Spyware / Malware / Virus Removal

[Resolved] HTL - Fun Trojan

24 min read

Looking for the outcome? Ask AI

Tomk

Post #31June 8, 2009, 2:43 AM UTC

Flyingfish,

So what is going on with the logs not being produced after a reboot scan? IS the virus doing that?

Probably.

Finding the rootkits was a good thing (if you can call a rootkit a good thing). I don't know why none of the Rootkit scanner could find it.

Let's get a scan on a couple versions of a file.

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

c:\windows\system32\drivers\tcpip.sys <===this file

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

Also please check this one: c:\windows\$NtServicePackUninstall$\tcpip.sys

Flyingfish

Post #32June 9, 2009, 12:06 AM UTC

Logs below~ Filename: tcpip.sys Status: Scan finished. 0 out of 21 scanners reported malware. Scan taken on: Tue 26 May 2009 19:53:43 (CET) Permalink Additional info File size: 361600 bytes Filetype: PE32 executable for MS Windows (native) Intel 80386 32-bit MD5: 9425b72f40257b45d45d24773273dad0 SHA1: 0668a9335026b7c84073bbef8ee2b9d19e80d335 Scanners [ArcaVir] 2009-05-26 Found nothing [F-Secure Anti-Virus] 2009-05-26 Found nothing [Emsisoft A-squared] 2009-05-26 Found nothing [Ikarus] 2009-05-26 Found nothing [Avast! antivirus] 2009-05-25 Found nothing [Kaspersky Anti-Virus] 2009-05-26 Found nothing [Grisoft AVG Anti-Virus] 2009-05-26 Found nothing [ESET NOD32] 2009-05-26 Found nothing [Avira AntiVir] 2009-05-26 Found nothing [Norman Virus Control] 2009-05-26 Found nothing [Softwin BitDefender] 2009-05-26 Found nothing [Panda Antivirus] 2009-05-26 Found nothing [ClamAV] 2009-05-26 Found nothing [Quick Heal] 2009-05-26 Found nothing [CPsecure] 2009-05-26 Found nothing [Sophos] 2009-05-26 Found nothing [Dr.Web] 2009-05-26 Found nothing [VirusBlokAda VBA32] 2009-05-25 Found nothing [Frisk F-Prot Antivirus] 2009-05-26 Found nothing [VirusBuster] 2009-05-26 Found nothing And I can't find the second one. c:\windows\$NtServicePackUninstall$\tcpip.sys Did searches in the windows folder, it's not there, unless it is hidden , and I can't view hidden files.

Tomk

Post #33June 9, 2009, 12:17 AM UTC

Flyingfish,

You did good. I was really only interested in the second one if something was found in the first one. It was clean so we don't care about the other one.

Combofix has been updated to a newer version. I'd like you to drag your copy to your recycle bin. Then please re-download and run just like you did originally. Because that was so far back, here are directions again (You probably won't receive any questions about recovery console because you've already installed it):

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Flyingfish

Post #34June 9, 2009, 3:38 AM UTC

Hey TomK,

One other annoyance I found is that I cannot drag and drop desktop items in the recycling bin. I can delete them, just can't drag and drop. The program will drop into the spot the bin was, and the bin moves to the side. Fun fun fun.

Here's the log:

ComboFix 09-06-08.03 - Dan 06/08/2009 22:09.9 - NTFSx86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))
.

2009-06-02 23:51 . 2009-06-07 17:08 ——– d—–w- c:\windows\system32\CatRoot2
2009-06-02 02:58 . 2009-06-02 02:58 ——– d—–w- c:\docume~1\Dan\APPLIC~1\AVG8
2009-05-27 10:46 . 2009-05-27 10:46 ——– d—–w- c:\documents and settings\All Users\Application Data\Comcast
2009-05-24 20:29 . 2009-04-06 20:32 15504 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-05-24 20:29 . 2009-04-06 20:32 38496 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-24 20:29 . 2009-05-24 20:31 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-05-20 01:58 . 2009-05-20 02:02 ——– d—–w- C:\Rooter$
2009-05-19 03:38 . 2009-05-19 03:38 ——– d—–w- c:\docume~1\Dan\APPLIC~1\Malwarebytes
2009-05-19 03:38 . 2009-05-19 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-19 03:19 . 2009-05-19 03:19 ——– d—–w- c:\program files\ERUNT
2009-05-17 00:39 . 2009-05-17 17:52 ——– d—–w- c:\program files\SpywareBlaster
2009-05-12 22:05 . 2009-05-12 22:08 ——– d—–w- c:\documents and settings\Angelina\Application Data\COMCASTTOOLBAR
2009-05-12 22:00 . 2009-05-12 22:00 ——– d—–w- c:\documents and settings\Angelina\Local Settings\Application Data\SupportSoft
2009-05-12 21:35 . 2009-05-12 21:33 2051864 —-a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 16:28 . 2008-04-29 12:11 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-05-17 02:10 . 2009-05-09 13:22 ——– d—–w- c:\docume~1\Dan\APPLIC~1\ComcastToolbar
2009-05-14 00:27 . 2008-04-29 12:13 ——– d—–w- c:\docume~1\Dan\APPLIC~1\AVGTOOLBAR
2009-05-12 22:24 . 2008-04-29 23:53 72280 —-a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-12 22:24 . 2008-04-29 23:53 72280 —-a-w- c:\docume~1\Dan\LOCALS~1\APPLIC~1\GDIPFONTCACHEV1.DAT
2009-05-09 13:22 . 2009-05-09 13:22 ——– d—–w- c:\program files\ComcastToolbar
2009-05-09 13:22 . 2006-01-05 16:50 ——– d—–w- c:\program files\Common Files\Scanner
2009-05-09 13:21 . 2009-05-09 13:21 ——– d—–w- c:\documents and settings\All Users\Application Data\SupportSoft
2009-05-09 13:20 . 2008-09-28 20:04 ——– d—–w- c:\program files\Common Files\SupportSoft
2009-05-09 13:20 . 2009-05-09 13:20 ——– d—–w- c:\program files\Comcast
2009-05-09 13:19 . 2008-09-28 20:04 ——– d—–w- c:\program files\support.com
2009-05-05 14:02 . 2008-10-08 15:26 ——– d—–w- c:\documents and settings\Angelina\Application Data\AVGTOOLBAR
2009-04-25 00:16 . 2009-04-25 00:16 ——– d—–w- c:\program files\Microsoft IntelliPoint
2009-04-25 00:15 . 2009-04-25 00:15 ——– d—–w- c:\program files\Microsoft IntelliType Pro
2009-04-23 13:15 . 2008-04-29 12:14 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-04-23 13:15 . 2007-10-15 23:16 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-04-23 13:15 . 2008-04-29 12:14 325896 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-04-23 13:15 . 2008-04-29 12:11 29208 —-a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-04-23 13:15 . 2008-04-29 12:11 50968 —-a-w- c:\windows\system32\avgfwdx.dll
2009-04-23 13:15 . 2008-04-29 12:14 12552 —-a-w- c:\windows\system32\drivers\avgrkx86.sys
2009-04-23 13:14 . 2008-04-29 12:14 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-04-18 20:05 . 2006-02-25 01:02 23808 —-a-w- c:\docume~1\Dan\APPLIC~1\wklnhst.dat
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w- c:\program files\iTunes
2009-04-12 00:58 . 2009-04-12 00:57 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-12 00:57 . 2009-04-12 00:57 ——– d—–w- c:\program files\iPod
2009-04-12 00:57 . 2008-01-02 03:36 ——– d—–w- c:\program files\Common Files\Apple
2009-04-12 00:49 . 2009-04-12 00:49 75048 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-11 15:14 . 2007-10-15 23:41 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-04-11 14:09 . 2009-04-11 13:57 ——– d—–w- c:\docume~1\Dan\APPLIC~1\Mozilla Firefox
2009-03-19 21:32 . 2009-03-19 21:32 23400 —-a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 21:32 . 2008-01-29 17:01 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell AIO Printer A940"="c:\program files\Dell AIO Printer A940\dlbabmgr.exe" [2003-06-25 294998]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-23 1947928]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-02-06 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-23 13:15 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"YOP"=c:\progra~1\Yahoo!\YOP\yop.exe /autostart
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" /hide
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"= c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\\Program Files\\Activision\\Star Trek Armada II\\Armada2.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"=
"c:\\Program Files\\Raven\\Star Trek Voyager Elite Force\\stvoyHM.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 bcbus;BestCrypt bus driver;c:\windows\system32\DRIVERS\bcbus.sys [x]
R2 NkPtpEnumP2;NkPtpEnumP2;c:\program files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe [2005-06-17 24064]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2009-04-23 12552]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-23 325896]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-23 108552]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-23 908568]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-23 298776]
S2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-04-23 1366904]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2009-04-23 29208]
S3 VBus;Virtual Bus;c:\windows\system32\DRIVERS\NkVBus.sys [2005-06-17 17664]

— Other Services/Drivers In Memory —

*Deregistered* - IPVNMon
.
Contents of the 'Scheduled Tasks' folder

2009-06-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-06-08 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]

2009-06-08 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]
.
.
——- Supplementary Scan ——-
.
mWindow Title = Windows Internet Explorer provided by Comcast
LSP: c:\windows\System32\VetRedir.dll
FF - ProfilePath - c:\docume~1\Dan\APPLIC~1\Mozilla\Firefox\Profiles\75p2ovg1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.chicagobears.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-08 22:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(948)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(1004)
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll

- - - - - - - > 'explorer.exe'(5836)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\System32\VetRedir.dll
c:\windows\system32\ISafeIf.dll
.
Completion time: 2009-06-09 22:22
ComboFix-quarantined-files.txt 2009-06-09 03:21
ComboFix2.txt 2009-06-07 17:20
ComboFix3.txt 2009-06-06 03:06
ComboFix4.txt 2009-05-23 19:52
ComboFix5.txt 2009-06-09 03:08

Pre-Run: 44,989,009,920 bytes free
Post-Run: 44,976,291,840 bytes free

172 — E O F — 2009-05-14 01:50

Tomk

Post #35June 9, 2009, 5:43 AM UTC

Flyingfish,

That looks better but there is obviously something still hiding that I'm not seeing.

Let's try this:

Please download RootRepeal to your desktop

Physically disconnect your machine from the internet as your system will be unprotected.
Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
Click the Report tab at the bottom and then the Scan button.
A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
The scan will take a little while to run, so let it go unhindered.
Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
Reconnect to the internet.
Post the log here in your reply.

Flyingfish

Post #36June 10, 2009, 2:29 AM UTC

Heya TomK, So I ran the report with all the options by mistake. I am not sure, I think it found something.

I think the IPVNMon.sys file came up before as something bad. I was also curious, I couldn't remember if this was addressed but just about every time combofix ran it always said that a file was trying to attach itself to combofix, C\programfiles\commonfiles\logishrd\LVMVFM\LVPrclnj.dll What is that file? If it is bad, was it removed? Also, why does CF always say it couldn't access personal settings b/c access is denied? Is that suppose to happen? Thanks for your help again! ROOTREPEAL © AD, 2007-2009 ================================================== Scan Time: 2009/06/09 21:00 Program Version: Version 1.3.0.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: catchme.sys Image Path: C:\WINDOWS\TEMP\catchme.sys Address: 0xF77ED000 Size: 31744 File Visible: No Signed: - Status: - Name: Combo-Fix.sys Image Path: Combo-Fix.sys Address: 0xF752D000 Size: 60416 File Visible: No Signed: - Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xED4F8000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7A93000 Size: 8192 File Visible: No Signed: - Status: - Name: PROCEXP90.SYS Image Path: C:\WINDOWS\system32\Drivers\PROCEXP90.SYS Address: 0xF7A8F000 Size: 6464 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xEC127000 Size: 49152 File Visible: No Signed: - Status: - SSDT ——————- #: 066 Function Name: NtDeviceIoControlFile Status: Hooked by "IPVNMon.sys" at address 0xf72f5803 ==EOF==

Tomk

Post #37June 10, 2009, 4:55 AM UTC

Flyingfish,

IPVNMon.sys is Visual IP InSight software. It usually comes from your ISP. Shouldn't be the cause of your problems.

LVPrclnj.dll is for your webcam.

Let's get a different look at the beast.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Flyingfish

Post #38June 11, 2009, 12:02 AM UTC

Here's da logs!

OTL logfile created on: 6/10/2009 6:52:22 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Dan\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: | Country: | Language: | Date Format:

1023.00 Mb Total Physical Memory | 587.13 Mb Available Physical Memory | 57.39% Memory free
2.41 Gb Paging File | 1.95 Gb Available in Paging File | 81.18% Paging File free
Paging file location(s): C:\pagefile.sys 0 0E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.46 Gb Total Space | 41.81 Gb Free Space | 56.15% Space Free | Partition Type: NTFS
Drive D: | 662.68 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FLYINGPLATYPUS
Current User Name: Dan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - [2003/06/25 10:32:48 | 00,303,104 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\LEXBCES.EXE
PRC - [2003/06/25 10:27:38 | 00,174,592 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\LEXPPS.EXE
PRC - [2009/03/06 00:04:30 | 00,132,424 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/04/23 08:14:06 | 00,298,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
PRC - [2009/04/23 08:14:15 | 01,366,904 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\PROGRA~1\AVG\AVG8\avgfws8.exe
PRC - [2008/12/12 12:17:38 | 00,238,888 | —- | M] (Apple Inc.) – C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [1999/12/13 02:01:00 | 00,044,032 | —- | M] (Creative Technology Ltd) – C:\WINDOWS\System32\CTsvcCDA.exe
PRC - [2002/05/22 11:52:06 | 00,022,016 | —- | M] (Inprise Corporation) – C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
PRC - [2009/01/03 10:40:19 | 00,152,984 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2007/10/19 13:17:28 | 00,186,904 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2009/04/23 08:15:27 | 00,833,304 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\PROGRA~1\AVG\AVG8\avgam.exe
PRC - [2009/05/12 16:33:09 | 00,486,680 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\PROGRA~1\AVG\AVG8\avgrsx.exe
PRC - [2003/11/12 14:46:34 | 00,049,152 | —- | M] (Dantz Development Corporation) – C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
PRC - [2003/12/10 22:09:34 | 00,046,592 | R— | M] (Dantz Development Corporation) – C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
PRC - [2008/04/24 13:26:18 | 00,202,560 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
PRC - [2000/06/26 08:44:20 | 00,053,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MsPMSPSv.exe
PRC - [2009/04/23 08:15:13 | 00,908,568 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\PROGRA~1\AVG\AVG8\avgemc.exe
PRC - [2006/10/18 21:05:24 | 00,913,408 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\WMPNetwk.exe
PRC - [2009/04/23 08:15:52 | 00,692,504 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgcsrvx.exe
PRC - [2002/05/22 11:52:06 | 01,701,888 | —- | M] (Inprise Corporation) – C:\Program Files\Borland\Interbase\Bin\IBServer.exe
PRC - [2007/10/19 13:17:28 | 00,186,904 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2008/04/13 19:12:19 | 01,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2009/04/23 08:14:34 | 00,594,712 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\PROGRA~1\AVG\AVG8\avgnsx.exe
PRC - [2008/04/13 19:12:41 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\wscntfy.exe
PRC - [2009/06/10 18:48:04 | 00,501,760 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Dan\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/03/06 00:04:30 | 00,132,424 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe – (Apple Mobile Device [Auto | Running])
SRV - [2008/07/25 11:16:40 | 00,034,312 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe – (aspnet_state [On_Demand | Stopped])
SRV - [2006/05/03 11:43:46 | 00,413,696 | —- | M] (ATI Technologies Inc.) – C:\WINDOWS\system32\Ati2evxx.exe – (Ati HotKey Poller [Auto | Stopped])
SRV - [2006/05/03 12:57:00 | 00,520,192 | —- | M] () – C:\WINDOWS\system32\ati2sgag.exe – (ATI Smart [Auto | Stopped])
SRV - [2009/04/23 08:15:13 | 00,908,568 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgemc.exe – (avg8emc [Auto | Running])
SRV - [2009/04/23 08:14:06 | 00,298,776 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgwdsvc.exe – (avg8wd [Auto | Running])
SRV - [2009/04/23 08:14:15 | 01,366,904 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgfws8.exe – (avgfws8 [Auto | Running])
SRV - [2008/12/12 12:17:38 | 00,238,888 | —- | M] (Apple Inc.) – C:\Program Files\Bonjour\mDNSResponder.exe – (Bonjour Service [Auto | Running])
SRV - File not found – – (CAISafe [Disabled | Stopped])
SRV - [2008/07/25 11:17:02 | 00,069,632 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [1999/12/13 02:01:00 | 00,044,032 | —- | M] (Creative Technology Ltd) – C:\WINDOWS\System32\CTsvcCDA.exe – (Creative Service for CDROM Access [Auto | Running])
SRV - [2008/07/29 21:10:04 | 00,046,104 | —- | M] (Microsoft Corporation) – c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe – (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2008/04/13 19:12:02 | 00,038,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll – (helpsvc [Auto | Running])
SRV - [2005/04/04 00:41:10 | 00,069,632 | —- | M] (Macrovision Corporation) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe – (IDriverT [On_Demand | Stopped])
SRV - [2008/07/29 19:24:50 | 00,881,664 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe – (idsvc [Unknown | Stopped])
SRV - [2002/05/22 11:52:06 | 00,022,016 | —- | M] (Inprise Corporation) – C:\Program Files\Borland\Interbase\Bin\IBGuard.exe – (InterBaseGuardian [Auto | Running])
SRV - [2002/05/22 11:52:06 | 01,701,888 | —- | M] (Inprise Corporation) – C:\Program Files\Borland\Interbase\Bin\IBServer.exe – (InterBaseServer [On_Demand | Running])
SRV - [2009/04/02 16:10:56 | 00,656,168 | —- | M] (Apple Inc.) – C:\Program Files\iPod\bin\iPodService.exe – (iPod Service [On_Demand | Stopped])
SRV - [2009/01/03 10:40:19 | 00,152,984 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\jqs.exe – (JavaQuickStarterService [Auto | Running])
SRV - [2003/06/25 10:32:48 | 00,303,104 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\LEXBCES.EXE – (LexBceS [Auto | Running])
SRV - [2007/10/19 13:17:28 | 00,186,904 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe – (LVCOMSer [Auto | Running])
SRV - [2007/10/19 13:19:22 | 00,141,848 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcSrv [Auto | Stopped])
SRV - [2007/10/19 13:21:16 | 00,141,848 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe – (LVSrvLauncher [Auto | Stopped])
SRV - [2008/07/29 19:16:38 | 00,132,096 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe – (NetTcpPortSharing [Disabled | Stopped])
SRV - [2005/06/17 12:11:00 | 00,024,064 | —- | M] (Nikon Corporation) – C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe – (NkPtpEnumP2 [Auto | Stopped])
SRV - [2003/11/12 14:46:34 | 00,049,152 | —- | M] (Dantz Development Corporation) – C:\Program Files\Dantz\Retrospect\retrorun.exe – (RetroLauncher [Auto | Running])
SRV - [2003/12/10 22:09:34 | 00,046,592 | R— | M] (Dantz Development Corporation) – C:\Program Files\Dantz\Retrospect\wdsvc.exe – (RetroWDSvc [Auto | Running])
SRV - [2008/04/24 13:26:18 | 00,202,560 | —- | M] (SupportSoft, Inc.) – C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe – (sprtsvc_ddoctorv2 [Auto | Running])
SRV - [2004/12/13 04:34:32 | 00,049,152 | —- | M] (Ulead Systems, Inc.) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe – (UleadBurningHelper [Disabled | Stopped])
SRV - File not found – – (VETMSGNT [Auto | Stopped])
SRV - [2000/06/26 08:44:20 | 00,053,520 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MsPMSPSv.exe – (WMDM PMSP Service [Auto | Running])
SRV - [2006/10/18 21:05:24 | 00,913,408 | —- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\WMPNetwk.exe – (WMPNetworkSvc [Auto | Running])
SRV - File not found – – (x10nets [On_Demand | Stopped])
SRV - [2003/05/19 17:07:38 | 00,086,016 | —- | M] (Yahoo! Inc.) – C:\WINDOWS\System32\YPcservice.exe – (YPCService [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2003/12/15 12:28:46 | 00,257,872 | —- | M] (Jungo) – C:\WINDOWS\system32\drivers\ATIRWVD.SYS – (ATI Remote Wonder II [On_Demand | Stopped])
DRV - [2006/05/03 11:50:42 | 01,540,608 | —- | M] (ATI Technologies Inc.) – C:\WINDOWS\system32\DRIVERS\ati2mtag.sys – (ati2mtag [On_Demand | Running])
DRV - [2009/04/23 08:15:41 | 00,029,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\DRIVERS\avgfwdx.sys – (Avgfwdx [On_Demand | Running])
DRV - [2009/04/23 08:15:41 | 00,029,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\system32\DRIVERS\avgfwdx.sys – (Avgfwfd [On_Demand | Stopped])
DRV - [2009/04/23 08:15:52 | 00,325,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\Drivers\avgldx86.sys – (AvgLdx86 [System | Running])
DRV - [2009/04/23 08:15:53 | 00,027,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\Drivers\avgmfx86.sys – (AvgMfx86 [System | Running])
DRV - [2009/04/23 08:15:39 | 00,012,552 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\Drivers\avgrkx86.sys – (AvgRkx86 [Boot | Running])
DRV - [2009/04/23 08:14:25 | 00,108,552 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\Drivers\avgtdix.sys – (AvgTdiX [System | Running])
DRV - [2003/08/28 18:58:40 | 00,004,272 | R— | M] () – C:\WINDOWS\System32\drivers\bvrp_pci.sys – (bvrp_pci [On_Demand | Stopped])
DRV - File not found – – (catchme [Disabled | Running])
DRV - [2003/09/22 08:48:06 | 00,130,192 | —- | M] (Creative Technology Ltd) – C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys – (ctsfm2k [On_Demand | Running])
DRV - [2003/07/31 04:21:00 | 00,084,576 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\drvmcdb.sys – (drvmcdb [Boot | Running])
DRV - [2003/06/20 03:56:00 | 00,040,448 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\drvnddm.sys – (drvnddm [Auto | Running])
DRV - [2005/06/13 13:58:04 | 00,162,816 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\DRIVERS\e100b325.sys – (E100B [On_Demand | Running])
DRV - [2008/04/13 13:45:29 | 00,010,624 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\DRIVERS\gameenum.sys – (gameenum [On_Demand | Running])
DRV - [2009/03/19 16:32:48 | 00,023,400 | —- | M] (GEAR Software Inc.) – C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys – (GEARAspiWDM [On_Demand | Running])
DRV - [2003/07/02 10:26:20 | 00,202,368 | —- | M] (Conexant Systems, Inc.) – C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys – (HSFHWBS2 [On_Demand | Running])
DRV - [2003/07/02 10:24:16 | 01,063,936 | —- | M] (Conexant Systems, Inc.) – C:\WINDOWS\System32\DRIVERS\HSF_DP.sys – (HSF_DP [On_Demand | Running])
DRV - [2006/11/22 18:13:22 | 00,016,024 | —- | M] (InterVideo, Inc.) – C:\WINDOWS\system32\drivers\iviaspi.sys – (Iviaspi [On_Demand | Running])
DRV - [2007/10/19 13:16:30 | 02,109,976 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\LVcKap.sys – (LVcKap [On_Demand | Stopped])
DRV - [2007/10/11 18:59:02 | 02,142,488 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys – (LVMVDrv [On_Demand | Stopped])
DRV - [2007/10/11 18:59:24 | 00,025,624 | —- | M] () – C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys – (LVPr2Mon [On_Demand | Running])
DRV - [2006/12/14 22:41:56 | 00,041,248 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\drivers\lvusbsta.sys – (LVUSBSta [On_Demand | Running])
DRV - [2004/04/13 20:20:08 | 00,015,781 | R— | M] (Meetinghouse Data Communications) – C:\WINDOWS\System32\DRIVERS\mdc8021x.sys – (MDC8021X [Auto | Running])
DRV - [2003/04/09 13:48:08 | 00,011,043 | —- | M] (Conexant) – C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys – (mdmxsdk [Auto | Running])
DRV - [2008/06/09 15:12:08 | 00,018,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\DRIVERS\NuidFltr.sys – (NuidFltr [On_Demand | Running])
DRV - [2001/08/22 09:42:58 | 00,013,632 | —- | M] (Dell Computer Corporation) – C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS – (OMCI [System | Running])
DRV - [2003/09/22 08:47:38 | 00,178,672 | —- | M] (Creative Technology Ltd.) – C:\WINDOWS\system32\DRIVERS\ctoss2k.sys – (ossrv [On_Demand | Running])
DRV - [2004/07/19 12:57:46 | 01,329,920 | —- | M] (Creative Technology Ltd.) – C:\WINDOWS\system32\drivers\P16X.sys – (P16X [On_Demand | Running])
DRV - [2006/12/14 22:36:26 | 00,014,240 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\lv302af.sys – (pepifilter [On_Demand | Stopped])
DRV - [2003/03/05 13:19:28 | 00,015,840 | —- | M] (Creative Technology Ltd.) – C:\WINDOWS\system32\drivers\PfModNT.sys – (PfModNT [Auto | Running])
DRV - [2006/12/14 22:36:38 | 00,936,864 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\DRIVERS\LV302V32.SYS – (PID_PEPI [On_Demand | Stopped])
DRV - [2008/06/10 15:04:26 | 00,031,048 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\DRIVERS\point32.sys – (Point32 [On_Demand | Running])
DRV - [2003/07/16 15:42:18 | 00,017,792 | —- | M] (Parallel Technologies, Inc.) – C:\WINDOWS\System32\DRIVERS\ptilink.sys – (Ptilink [On_Demand | Running])
DRV - [2007/07/26 18:06:18 | 00,043,528 | —- | M] (Sonic Solutions) – C:\WINDOWS\System32\DRIVERS\PxHelp20.sys – (PxHelp20 [Boot | Running])
DRV - [2007/11/13 05:25:53 | 00,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) – C:\WINDOWS\System32\DRIVERS\secdrv.sys – (Secdrv [Auto | Running])
DRV - [2003/07/14 12:28:40 | 00,005,621 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\sscdbhk5.sys – (sscdbhk5 [System | Running])
DRV - [2003/07/14 12:28:22 | 00,023,219 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\drivers\ssrtln.sys – (ssrtln [System | Running])
DRV - [2003/08/06 02:04:00 | 00,025,685 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsnboio.sys – (tfsnboio [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,034,837 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsncofs.sys – (tfsncofs [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,004,117 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsndrct.sys – (tfsndrct [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,002,233 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsndres.sys – (tfsndres [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,083,284 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsnifs.sys – (tfsnifs [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,014,229 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsnopio.sys – (tfsnopio [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,006,357 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsnpool.sys – (tfsnpool [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,098,068 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsnudf.sys – (tfsnudf [Auto | Running])
DRV - [2003/08/06 02:04:00 | 00,100,373 | —- | M] (Sonic Solutions) – C:\WINDOWS\system32\dla\tfsnudfa.sys – (tfsnudfa [Auto | Running])
DRV - [2009/03/05 23:59:00 | 00,036,864 | —- | M] (Apple, Inc.) – C:\WINDOWS\System32\Drivers\usbaapl.sys – (USBAAPL [On_Demand | Stopped])
DRV - [2008/04/13 13:45:12 | 00,060,032 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\usbaudio.sys – (usbaudio [On_Demand | Stopped])
DRV - [2005/06/17 12:11:00 | 00,017,664 | —- | M] (Nikon Corporation) – C:\WINDOWS\system32\DRIVERS\NkVBus.sys – (VBus [On_Demand | Running])
DRV - [2006/01/05 11:50:21 | 00,021,031 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\Vet-Filt.sys – (VET-FILT [System | Running])
DRV - [2006/01/05 11:50:21 | 00,015,478 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\Vet-Rec.sys – (VET-REC [System | Running])
DRV - [2007/07/23 09:15:19 | 00,108,360 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\VetEBoot.sys – (VETEBOOT [On_Demand | Running])
DRV - [2007/07/23 09:15:19 | 00,879,832 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\VetEFile.sys – (VETEFILE [System | Running])
DRV - [2006/01/05 11:50:21 | 00,015,735 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\VetFDDNT.sys – (VETFDDNT [System | Running])
DRV - [2006/07/31 17:15:47 | 00,026,787 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetmonnt.sys – (VETMONNT [System | Running])
DRV - [2003/07/02 10:25:24 | 00,631,680 | —- | M] (Conexant Systems, Inc.) – C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys – (winachsf [On_Demand | Running])
DRV - [2004/09/07 19:57:00 | 00,316,152 | —- | M] (Jungo) – C:\WINDOWS\system32\drivers\windrvr6.sys – (WinDriver6 [On_Demand | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/customize/…/search/ie.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\PROGRAM FILES\AVG\AVG8\FIREFOX [2009/04/24 07:23:22 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1d5287d1-8a92-0001-1f31-1cec198018d8}: C:\PROGRAM FILES\AVG\AVG8\TOOLBARFF [2009/04/24 07:23:22 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/01/03 10:40:21 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{4709ABB0-C3AC-40CC-8A0E-43548CB45C51}: C:\DOCUMENTS AND SETTINGS\ANGELINA\LOCAL SETTINGS\APPLICATION DATA\{4709ABB0-C3AC-40CC-8A0E-43548CB45C51} [2009/03/10 12:07:24 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{8F59A367-5FAA-4565-B28B-18FCC0DDFB7D}: C:\DOCUMENTS AND SETTINGS\DAN\LOCAL SETTINGS\APPLICATION DATA\{8F59A367-5FAA-4565-B28B-18FCC0DDFB7D} [2009/03/10 18:59:12 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009/03/28 11:45:54 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/30 07:41:18 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/30 07:41:18 | 00,000,000 | —D | M]

[2009/04/16 07:52:29 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/04/30 07:41:18 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/04/30 07:41:08 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/30 07:41:08 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/03/26 13:56:22 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/03/26 13:56:22 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/03/26 13:56:22 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/03/26 13:56:22 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/03/26 13:56:22 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/03/26 13:56:22 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/03/26 13:56:22 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll (Comcast Cable Communications. )
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVGTOOLBAR) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Comcast Toolbar) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\Program Files\ComcastToolbar\comcasttoolbar.dll (Comcast Cable Communications. )
O3 - HKLM\..\Toolbar: (AVGTOOLBAR) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program Files\AVG\AVG8\avgtoolbar.dll (AVG Technologies CZ, s.r.o.)
O3 - HKLM\..\Toolbar: (no name) - SITEguard - Reg Error: Key error. File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe File not found
O4 - HKLM..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2 (SupportSoft, Inc.)
O4 - HKLM..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe" (Dell Computer Corporation)
O4 - HKLM..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" (Microsoft Corporation)
O4 - HKLM..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide ()
O4 - HKLM..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe (Microsoft® Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk.disabled ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuPinnedList = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LockTaskbar = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoComputersNearMe = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoMovingBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCloseDragDropBands = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: Wallpaper=- =
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WallPaperStyle=- =
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O15 - HKLM\..Trusted Domains: 50 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\system32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/01/05 00:57:15 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2007/08/14 11:32:04 | 00,000,000 | R–D | M] - D:\Autorun – [ CDFS ]
O32 - AutoRun File - [2007/06/14 18:23:01 | 00,263,744 | R— | M] (Firaxis Games) - D:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2007/07/17 12:11:01 | 00,006,299 | R— | M] () - D:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/10 18:48:04 | 00,000,000 | —D | M]

========== Files/Folders - Created Within 30 Days ==========

[4 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/06/10 18:41:45 | 00,000,000 | —D | C] – C:\WINDOWS\LastGood
[2009/06/09 08:17:47 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/06/07 11:44:26 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/06/05 20:56:21 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/06/05 20:56:21 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/06/05 20:56:21 | 00,155,136 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/06/05 20:56:21 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/06/05 20:56:21 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/06/05 20:56:21 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/06/05 20:56:21 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/06/02 18:51:03 | 00,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2
[2009/05/27 05:46:14 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Comcast
[2009/05/24 15:29:16 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/24 15:29:15 | 00,015,504 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/05/24 15:29:12 | 00,038,496 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/24 15:29:11 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/05/22 18:36:14 | 00,251,183 | —- | C] () – C:\Documents and Settings\Dan\My Documents\index.asp.htm
[2009/05/20 20:38:02 | 00,000,211 | —- | C] () – C:\Boot.bak
[2009/05/20 20:37:57 | 00,260,272 | —- | C] () – C:\cmldr
[2009/05/20 20:37:52 | 00,000,000 | RHSD | C] – C:\cmdcons
[2009/05/20 20:30:57 | 00,000,000 | —D | C] – C:\Qoobox
[2009/05/19 20:58:20 | 00,000,000 | —D | C] – C:\Rooter$
[2009/05/18 22:38:16 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/05/18 22:21:10 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/05/18 22:19:22 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/05/17 12:53:26 | 00,000,000 | —D | C] – C:\Config.Msi
[2009/05/16 19:39:36 | 00,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2009/05/13 21:14:35 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/05/13 19:07:20 | 00,000,642 | —- | C] () – C:\Documents and Settings\Dan\My Documents\reistry 2.reg
[2009/05/13 19:06:28 | 00,000,720 | —- | C] () – C:\Documents and Settings\Dan\My Documents\registry.reg
[2009/05/13 07:35:42 | 00,000,000 | —D | C] – C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia
[2009/05/12 19:46:17 | 00,001,781 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Logitech QuickCam.lnk
[2009/05/12 15:09:48 | 00,000,003 | —- | C] () – C:\Documents and Settings\All Users\Application Data\os60256249.ini
[2009/05/12 15:09:46 | 00,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\90246246.ini
[2008/07/26 11:25:01 | 00,000,165 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2008/06/10 19:07:20 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/06/10 19:03:26 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/06/10 19:03:26 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/05/22 17:18:54 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/03/21 11:03:58 | 00,001,070 | —- | C] () – C:\WINDOWS\EF.ini
[2007/12/22 18:00:48 | 00,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2007/10/11 18:59:24 | 00,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2007/08/12 22:52:22 | 00,000,058 | —- | C] () – C:\WINDOWS\tutorial.INI
[2007/08/10 18:17:47 | 00,000,173 | —- | C] () – C:\WINDOWS\srlink.ini
[2007/08/10 18:17:47 | 00,000,040 | —- | C] () – C:\WINDOWS\System32\sx96.ini
[2007/08/10 18:15:33 | 00,021,504 | —- | C] () – C:\WINDOWS\System32\docobj.dll
[2007/02/22 23:08:38 | 00,048,205 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2007/01/26 18:53:15 | 00,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2006/03/11 23:29:56 | 00,000,750 | —- | C] () – C:\WINDOWS\Sfc3ng.ini
[2006/02/24 18:32:36 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/02/20 23:32:36 | 00,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/01/25 01:09:43 | 00,000,000 | —- | C] () – C:\WINDOWS\ATIMMC.INI
[2006/01/21 17:16:43 | 00,002,572 | —- | C] () – C:\WINDOWS\MIXDEF.INI
[2006/01/21 01:15:38 | 00,001,008 | —- | C] () – C:\WINDOWS\STA2.ini
[2006/01/05 12:17:01 | 00,000,325 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/01/05 11:59:13 | 00,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2006/01/05 11:58:58 | 00,002,516 | —- | C] () – C:\WINDOWS\System32\P16X.ini
[2006/01/05 11:58:58 | 00,000,026 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2006/01/05 11:58:57 | 00,065,536 | —- | C] ( ) – C:\WINDOWS\System32\A3d.dll
[2006/01/05 11:58:57 | 00,047,616 | —- | C] () – C:\WINDOWS\System32\P16X.dll
[2006/01/05 11:58:54 | 00,000,064 | —- | C] () – C:\WINDOWS\P16x.ini
[2006/01/05 11:58:07 | 00,000,245 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2006/01/05 02:16:03 | 00,000,595 | —- | C] () – C:\WINDOWS\DELLSTAT.INI
[2006/01/05 02:15:48 | 00,040,960 | —- | C] () – C:\WINDOWS\System32\dlbavs.dll
[2006/01/05 02:15:30 | 00,000,177 | —- | C] () – C:\WINDOWS\System32\dlbacoin.ini
[2006/01/05 01:58:10 | 00,004,272 | R— | C] () – C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2006/01/05 01:27:07 | 00,065,536 | —- | C] () – C:\WINDOWS\System32\YCRWin32.dll
[2005/03/01 15:30:20 | 00,000,453 | —- | C] () – C:\WINDOWS\bdoscandellang.ini
[2004/01/28 12:42:06 | 00,013,601 | —- | C] () – C:\WINDOWS\System32\vctest.ini
[2003/11/20 16:39:58 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/07/16 15:51:23 | 00,000,556 | —- | C] () – C:\WINDOWS\win.ini
[2003/07/16 15:47:28 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini
[2003/07/14 14:30:28 | 00,197,120 | —- | C] () – C:\WINDOWS\patchw32.dll

