 14:23 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2008-06-12 14:23 . 2008-06-12 14:23 428032 c:\windows\system32\dllcache\msdtcprx.dll
+ 2009-04-15 02:52 . 2009-02-09 12:10 729088 c:\windows\system32\dllcache\lsasrv.dll
+ 2009-03-21 14:06 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\kernel32.dll
+ 2009-04-15 03:09 . 2009-02-28 04:55 105984 c:\windows\system32\dllcache\iecompat.dll
+ 2009-04-15 02:52 . 2009-02-09 12:10 473600 c:\windows\system32\dllcache\fastprox.dll
+ 2009-04-15 02:52 . 2009-02-09 12:10 617472 c:\windows\system32\dllcache\advapi32.dll
- 2004-08-10 12:00 . 2008-04-14 00:11 617472 c:\windows\system32\advapi32.dll
+ 2004-08-10 12:00 . 2009-02-09 12:10 617472 c:\windows\system32\advapi32.dll
- 2005-09-15 03:42 . 2009-03-11 09:02 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2005-09-15 03:42 . 2009-03-11 09:02 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2005-09-15 03:42 . 2009-04-15 02:55 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-04-15 03:10 . 2007-11-30 12:39 382840 c:\windows\ie8updates\KB968220-IE8\spuninst\updspapi.dll
+ 2009-04-15 03:10 . 2007-11-30 12:39 231288 c:\windows\ie8updates\KB968220-IE8\spuninst\spuninst.exe
+ 2004-08-10 12:00 . 2008-12-20 22:14 1288192 c:\windows\system32\quartz.dll
- 2004-08-10 12:00 . 2008-05-07 05:12 1288192 c:\windows\system32\quartz.dll
+ 2004-08-10 12:00 . 2009-02-06 11:06 2145280 c:\windows\system32\ntoskrnl.exe
- 2004-08-10 12:00 . 2008-08-14 10:09 2145280 c:\windows\system32\ntoskrnl.exe
- 2004-08-11 02:00 . 2008-08-14 09:33 2023936 c:\windows\system32\ntkrnlpa.exe
+ 2004-08-11 02:00 . 2009-02-06 10:32 2023936 c:\windows\system32\ntkrnlpa.exe
+ 2008-05-07 05:12 . 2008-12-20 22:14 1288192 c:\windows\system32\dllcache\quartz.dll
- 2008-05-07 05:12 . 2008-05-07 05:12 1288192 c:\windows\system32\dllcache\quartz.dll
+ 2008-10-15 00:57 . 2009-02-06 11:08 2189056 c:\windows\system32\dllcache\ntoskrnl.exe
- 2008-10-15 00:57 . 2008-08-14 09:33 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2008-10-15 00:57 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2008-10-15 00:57 . 2009-02-08 01:02 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2008-10-15 00:57 . 2008-08-14 09:33 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2008-10-15 00:57 . 2008-08-14 10:09 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-10-15 00:57 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-10-15 00:57 . 2009-02-06 11:08 2189056 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2008-10-15 00:57 . 2009-02-06 10:32 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2008-10-15 00:57 . 2008-08-14 09:33 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2008-10-15 00:57 . 2008-08-14 09:33 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-10-15 00:57 . 2009-02-08 01:02 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-10-15 00:57 . 2009-02-06 11:06 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
- 2008-10-15 00:57 . 2008-08-14 10:09 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2008-01-17 08:55 . 2009-04-06 14:57 24921544 c:\windows\system32\MRT.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2005-05-11 253952]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-09-14 50688]
"CocaCola Media Manager Tray"="c:\program files\Entriq\MediaSphere\Bin\EntriqMediaTray.exe" [2007-03-13 387152]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-15 778240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-02-23 69632]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" - c:\windows\arpwrmsg.exe [2005-08-03 77312]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-10-25 16855552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2009-01-21 172032]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
S2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-10-07 82696]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2009-03-08 266240]
S2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [2008-10-10 13088]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\DRIVERS\A3AB.sys [2007-05-23 547744]
S3 bdfm;bdfm;c:\windows\system32\drivers\bdfm.sys [2008-09-18 111112]
S3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\bdfndisf.sys [2009-02-12 104328]


— Other Services/Drivers In Memory —

*NewlyCreated* - 35F968BA
*NewlyCreated* - 6E331954
*Deregistered* - 35f968ba
*Deregistered* - 6e331954

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2009-04-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 18:34]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=Q405&bd;=pavilion&pf;=desktop&parm1;=seconduser
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
TCP: {F8711D3D-9D7D-4653-B38A-E02931182F9F} = 205.171.3.65,205.171.2.65
DPF: {38AB0814-B09B-4378-9940-14A19638C3C2} - hxxp://www.auctiva.com/Aurigma/ImageUploader55.cab
DPF: {C56BF45D-4722-4EFD-AA14-9DB1E92661E3} - hxxp://coke.mycokerewards.com/cabs/CocaCola_1_0_0_9.cab
FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\vl6og035.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?wl=true
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 22:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(876)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2740)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-16 22:51
ComboFix-quarantined-files.txt 2009-04-16 04:51
ComboFix2.txt 2009-04-15 02:37

Pre-Run: 213,190,365,184 bytes free
Post-Run: 213,225,697,280 bytes free

524
Post #13
——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Thursday, April 16, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Thursday, April 16, 2009 06:02:30 Records in database: 2049653 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Files scanned: 128106 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 04:21:00 No malware has been detected. The scan area is clean. The selected area was scanned.
Post #15
I've used that PC sparingly and have been disabling the network on it when not in use. Other than the odd message on shutdown about not being able to write to 0x00000000 still coming up, everything seems to be working ok.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI