Spyware / Malware / Virus Removal

[Closed] Please help me to understand more

13 min read

Looking for the outcome? Ask AI

beroo Topic Starter

Post #1June 5, 2009, 11:38 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:15:00 AM, on 6/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\stacsv.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aol\aol toolbar 5.0\AolTbServer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IDTSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe /TrayMode
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-MY\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\stacsv.exe

–
End of file - 7176 bytes

SpySentinel

Post #2June 6, 2009, 1:05 AM UTC last edited June 6, 2009, 1:07 AM UTC

Hi beroo,

My name is SpySentinel and I will be helping you with your computer problem.

Step #1

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Step #2

Download Rooter.exe to your desktop

Then doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Step #3

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

Post the OTL, Rooter, and Malwarebytes' Logs in your next reply.

beroo

Post #3June 9, 2009, 5:55 AM UTC

Rooter Microsoft Windows XP Home Edition (5.1.2600) Service Pack 3 C:\ [Fixed] - NTFS - (Total:76308 Mo/Free:2629 Mo) Tue 06/09/2009|13:51 ———————-\\ Processes.. –Locked– [System Process] ———- System ———- \SystemRoot\System32\smss.exe ———- \??\C:\WINDOWS\system32\csrss.exe ———- \??\C:\WINDOWS\system32\winlogon.exe ———- C:\WINDOWS\system32\services.exe ———- C:\WINDOWS\system32\lsass.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe ———- C:\WINDOWS\System32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\system32\spoolsv.exe ———- c:\program files\idt\wdm\stacsv.exe ———- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ———- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe ———- C:\WINDOWS\system32\svchost.exe ———- C:\WINDOWS\System32\alg.exe ———- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe ———- C:\WINDOWS\Explorer.EXE ———- C:\WINDOWS\system32\igfxtray.exe ———- C:\WINDOWS\system32\hkcmd.exe ———- C:\WINDOWS\system32\igfxpers.exe ———- C:\WINDOWS\system32\igfxsrvc.exe ———- C:\Program Files\IDT\WDM\sttray.exe ———- C:\WINDOWS\system32\AESTFltr.exe ———- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ———- C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe ———- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe ———- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe ———- C:\WINDOWS\system32\wbem\wmiprvse.exe ———- C:\WINDOWS\system32\ctfmon.exe ———- C:\Program Files\Windows Live\Messenger\msnmsgr.exe ———- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe ———- C:\Program Files\Windows Live\Contacts\wlcomm.exe ———- C:\Program Files\Internet Explorer\iexplore.exe ———- c:\program files\aol\aol toolbar 5.0\AolTbServer.exe ———- C:\WINDOWS\system32\wuauclt.exe ———- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe ———- C:\WINDOWS\system32\cmd.exe ———- C:\Rooter$\RK.exe ———————-\\ Search.. ———————-\\ ROOTKIT !! 1 - "C:\Rooter$\Rooter_1.txt" - Tue 06/09/2009|13:52 ———————-\\ Scan completed at 13:52

beroo

Post #4June 9, 2009, 5:59 AM UTC

Malwarebytes' Anti-Malware 1.37 Database version: 2250 Windows 5.1.2600 Service Pack 3 6/9/2009 1:57:03 PM mbam-log-2009-06-09 (13-57-03).txt Scan type: Quick Scan Objects scanned: 85690 Time elapsed: 8 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

beroo

Post #5June 9, 2009, 6:10 AM UTC

OTL Extras logfile created on: 6/9/2009 2:02:14 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DTSLYD8J
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.23 Mb Total Physical Memory | 458.25 Mb Available Physical Memory | 45.14% Memory free
2.38 Gb Paging File | 1.94 Gb Available in Paging File | 81.36% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 66.57 Gb Free Space | 89.33% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC183754137168
Current User Name: Kelly chen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader (AOL LLC)
C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call (Microsoft Corporation)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0517F875-BBB2-4812-A63E-733B33CEF215}" = Roxio Instant Restore
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{275E7C8F-5407-4E2D-9506-0DC5BC59B14E}" = MigoMobile DESKTOP 4
"{2B682751-E749-441C-A4B3-1F538E26E56E}" = Roxio Instant Restore Recovery Disk
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}" = Roxio BackOnTrack
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{4F2AF17E-94F0-4F22-943D-216CE46AC502}" = HP Mobile Broadband Setup Utility
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{69DAC00A-7665-4E9B-B441-093D40736429}" = HP BatteryCheck 2.10 A2
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{87A83C6F-F53C-448A-B078-FF00E3EAEB29}" = Roxio Disaster Recovery
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B5B25043-42A0-4490-A425-C7A6284213E6}" = HP User Guides 0130
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"553D07C7937AEF19AECBF1E27F5709BCDA84B2C7" = Windows Driver Package - SMSC LAN9500 USB 2.0 to Ethernet 10/100 Adapter x86 Driver (05/12/2008 1.52.0000.0000)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AIM_6" = AIM 6
"AOL Toolbar" = AOL Toolbar 5.0
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"HDMI" = Intel® Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"NIS" = Norton Internet Security
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ System Events ]
Error - 6/2/2009 9:41:25 AM | Computer Name = PC183754137168 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 6/4/2009 11:22:33 AM | Computer Name = PC183754137168 | Source = Dhcp | ID = 1000
Description = Your computer has lost the lease to its IP address 192.168.1.143 on
the Network Card with network address 00242B7F8DCF.

Error - 6/4/2009 11:27:51 AM | Computer Name = PC183754137168 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the crd service to connect.

Error - 6/4/2009 11:27:51 AM | Computer Name = PC183754137168 | Source = Service Control Manager | ID = 7000
Description = The crd service failed to start due to the following error: %%1053

Error - 6/4/2009 10:21:00 PM | Computer Name = PC183754137168 | Source = PlugPlayManager | ID = 12
Description = The device 'Marvell Yukon 88E8040 PCI-E Fast Ethernet Controller'
(PCI\VEN_11AB&DEV_4354&SUBSYS_361A103C&REV_00\4&23c6fc68&0&00E1) disappeared from
the system without first being prepared for removal.

Error - 6/5/2009 7:04:37 PM | Computer Name = PC183754137168 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.104 for the Network Card with network
address 00248140A083 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 6/9/2009 1:30:24 AM | Computer Name = PC183754137168 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.33 for the Network Card with network
address 00248140A083 has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

< End of report >

OTL logfile created on: 6/9/2009 2:02:14 PM - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DTSLYD8J
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.23 Mb Total Physical Memory | 458.25 Mb Available Physical Memory | 45.14% Memory free
2.38 Gb Paging File | 1.94 Gb Available in Paging File | 81.36% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 66.57 Gb Free Space | 89.33% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC183754137168
Current User Name: Kelly chen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe (Sonic Solutions)
PRC - c:\program files\idt\wdm\stacsv.exe (IDT, Inc.)
PRC - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
PRC - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe ()
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - c:\program files\aol\aol toolbar 5.0\AolTbServer.exe (AOL LLC)
PRC - C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DTSLYD8J\OTL[2].exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 [Auto | Running]) – C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe ()
SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (BOTService [Auto | Running]) – C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe (Sonic Solutions)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (hpqwmiex [On_Demand | Running]) – C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (Hewlett-Packard Development Company, L.P.)
SRV - (IDriverT [On_Demand | Stopped]) – c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Norton Internet Security [Auto | Running]) – C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (STacSV [Auto | Running]) – c:\program files\idt\wdm\stacsv.exe (IDT, Inc.)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)
SRV - (spupdsvc [Auto | Stopped]) – C:\WINDOWS\system32\spupdsvc.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AESTAud [On_Demand | Running]) – C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (AliIde [Boot | Running]) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (amdagp [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (asc [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (BCM43XX [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\bcmwl5.sys (Broadcom Corporation)
DRV - (BHDrvx86 [System | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\BHDrvx86.sys (Symantec Corporation)
DRV - (ccHP [System | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\ccHPx86.sys (Symantec Corporation)
DRV - (CmdIde [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (dac2w2k [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (eeCtrl [System | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\igxpmp32.sys (Intel Corporation)
DRV - (IDSxpx86 [System | Running]) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090604.001\IDSxpx86.sys (Symantec Corporation)
DRV - (mraid35x [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (NAVENG [On_Demand | Running]) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.033\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090608.033\NAVEX15.SYS (Symantec Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql1080 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql12160 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1280 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (SahdIa32 [Boot | Running]) – C:\WINDOWS\System32\Drivers\SahdIa32.sys (Sonic Solutions)
DRV - (SaibIa32 [Boot | Running]) – C:\WINDOWS\System32\Drivers\SaibIa32.sys (Sonic Solutions)
DRV - (SaibVd32 [System | Running]) – C:\WINDOWS\System32\Drivers\SaibVd32.sys (Sonic Solutions)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (sisagp [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Sparrow [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (SRTSP [On_Demand | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX [System | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (STHDA [On_Demand | Running]) – C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (symc810 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (symc8xx [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (SYMDNS [On_Demand | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMDNS.SYS (Symantec Corporation)
DRV - (SymEFA [Boot | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymEvent [On_Demand | Running]) – C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMFW [On_Demand | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMFW.SYS (Symantec Corporation)
DRV - (SYMIDS [On_Demand | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMIDS.SYS (Symantec Corporation)
DRV - (SymIM [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SymIMMP [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\SymIM.sys (Symantec Corporation)
DRV - (SYMNDIS [On_Demand | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMTDI.SYS (Symantec Corporation)
DRV - (sym_hi [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (sym_u3 [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (SynTP [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (SysCow [Boot | Running]) – C:\WINDOWS\system32\drivers\syscow32x.sys (Sonic Solutions)
DRV - (ultra [Disabled | Stopped]) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (yukonwxp [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\yk51x86.sys (Marvell)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf=cnnb
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {7BA52691-1876-45ce-9EE6-54BCB3B04BBC}:3.0
FF - prefs.js..extensions.enabledItems: {8545daff-ad1e-493f-a37e-eed1ac79682b}:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/06/05 12:56:09 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/06/05 12:54:48 | 00,000,000 | —D | M]

[2009/06/05 13:07:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\mozilla\Extensions
[2009/06/05 13:07:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/06/05 13:07:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\mozilla\Firefox\Profiles\8h0gatt6.default\extensions
[2009/06/09 13:26:26 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions
[2009/06/05 12:54:49 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/04/24 12:38:30 | 00,023,032 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/24 12:38:32 | 00,134,648 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009/04/24 08:39:08 | 00,001,394 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/04/24 08:39:08 | 00,002,193 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/04/24 08:39:08 | 00,001,534 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/04/24 08:39:08 | 00,002,343 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/04/24 08:39:08 | 00,001,706 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/04/24 08:39:08 | 00,001,178 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/04/24 08:39:08 | 00,000,792 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - Reg Error: Key error. File not found
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg (Andrea Electronics Corporation)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe /TrayMode (Hewlett-Packard Company)
O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IDTSysTrayApp] sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 (Microsoft Corporation)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC ()
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKLM..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-MY\local\search.html ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/06 07:14:36 | 00,000,000 | —D | M]

========== Files/Folders - Created Within 30 Days ==========

[36 C:\WINDOWS\System32\*.tmp files]
[2009/06/09 13:51:28 | 00,000,000 | —D | C] – C:\Rooter$
[2009/06/09 13:46:14 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\Malwarebytes
[2009/06/09 13:46:07 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/09 13:46:02 | 00,040,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/06/09 13:45:55 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/09 13:45:54 | 00,019,096 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/06/09 13:45:53 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/06/09 13:37:16 | 00,000,000 | —D | C] – C:\WINDOWS\ie7updates
[2009/06/09 13:36:42 | 00,000,150 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2009/06/09 13:27:58 | 00,000,000 | —D | C] – C:\WINDOWS\LastGood
[2009/06/07 23:51:31 | 00,268,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2009/06/07 23:51:31 | 00,208,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\muweb.dll
[2009/06/07 23:51:31 | 00,027,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2009/06/06 07:14:36 | 00,001,734 | —- | C] () – C:\Documents and Settings\Kelly chen\Desktop\HijackThis.lnk
[2009/06/06 07:14:34 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/06/05 18:16:10 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2009/06/05 14:00:14 | 00,138,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\afd.sys
[2009/06/05 14:00:14 | 00,138,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\afd.sys
[2009/06/05 13:57:41 | 00,284,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pdh.dll
[2009/06/05 13:57:40 | 00,401,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcss.dll
[2009/06/05 13:57:40 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sc.exe
[2009/06/05 13:57:40 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sc.exe
[2009/06/05 13:57:39 | 00,473,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/06/05 13:57:39 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/06/05 13:57:39 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\services.exe
[2009/06/05 13:57:39 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\services.exe
[2009/06/05 13:57:38 | 00,453,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009/06/05 13:57:37 | 00,729,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lsasrv.dll
[2009/06/05 13:57:37 | 00,729,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2009/06/05 13:57:37 | 00,714,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntdll.dll
[2009/06/05 13:57:37 | 00,714,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntdll.dll
[2009/06/05 13:57:37 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advapi32.dll
[2009/06/05 13:57:37 | 00,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\advapi32.dll
[2009/06/05 13:57:35 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntoskrnl.exe
[2009/06/05 13:57:35 | 02,145,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2009/06/05 13:57:33 | 02,189,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2009/06/05 13:57:32 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntkrnlpa.exe
[2009/06/05 13:57:32 | 02,023,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2009/06/05 13:50:01 | 00,337,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netapi32.dll
[2009/06/05 13:46:02 | 00,002,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp4res.dll
[2009/06/05 13:46:01 | 01,203,922 | —- | C] () – C:\WINDOWS\System32\dllcache\sysmain.sdb
[2009/06/05 13:46:00 | 00,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wordpad.exe
[2009/06/05 13:44:59 | 00,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\bthport.sys
[2009/06/05 13:44:59 | 00,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bthport.sys
[2009/06/05 13:40:16 | 00,765,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2009/06/05 13:27:37 | 00,203,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rmcast.sys
[2009/06/05 13:27:37 | 00,203,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rmcast.sys
[2009/06/05 13:27:04 | 00,455,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mrxsmb.sys
[2009/06/05 13:27:04 | 00,455,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2009/06/05 13:25:08 | 00,333,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\srv.sys
[2009/06/05 13:25:08 | 00,333,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srv.sys
[2009/06/05 13:24:00 | 00,331,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadce.dll
[2009/06/05 13:21:25 | 00,691,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcomm.dll
[2009/06/05 13:15:22 | 00,000,000 | —D | C] – C:\Program Files\Microsoft
[2009/06/05 13:14:54 | 00,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2009/06/05 13:14:18 | 00,000,000 | —D | C] – C:\Program Files\Windows Live
[2009/06/05 13:07:05 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\Mozilla
[2009/06/05 13:04:18 | 00,247,326 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\strmdll.dll
[2009/06/05 13:04:18 | 00,247,326 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\strmdll.dll
[2009/06/05 13:01:40 | 00,000,591 | —- | C] () – C:\Documents and Settings\Kelly chen\Desktop\Shortcut to KMPlayer.lnk
[2009/06/05 13:01:22 | 00,000,000 | —D | C] – C:\Program Files\KMP
[2009/06/05 12:56:43 | 01,106,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml3.dll
[2009/06/05 12:56:12 | 00,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/06/05 12:55:01 | 00,001,602 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/06/05 12:54:40 | 00,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2009/06/05 12:51:47 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2009/06/05 00:13:07 | 00,000,000 | R–D | C] – C:\Documents and Settings\Kelly chen\My Documents\My Videos
[2009/06/05 00:13:07 | 00,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Videos
[2009/06/05 00:12:57 | 00,000,782 | —- | C] () – C:\Documents and Settings\Kelly chen\Desktop\Windows Media Player.lnk
[2009/06/05 00:12:22 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/06/05 00:11:12 | 00,026,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\USBSTOR.SYS
[2009/06/04 23:23:23 | 00,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2009/06/02 22:07:38 | 00,202,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuweb.dll
[2009/06/02 22:07:35 | 00,323,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wucltui.dll
[2009/06/02 22:07:34 | 01,809,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuaueng.dll
[2009/06/02 22:07:34 | 00,213,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuaucpl.cpl
[2009/06/02 22:07:33 | 00,051,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuauclt.exe
[2009/06/02 22:07:32 | 00,561,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuapi.dll
[2009/06/02 22:07:31 | 00,092,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cdm.dll
[2009/05/30 22:44:30 | 00,000,205 | —- | C] () – C:\Documents and Settings\Kelly chen\Desktop\HP Battery Check.lnk
[2009/05/30 21:05:12 | 00,035,888 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SymIM.sys
[2009/05/30 21:05:03 | 00,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2009/05/30 21:05:02 | 00,124,464 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2009/05/30 21:05:02 | 00,010,635 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2009/05/30 21:05:02 | 00,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2009/05/30 21:05:01 | 00,000,000 | —D | C] – C:\Program Files\Symantec
[2009/05/30 21:05:01 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2009/05/30 01:09:26 | 00,000,062 | -HS- | C] () – C:\Documents and Settings\Kelly chen\Application Data\desktop.ini
[2009/05/30 01:09:25 | 00,000,081 | -HS- | C] () – C:\Documents and Settings\Kelly chen\My Documents\desktop.ini
[2009/05/30 01:09:25 | 00,000,062 | -HS- | C] () – C:\Documents and Settings\Kelly chen\Local Settings\desktop.ini
[2009/05/30 01:09:24 | 00,000,084 | -HS- | C] () – C:\Documents and Settings\Kelly chen\Start Menu\Programs\Startup\desktop.ini
[2009/05/30 01:09:24 | 00,000,000 | –SD | C] – C:\Documents and Settings\Kelly chen\Application Data\Microsoft
[2009/05/30 01:09:24 | 00,000,000 | R–D | C] – C:\Documents and Settings\Kelly chen\My Documents\My Pictures
[2009/05/30 01:09:24 | 00,000,000 | R–D | C] – C:\Documents and Settings\Kelly chen\My Documents\My Music
[2009/05/30 01:09:24 | 00,000,000 | -HSD | C] – C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files
[2009/05/30 01:09:24 | 00,000,000 | -HSD | C] – C:\Documents and Settings\Kelly chen\Local Settings\History
[2009/05/30 01:09:24 | 00,000,000 | -H-D | C] – C:\Documents and Settings\Kelly chen\Local Settings\Application Data
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Local Settings\Temp
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\TMP
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\Sun
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\MigoMobile
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\Macromedia
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\InstallShield
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\Identities
[2009/05/30 01:09:24 | 00,000,000 | —D | C] – C:\Documents and Settings\Kelly chen\Application Data\Adobe
[2009/05/29 10:21:54 | 00,221,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpns.dll
[2009/05/29 10:20:49 | 03,170,304 | RHS- | C] () – C:\Boot.sdi
[2009/05/29 10:20:49 | 00,333,203 | RHS- | C] () – C:\bootmgr
[2009/05/29 10:20:49 | 00,259,584 | RHS- | C] (Microsoft Corporation) – C:\BCDEDIT.EXE
[2009/05/29 10:20:49 | 00,259,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bcdedit.exe
[2009/05/29 10:20:49 | 00,102,400 | RHS- | C] (Microsoft Corporation) – C:\bootsect.exe
[2009/05/29 10:20:10 | 18,356,0527 | RHS- | C] () – C:\BootENU.wim
[2009/05/29 10:20:10 | 00,000,000 | -HSD | C] – C:\Boot
[2009/05/29 10:20:05 | 00,000,282 | —- | C] () – C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2009/05/29 10:19:51 | 00,111,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\BootSect.exe
[2009/05/29 10:19:43 | 00,001,931 | —- | C] () – C:\Documents and Settings\All Users\Desktop\eBay.com.my.lnk
[2009/05/29 10:19:41 | 00,001,851 | —- | C] () – C:\Documents and Settings\All Users\Desktop\My HP Games.lnk
[2009/05/29 10:19:10 | 00,873,134 | —- | C] () – C:\WINDOWS\System32\oem1.inf
[2009/05/29 10:14:28 | 00,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2009/05/29 10:11:27 | 00,571,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\TINTLGNT.IME
[2009/05/29 10:11:27 | 00,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\CINTLGNT.IME
[2009/05/29 10:11:26 | 00,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winar30.ime
[2009/05/29 10:11:26 | 00,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\phon.ime
[2009/05/29 10:11:26 | 00,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dayi.ime
[2009/05/29 10:11:26 | 00,078,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chajei.ime
[2009/05/29 10:11:26 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\quick.ime
[2009/05/29 10:11:26 | 00,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\uniime.dll
[2009/05/29 10:11:26 | 00,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winime.ime
[2009/05/29 10:11:26 | 00,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\unicdime.ime
[2009/05/29 10:11:26 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\romanime.ime
[2009/05/29 10:11:26 | 00,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\miniime.tpl
[2009/05/29 10:11:24 | 00,482,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\PINTLGNT.IME
[2009/05/29 10:11:23 | 00,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\c_g18030.dll
[2009/05/29 10:11:23 | 00,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINZM.IME
[2009/05/29 10:11:23 | 00,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINSP.IME
[2009/05/29 10:11:23 | 00,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINPY.IME
[2009/05/29 10:11:23 | 00,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imekr61.ime
[2009/05/29 10:11:23 | 00,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINGB.IME
[2009/05/29 10:11:23 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdibm02.dll
[2009/05/29 10:11:23 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\f3ahvoas.dll
[2009/05/29 10:11:23 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlk41a.dll
[2009/05/29 10:11:23 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlk41j.dll
[2009/05/29 10:11:23 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd106n.dll
[2009/05/29 10:11:22 | 00,811,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imjp81k.dll