========== Files - Modified Within 30 Days ==========

[4 C:\WINDOWS\System32\*.tmp files]
[1 C:\WINDOWS\*.tmp files]
[2009/06/10 18:40:26 | 37,028,844 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/06/10 18:40:26 | 00,071,058 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/06/10 18:38:49 | 00,000,368 | —- | M] () – C:\WINDOWS\tasks\RegCure.job
[2009/06/10 17:00:04 | 00,000,434 | —- | M] () – C:\WINDOWS\tasks\RegCure Program Check.job
[2009/06/08 22:22:42 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/06/08 22:18:03 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/06/08 08:10:10 | 00,155,136 | —- | M] () – C:\WINDOWS\PEV.exe
[2009/06/07 12:03:06 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2009/06/07 11:59:10 | 00,001,781 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Logitech QuickCam.lnk
[2009/06/07 11:55:52 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/06 19:47:03 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/06/06 17:00:41 | 00,000,595 | —- | M] () – C:\WINDOWS\DELLSTAT.INI
[2009/06/02 18:54:04 | 00,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2009/06/02 18:54:04 | 00,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2009/05/24 15:29:16 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/05/22 18:36:14 | 00,251,183 | —- | M] () – C:\Documents and Settings\Dan\My Documents\index.asp.htm
[2009/05/20 20:38:02 | 00,000,281 | RHS- | M] () – C:\boot.ini
[2009/05/18 22:10:31 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/05/16 19:01:08 | 00,308,276 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090517-222645.backup
[2009/05/13 21:17:23 | 00,000,556 | —- | M] () – C:\WINDOWS\win.ini
[2009/05/13 21:17:23 | 00,000,211 | —- | M] () – C:\Boot.bak
[2009/05/13 19:41:47 | 00,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2009/05/13 19:07:20 | 00,000,642 | —- | M] () – C:\Documents and Settings\Dan\My Documents\reistry 2.reg
[2009/05/13 19:06:28 | 00,000,720 | —- | M] () – C:\Documents and Settings\Dan\My Documents\registry.reg
[2009/05/13 17:54:21 | 00,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/05/12 22:16:54 | 00,308,276 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090516-190108.backup
[2009/05/12 19:32:05 | 00,000,325 | —- | M] () – C:\WINDOWS\wininit.ini
[2009/05/12 17:33:34 | 00,308,276 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20090512-221654.backup
[2009/05/12 16:21:22 | 00,000,062 | -HS- | M] () – C:\Documents and Settings\Dan\Local Settings\desktop.ini
[2009/05/12 15:29:53 | 00,000,003 | —- | M] () – C:\Documents and Settings\All Users\Application Data\os60256249.ini
[2009/05/12 15:09:46 | 00,000,000 | —- | M] () – C:\Documents and Settings\All Users\Application Data\90246246.ini
[2009/05/11 22:46:00 | 00,501,230 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/05/11 22:46:00 | 00,441,124 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/05/11 22:46:00 | 00,071,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== LOP Check ==========

[2009/06/06 19:47:03 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2003/07/16 15:36:49 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/06/10 17:00:04 | 00,000,434 | —- | M] () – C:\WINDOWS\Tasks\RegCure Program Check.job
[2009/06/10 18:38:49 | 00,000,368 | —- | M] () – C:\WINDOWS\Tasks\RegCure.job
[2009/06/08 22:22:42 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

Flyingfish

Post #39June 11, 2009, 12:03 AM UTC

Long Logs v2

OTL Extras logfile created on: 6/10/2009 6:52:22 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Dan\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: | Country: | Language: | Date Format:

1023.00 Mb Total Physical Memory | 587.13 Mb Available Physical Memory | 57.39% Memory free
2.41 Gb Paging File | 1.95 Gb Available in Paging File | 81.18% Paging File free
Paging file location(s): C:\pagefile.sys 0 0E:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.46 Gb Total Space | 41.81 Gb Free Space | 56.15% Space Free | Partition Type: NTFS
Drive D: | 662.68 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FLYINGPLATYPUS
Current User Name: Dan
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
"EnableFirewall" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008/04/13 13:53:32 | 00,558,080 | —- | M] (Microsoft Corporation) – %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2007/03/27 15:22:58 | 00,091,640 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Messenger\yserver.exe:*:Enabled:Yahoo! FT Server
[2003/06/25 10:27:38 | 00,174,592 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\system32\LEXPPS.EXE:*:Disabled:LEXPPS.EXE
[2007/05/16 23:52:50 | 11,739,782 | —- | M] (Firaxis Games) – C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4
[2002/01/21 16:15:02 | 03,637,293 | —- | M] (Activision) – C:\Program Files\Activision\Star Trek Armada II\Armada2.exe:*:Disabled:Star Trek Armada 2
[2007/03/27 15:22:56 | 04,670,968 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger
[2008/04/13 13:53:32 | 00,558,080 | —- | M] (Microsoft Corporation) – %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000
[2006/11/03 02:17:27 | 00,010,800 | —- | M] (AOL LLC) – C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader
[2007/08/14 12:09:20 | 14,092,712 | —- | M] (Firaxis Games) – C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:*:Enabled:Sid Meier's Civilization 4 Beyond the Sword
[2007/08/08 16:08:34 | 11,621,688 | —- | M] (Firaxis Games) – C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Beyond the Sword Pitboss
[2000/08/17 17:37:44 | 00,921,600 | —- | M] () – C:\Program Files\Raven\Star Trek Voyager Elite Force\stvoyHM.exe:*:Disabled:stvoyHM
[2009/05/12 16:30:43 | 01,085,208 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe
[2009/04/23 08:15:13 | 00,908,568 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe
[2009/04/23 08:14:34 | 00,594,712 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe
[2008/12/12 12:17:38 | 00,238,888 | —- | M] (Apple Inc.) – C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
[2009/04/02 16:10:58 | 13,646,632 | —- | M] (Apple Inc.) – C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02F6993D-B763-4F40-8F93-2A9CD97586E3}" = Microsoft IntelliType Pro 6.3
"{04410044-9149-45C6-A806-F2BF9CFCE762}" = Microsoft Encarta Encyclopedia Standard 2004
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{0EE11800-A1BD-11D3-BFEB-005004AF2D32}" = Risk II
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{176B3593-72F1-459C-829C-5E9671E2CB35}" = GameSpy Comrade
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1D643CD7-4DD6-11D7-A4E0-000874180BB3}" = Microsoft Money 2004
"{1EECBA68-8BE4-4076-94DF-E9ED206B1D21}" = Star Wars Jedi Knight Jedi Academy
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{32E4F0D2-C135-475E-A841-1D59A0D22989}" = Sid Meier's Civilization 4 - Beyond the Sword
"{3347F781-9C89-4C9B-B471-B1FFC3BC4A84}" = ATIRW2
"{33BEE6F3-9987-4F98-A069-97A64EC8321A}" = Microsoft Works Suite Add-in for Microsoft Word
"{34F0D55F-C386-4195-9A5B-961D3F6ACD46}" = InterVideo MediaOne Gallery
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{3B0F52AC-EF5C-4831-B221-06C782E41280}" = Quicken 2008
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{410438A3-B591-4028-B70A-3CC0B33FBCD1}" =
"{4468EF97-A253-4699-9E1C-88CAE2C6832D}" = ABBYY FineReader 5.0 Sprint
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{526E0B09-1C4D-11D5-9D16-0050DA1AA1B3}" = Dominion Wars
"{54AE3C08-D7D8-45FF-9348-0B4BE0D5A6CB}" = Comcast Universal Installer v1.2
"{5E835305-63BB-4E55-BBB7-EEBBE67774DB}" = Sonic MyDVD
"{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes
"{634EC9A4-FEF1-11D7-A65F-18181164CC00}" = BalanceLog
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6675E71B-9843-4971-BC15-18AB52801134}" = Dragon NaturallySpeaking 7.3
"{66A9D30D-1464-4C7F-B2F3-507DADAF2595}" = Microsoft IntelliPoint 6.3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B69C5C-87D6-471E-B695-0BD736C4B644}" = Retrospect 6.5
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{8704D51E-25B7-4F23-81E7-AA4F54790210}" = Microsoft Streets and Trips 2004
"{8988F5D0-C83F-41F4-B41B-86031F9B37F5}" = ATI Multimedia Center
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C64E145-54BA-11D6-91B1-00500462BE80}" = Microsoft Money 2004 System Pack
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{945AC98B-3DC8-45BE-BAE0-22CEEE37A103}" = Logitech QuickCam
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{96E16100-A77F-4B31-B9AD-FFBA040EE1BD}" = Sound Blaster Live!
"{A14C24F6-615B-415E-84B0-610FDAD19B68}" = MobileMe Control Panel
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5F68DC8-0278-4AD8-B413-861509B5F25B}" = ArcSoft Panorama Maker 3
"{A8589680-35C1-4732-ACCA-09B78921ECE3}" = Sid Meier's Civilization 4
"{AA0A1531-C625-4B1D-A3FA-273A181B017B}" = Wireless Camera Setup Utility
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B9966F27-9678-4620-9579-925E3084647E}" = Microsoft Works
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BEF726DD-4037-4214-8C6A-E625C02D2870}" = Logitech Audio Echo Cancellation Component
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}" = Safari
"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Photo Premium 9
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
"{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}" = ATI Catalyst Control Center
"{F45298E5-0083-426F-A668-1A2C5F04B8A0}" = FaxTools
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"2Wire SetupWiz" = SBC Yahoo! DSL Home Networking Installer
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"AudibleManager" = AudibleManager
"AVG8Uninstall" = AVG 8.5
"CNXT_MODEM_PCI_VEN_14F1&DEV_2702" = Conexant SmartHSFi V.9x 56K DF PCI Modem
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"ComcastToolbar" = Comcast Toolbar
"Continuum_is1" = Continuum 0.40
"Dell AIO Printer A940" = Dell AIO Printer A940
"Digital Camera Driver" = Digital Camera Driver
"ERUNT_is1" = ERUNT 1.1j
"HijackThis" = HijackThis 2.0.2
"Homeworld2" = Homeworld2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{3347F781-9C89-4C9B-B471-B1FFC3BC4A84}" = ATI Remote Wonder 2.3
"InstallShield_{8988F5D0-C83F-41F4-B41B-86031F9B37F5}" = ATI Multimedia Center 9.01
"legacyqcam_10.50" = Logitech Legacy USB Camera Driver Package
"lvdrivers_11.50" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"NewWrlds" = NewWrlds
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PictureIt_v9" = Microsoft Picture It! Photo Premium 9
"PictureProject In Touch Downloader" = PictureProject In Touch Downloader 1.0
"PROSet" = Intel® PRO Network Connections Drivers
"RegCure" = RegCure 1.5.0.1
"Shockwave" = Shockwave
"SpywareBlaster_is1" = SpywareBlaster v2.5.2
"Star Trek Armada II" = Star Trek Armada II
"Star Trek Starfleet Command III" = Star Trek Starfleet Command III
"Star Trek Voyager Elite Force" = Star Trek Voyager Elite Force
"Starcraft" = Starcraft
"The Sudoku Challenge-retail" = The Sudoku Challenge
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works2004Setup" = Microsoft Works 2004 Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Yahoo! Applications" = AT&T Yahoo! Applications
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! IE Suggest" = Yahoo! IE Search Suggest
"Yahoo! Toolbar" = Yahoo! Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/24/2009 1:21:18 AM | Computer Name = FLYINGPLATYPUS | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16827, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/24/2009 1:21:50 AM | Computer Name = FLYINGPLATYPUS | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16827, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/24/2009 5:11:58 PM | Computer Name = FLYINGPLATYPUS | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.4030.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 5/24/2009 5:12:04 PM | Computer Name = FLYINGPLATYPUS | Source = Microsoft Office 10 | ID = 1000
Description = Faulting application winword.exe, version 10.0.4030.0, faulting module
winword.exe, version 10.0.4030.0, fault address 0x0005b3bf.

Error - 5/25/2009 12:39:00 PM | Computer Name = FLYINGPLATYPUS | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/6/2009 9:14:28 AM | Computer Name = FLYINGPLATYPUS | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16827, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/6/2009 9:14:47 AM | Computer Name = FLYINGPLATYPUS | Source = Application Hang | ID = 1001
Description = Fault bucket 1203548446.

Error - 6/6/2009 10:10:11 AM | Computer Name = FLYINGPLATYPUS | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/6/2009 10:10:13 AM | Computer Name = FLYINGPLATYPUS | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 6/6/2009 10:15:33 AM | Computer Name = FLYINGPLATYPUS | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

[ System Events ]
Error - 6/7/2009 1:03:08 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

Error - 6/7/2009 1:07:47 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/7/2009 1:08:02 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7034
Description = The NkPtpEnumP2 service terminated unexpectedly. It has done this
1 time(s).

Error - 6/7/2009 1:08:52 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 6/7/2009 1:09:28 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

Error - 6/7/2009 1:16:04 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

Error - 6/7/2009 1:16:05 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

Error - 6/8/2009 11:09:44 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

Error - 6/8/2009 11:17:57 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

Error - 6/8/2009 11:17:58 PM | Computer Name = FLYINGPLATYPUS | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the PEVSystemStart service
to connect.

< End of report >

Flyingfish

Post #40June 11, 2009, 12:06 AM UTC

Thanks TomK for the explanation of those processes. I was reaaaalllllllllllllllllly close. So far we've got nothing then? Why is this one so hard to find? Is it common they are this difficult? ~~Flyingfish

Tomk

Post #41June 11, 2009, 12:43 AM UTC

Flyingfish,

So far we've got nothing then? Why is this one so hard to find? Is it common they are this difficult?

Luckily they are not usually this hard. If they were, I'd have had to find a new hobby long ago.

A few things showing but I don't think they are going to resolve your issues.

Your Java is out of date and you have other old versions still on your computer, those old versions are now a security vulnerability:

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer - Version 6 update 14

Double click on OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Processes
explorer.exe

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/customize/.../search/ie.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)

:Files
C:\Documents and Settings\Dan\My Documents\reistry 2.reg
C:\Documents and Settings\Dan\My Documents\registry.reg
C:\Documents and Settings\All Users\Application Data\os60256249.ini
C:\Documents and Settings\All Users\Application Data\90246246.ini

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL2 log and a new HJT log.

Then let's try a tool we haven't thrown at it yet.

Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual user account.
Open the SDFix folder and double click on RunThis.bat to start the script.
Type Y and press Enter to begin the script.
It will start cleaning your PC and then prompt you to press any key to Reboot.
Press any key to restart the PC.
Your system will take longer than normal to restart as the fixtool will be removing files.
When the desktop loads the Fixtool will complete the removal and display Finished.
Press any key to end the script and to load your desktop icons.
A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log

Flyingfish

Post #42June 11, 2009, 1:57 AM UTC

Hi, I thought I'd post the first set of logs and then run the last scan. I think I ran this next on once with Indi. I encountered a problem when trying to load the new version of JAVA. I was able to uninstall it, although there was an error at the end and the program closed. I then tried to rerun the uninstaller and it said it was already uninstalled. So i went to Dl the new version and everything set up okay but then for the DL it would connect, start to DL, then stop/disconnect, and repeat. I tried it several times but it won't DL the program. IE cannot DL programs anymore since the virus, but I was using FF.

LOgs.