[2009/05/29 10:11:22 | 00,340,023 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imjp81.ime
[2009/05/29 10:11:22 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdax2.dll
[2009/05/29 10:11:22 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101.dll
[2009/05/29 10:11:20 | 00,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\Thawbrkr.dll
[2009/05/29 10:11:20 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_864.nls
[2009/05/29 10:11:20 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_720.nls
[2009/05/29 10:11:20 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_708.nls
[2009/05/29 10:11:20 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\C_28596.NLS
[2009/05/29 10:11:20 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10004.nls
[2009/05/29 10:11:20 | 00,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\c_iscii.dll
[2009/05/29 10:11:20 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdusa.dll
[2009/05/29 10:11:19 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_862.nls
[2009/05/29 10:11:19 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10005.nls
[2009/05/29 10:11:18 | 01,875,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msir3jp.lex
[2009/05/29 10:11:18 | 01,677,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chsbrkr.dll
[2009/05/29 10:11:18 | 01,158,818 | —- | C] () – C:\WINDOWS\System32\korwbrkr.lex
[2009/05/29 10:11:18 | 00,838,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chtbrkr.dll
[2009/05/29 10:11:18 | 00,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msir3jp.dll
[2009/05/29 10:11:18 | 00,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\korwbrkr.dll
[2009/05/29 10:11:18 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10021.nls
[2009/05/29 10:11:18 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ftlx041e.dll
[2009/05/29 10:11:18 | 00,002,060 | —- | C] () – C:\WINDOWS\System32\noise.jpn
[2009/05/29 10:11:18 | 00,001,486 | —- | C] () – C:\WINDOWS\System32\noise.kor
[2009/05/29 10:11:14 | 00,211,938 | —- | C] () – C:\WINDOWS\System32\lcphrase.tbl
[2009/05/29 10:11:14 | 00,195,618 | —- | C] () – C:\WINDOWS\System32\c_10002.nls
[2009/05/29 10:11:14 | 00,146,126 | —- | C] () – C:\WINDOWS\System32\array30.tab
[2009/05/29 10:11:14 | 00,116,285 | —- | C] () – C:\WINDOWS\System32\msdayi.tbl
[2009/05/29 10:11:14 | 00,110,566 | —- | C] () – C:\WINDOWS\System32\arphr.tbl
[2009/05/29 10:11:14 | 00,082,172 | —- | C] () – C:\WINDOWS\System32\bopomofo.nls
[2009/05/29 10:11:14 | 00,066,728 | —- | C] () – C:\WINDOWS\System32\big5.nls
[2009/05/29 10:11:14 | 00,044,370 | —- | C] () – C:\WINDOWS\System32\acode.tbl
[2009/05/29 10:11:14 | 00,044,370 | —- | C] () – C:\WINDOWS\System32\a234.tbl
[2009/05/29 10:11:14 | 00,043,242 | —- | C] () – C:\WINDOWS\System32\phoncode.tbl
[2009/05/29 10:11:14 | 00,024,114 | —- | C] () – C:\WINDOWS\System32\lcptr.tbl
[2009/05/29 10:11:14 | 00,018,600 | —- | C] () – C:\WINDOWS\System32\arrayhw.tab
[2009/05/29 10:11:14 | 00,016,312 | —- | C] () – C:\WINDOWS\System32\arptr.tbl
[2009/05/29 10:11:14 | 00,016,254 | —- | C] () – C:\WINDOWS\System32\PINTLPAE.HLP
[2009/05/29 10:11:14 | 00,014,821 | —- | C] () – C:\WINDOWS\System32\PINTLPAD.HLP
[2009/05/29 10:11:14 | 00,004,071 | —- | C] () – C:\WINDOWS\System32\phon.tbl
[2009/05/29 10:11:14 | 00,002,714 | —- | C] () – C:\WINDOWS\System32\phonptr.tbl
[2009/05/29 10:11:14 | 00,001,460 | —- | C] () – C:\WINDOWS\System32\a15.tbl
[2009/05/29 10:11:14 | 00,000,700 | —- | C] () – C:\WINDOWS\System32\dayiptr.tbl
[2009/05/29 10:11:14 | 00,000,520 | —- | C] () – C:\WINDOWS\System32\dayiphr.tbl
[2009/05/29 10:11:11 | 01,783,864 | —- | C] () – C:\WINDOWS\System32\WINPY.MB
[2009/05/29 10:11:11 | 01,564,868 | —- | C] () – C:\WINDOWS\System32\WINSP.MB
[2009/05/29 10:11:11 | 01,223,500 | —- | C] () – C:\WINDOWS\System32\WINZM.MB
[2009/05/29 10:11:11 | 00,173,602 | —- | C] () – C:\WINDOWS\System32\c_10008.nls
[2009/05/29 10:11:11 | 00,083,748 | —- | C] () – C:\WINDOWS\System32\prcp.nls
[2009/05/29 10:11:11 | 00,083,748 | —- | C] () – C:\WINDOWS\System32\prc.nls
[2009/05/29 10:11:11 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101a.dll
[2009/05/29 10:11:06 | 00,189,986 | —- | C] () – C:\WINDOWS\System32\c_1361.nls
[2009/05/29 10:11:06 | 00,177,698 | —- | C] () – C:\WINDOWS\System32\c_10003.nls
[2009/05/29 10:11:06 | 00,047,066 | —- | C] () – C:\WINDOWS\System32\ksc.nls
[2009/05/29 10:11:06 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnecAT.dll
[2009/05/29 10:11:06 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnecNT.dll
[2009/05/29 10:11:06 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnec95.dll
[2009/05/29 10:10:58 | 00,180,770 | —- | C] () – C:\WINDOWS\System32\c_20932.nls
[2009/05/29 10:10:58 | 00,180,258 | —- | C] () – C:\WINDOWS\System32\c_20000.nls