========== PROCESSES ==========
Process explorer.exe killed successfully!
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\CustomSearch| /E : value set successfully!
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
========== FILES ==========
C:\Documents and Settings\Dan\My Documents\reistry 2.reg moved successfully.
C:\Documents and Settings\Dan\My Documents\registry.reg moved successfully.
C:\Documents and Settings\All Users\Application Data\os60256249.ini moved successfully.
C:\Documents and Settings\All Users\Application Data\90246246.ini moved successfully.
========== COMMANDS ==========
File delete failed. C:\WINDOWS\Temp\06a543e6-b591-408e-979f-4c66e67065bb.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\0b141821-7bfa-41d2-a0a5-39c013560dd4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\1355a1b2-0ff8-4df0-b1c0-ca797cf4f6e0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\413126e9-ed64-4853-9adf-757179dafac4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\48afa479-48a5-431d-8538-0bbe9201e3dc.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\5c3773c7-66a2-4308-bf84-a754bc2923e5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\643248f2-e32f-4234-abf3-834e2fb5d6c6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\8403b0dc-ac6e-4364-95f6-abf1e0004440.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\8e020120-de06-492c-bba6-0d914712df1c.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\9fe12a57-2279-41b1-b3ac-79d8d440cde8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\abb7eea4-24ae-4e16-869d-d3b2400599a3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\abe054b1-9d3e-4e60-a79c-51a8740909bd.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\bebabb0b-9828-414a-9e05-19b4d163e1f9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\c19c34a0-afbb-4dd4-8c79-a3c4774a77ae.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\dd42b69f-859e-4781-827f-b7f10d0e0075.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\dd64a97a-9a31-49a4-895a-57453eb90229.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\e5723078-0b3d-45b2-9eff-e0dfebde2c81.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\e78e09b3-12d1-42a4-bd96-5239e1bfd108.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\f091a2ff-ea18-4fb4-b920-370124270efa.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\f62b6b00-75e8-496a-aca7-664972f03905.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\fb10bba7-06b2-44fe-ac84-0552ead85aa1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\fb7c8146-25f0-4941-bfc6-d8217db45de6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\fbf6f362-5667-4844-b66f-0e031a9cb0d8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\Temp\Perflib_Perfdata_100.dat scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\06a543e6-b591-408e-979f-4c66e67065bb.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\0b141821-7bfa-41d2-a0a5-39c013560dd4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\1355a1b2-0ff8-4df0-b1c0-ca797cf4f6e0.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\413126e9-ed64-4853-9adf-757179dafac4.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\48afa479-48a5-431d-8538-0bbe9201e3dc.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\5c3773c7-66a2-4308-bf84-a754bc2923e5.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\643248f2-e32f-4234-abf3-834e2fb5d6c6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\8403b0dc-ac6e-4364-95f6-abf1e0004440.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\8e020120-de06-492c-bba6-0d914712df1c.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\9fe12a57-2279-41b1-b3ac-79d8d440cde8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\abb7eea4-24ae-4e16-869d-d3b2400599a3.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\abe054b1-9d3e-4e60-a79c-51a8740909bd.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\bebabb0b-9828-414a-9e05-19b4d163e1f9.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\c19c34a0-afbb-4dd4-8c79-a3c4774a77ae.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\dd42b69f-859e-4781-827f-b7f10d0e0075.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\dd64a97a-9a31-49a4-895a-57453eb90229.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\e5723078-0b3d-45b2-9eff-e0dfebde2c81.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\e78e09b3-12d1-42a4-bd96-5239e1bfd108.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\f091a2ff-ea18-4fb4-b920-370124270efa.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\f62b6b00-75e8-496a-aca7-664972f03905.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\fb10bba7-06b2-44fe-ac84-0552ead85aa1.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\fb7c8146-25f0-4941-bfc6-d8217db45de6.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\fbf6f362-5667-4844-b66f-0e031a9cb0d8.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_100.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Temp folders emptied.
Explorer started successfully

OTL by OldTimer - Version 2.1.1.0 log created on 06102009_204051

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:19 PM, on 6/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Borland\Interbase\Bin\IBServer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\RunOnce: "C:\Documents and Settings\Dan\Desktop\OTL.exe"
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

–
End of file - 8493 bytes

Flyingfish

Post #43June 11, 2009, 2:52 AM UTC

I don't know if this matters but when I was in safe mode I went into the Admin'd profile by mistake and the start menu and task bar were opperating correctly. While still in safe mode I switched to my profile to view the directions and my start menu and task bar was not working. Why would this be so?

SD Fix Log. SD Fix did not run again upon restart, the log didn't auto populate either, so I launched it and used F/enter and it finished running and produced this log;

SDFix: Version 1.240
Run by [removed] on Wed 06/10/2009 at 09:15 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 21:35:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"="C:\\Program Files\\Yahoo!\\Messenger\\yserver.exe:*:Enabled:Yahoo! FT Server"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"C:\\Program Files\\Activision\\Star Trek Armada II\\Armada2.exe"="C:\\Program Files\\Activision\\Star Trek Armada II\\Armada2.exe:*:Disabled:Star Trek Armada 2"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword.exe:*:Enabled:Sid Meier's Civilization 4 Beyond the Sword"
"C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe"="C:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Beyond the Sword\\Civ4BeyondSword_PitBoss.exe:*:Enabled:Sid Meier's Civilization 4 Beyond the Sword Pitboss"
"C:\\Program Files\\Raven\\Star Trek Voyager Elite Force\\stvoyHM.exe"="C:\\Program Files\\Raven\\Star Trek Voyager Elite Force\\stvoyHM.exe:*:Disabled:stvoyHM"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"="C:\\Program Files\\AVG\\AVG8\\avgnsx.exe:*:Enabled:avgnsx.exe"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files :

Files with Hidden Attributes :

Wed 22 Oct 2008 949,072 A.SHR — "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR — "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Thu 5 Mar 2009 2,260,480 A.SHR — "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR — "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Sun 14 Jan 2007 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 12 Dec 2006 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 5 Apr 2009 57,856 …H. — "C:\Documents and Settings\Dan\My Documents\Resume\Most Up to Date Stuff\~WRL1780.tmp"
Sun 5 Apr 2009 57,856 …H. — "C:\Documents and Settings\Dan\My Documents\Resume\Most Up to Date Stuff\~WRL3633.tmp"
Thu 21 Feb 2008 51,200 …H. — "C:\Documents and Settings\Dan\My Documents\Resume\Most Up to Date Stuff\~WRL3756.tmp"
Sun 5 Apr 2009 57,856 …H. — "C:\Documents and Settings\Dan\My Documents\Resume\Most Up to Date Stuff\~WRL3862.tmp"
Sat 14 Jun 2008 29,184 A..H. — "C:\Documents and Settings\Dan\My Documents\Writings\funnie writtings\To the curb\~WRL2672.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:47:07 PM, on 6/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Borland\Interbase\Bin\IBServer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~2\COMCAS~1.DLL
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\RunOnce: "C:\Documents and Settings\Dan\Desktop\OTL.exe"
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBGuard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\Interbase\Bin\IBServer.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NkPtpEnumP2 - Nikon Corporation - C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe (file missing)
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

–
End of file - 8460 bytes

THANKS!

Tomk

Post #44June 11, 2009, 5:29 PM UTC last edited June 11, 2009, 5:30 PM UTC

Flyingfish,

I've come to the conclusion that I've reached the end of my usefulness.

I suggest that you post in the Windows Forum and see if the Tech Team can help. When you post there, please provide a link back to this thread so that they can see what all we've done here.

Meanwhile, Log looks good

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Double click on OTL to run it.
Click on CleanUp!
When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Flyingfish

Post #45June 13, 2009, 2:35 PM UTC

Thanks for all your help TomK. I followed the clean up processes, and posted on the windows forum. Hopefully, they can help clear up the windows-esk issues. Thanks again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] HTL - Fun Trojan

✨ Ask AI

Ask AI