[2009/05/29 10:10:58 | 00,177,698 | —- | C] () – C:\WINDOWS\System32\c_20949.nls
[2009/05/29 10:10:58 | 00,173,602 | —- | C] () – C:\WINDOWS\System32\c_20936.nls
[2009/05/29 10:10:58 | 00,162,850 | —- | C] () – C:\WINDOWS\System32\c_10001.nls
[2009/05/29 10:10:58 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_21027.nls
[2009/05/29 10:10:58 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_20290.nls
[2009/05/29 10:10:58 | 00,028,288 | —- | C] () – C:\WINDOWS\System32\xjis.nls
[2009/05/29 10:10:58 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\c_is2022.dll
[2009/05/29 10:10:55 | 00,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdjpn.dll
[2009/05/29 10:10:55 | 00,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkor.dll
[2009/05/29 10:10:55 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd106.dll
[2009/05/29 10:10:55 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101c.dll
[2009/05/29 10:10:55 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd103.dll
[2009/05/29 10:10:51 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101b.dll
[2009/05/29 10:08:38 | 10,646,20032 | -HS- | C] () – C:\hiberfil.sys
[2009/02/01 02:54:32 | 00,028,510 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2009/02/01 02:30:39 | 00,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2008/06/25 01:48:20 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2008/06/25 01:25:40 | 00,000,507 | —- | C] () – C:\WINDOWS\win.ini
[2008/06/24 18:06:38 | 00,000,231 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[36 C:\WINDOWS\System32\*.tmp files]
[2009/06/09 13:46:07 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/09 13:42:19 | 00,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/06/09 13:36:42 | 00,000,150 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[2009/06/09 13:30:58 | 00,401,632 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/06/09 13:30:58 | 00,062,746 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/06/09 13:30:57 | 00,471,150 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/06/09 13:27:03 | 00,000,282 | —- | M] () – C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2009/06/09 13:26:53 | 00,000,062 | -HS- | M] () – C:\Documents and Settings\Kelly chen\Local Settings\desktop.ini
[2009/06/09 13:26:21 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/06/09 13:26:18 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/06/09 13:26:13 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/06/09 13:26:09 | 10,646,20032 | -HS- | M] () – C:\hiberfil.sys
[2009/06/06 07:14:36 | 00,001,734 | —- | M] () – C:\Documents and Settings\Kelly chen\Desktop\HijackThis.lnk
[2009/06/05 19:18:39 | 00,231,184 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/06/05 13:01:40 | 00,000,591 | —- | M] () – C:\Documents and Settings\Kelly chen\Desktop\Shortcut to KMPlayer.lnk
[2009/06/05 12:56:12 | 00,000,000 | —- | M] () – C:\WINDOWS\nsreg.dat
[2009/06/05 12:55:01 | 00,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/06/05 00:12:58 | 00,000,782 | —- | M] () – C:\Documents and Settings\Kelly chen\Desktop\Windows Media Player.lnk
[2009/05/30 22:44:30 | 00,000,205 | —- | M] () – C:\Documents and Settings\Kelly chen\Desktop\HP Battery Check.lnk
[2009/05/30 21:05:02 | 00,124,464 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2009/05/30 21:05:02 | 00,010,635 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2009/05/30 21:05:02 | 00,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2009/05/30 21:05:01 | 00,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2009/05/30 21:04:57 | 00,001,984 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Internet Security.lnk
[2009/05/30 01:10:00 | 00,000,081 | -HS- | M] () – C:\Documents and Settings\Kelly chen\My Documents\desktop.ini
[2009/05/29 10:20:49 | 18,356,0527 | RHS- | M] () – C:\BootENU.wim
[2009/05/29 10:20:49 | 03,170,304 | RHS- | M] () – C:\Boot.sdi
[2009/05/29 10:20:49 | 00,333,203 | RHS- | M] () – C:\bootmgr
[2009/05/29 10:20:49 | 00,259,584 | RHS- | M] (Microsoft Corporation) – C:\BCDEDIT.EXE
[2009/05/29 10:20:49 | 00,259,584 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\bcdedit.exe
[2009/05/29 10:20:49 | 00,102,400 | RHS- | M] (Microsoft Corporation) – C:\bootsect.exe
[2009/05/29 10:19:41 | 00,001,851 | —- | M] () – C:\Documents and Settings\All Users\Desktop\My HP Games.lnk
[2009/05/29 10:17:05 | 00,038,471 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2009/05/29 10:16:56 | 00,000,211 | RHS- | M] () – C:\boot.ini
[2009/05/29 10:13:57 | 00,005,208 | —- | M] () – C:\WINDOWS\System32\pid.PNF
[2009/05/29 10:11:30 | 00,000,231 | —- | M] () – C:\WINDOWS\system.ini
[2009/05/26 13:20:08 | 00,040,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/05/26 13:19:56 | 00,019,096 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys

========== LOP Check ==========

[2009/06/09 13:45:55 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/02/01 02:50:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2009/02/01 02:55:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AOL
[2009/02/01 02:45:58 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2009/06/09 13:45:55 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/05 13:15:03 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/05/30 21:05:38 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Norton
[2009/02/01 02:12:27 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/02/01 02:46:54 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonic
[2009/02/01 02:47:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Uninstall
[2009/02/01 02:51:42 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/06/05 00:12:22 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/06/09 13:46:14 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Kelly chen\Application Data
[2009/02/01 02:50:40 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\Adobe
[2009/02/01 17:58:02 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\Identities
[2009/02/01 02:43:46 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\InstallShield
[2009/02/01 02:50:41 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\Macromedia
[2009/06/09 13:46:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\Malwarebytes
[2009/06/05 18:40:34 | 00,000,000 | –SD | M] – C:\Documents and Settings\Kelly chen\Application Data\Microsoft
[2009/02/01 02:56:33 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\MigoMobile
[2009/06/05 13:07:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\Mozilla
[2009/02/01 02:47:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\Sun
[2009/02/01 02:32:04 | 00,000,000 | —D | M] – C:\Documents and Settings\Kelly chen\Application Data\TMP
[2009/06/09 13:27:03 | 00,000,282 | —- | M] () – C:\WINDOWS\Tasks\BackOnTrack Instant Restore Idle.job
[2008/04/15 12:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/06/09 13:26:21 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

SpySentinel

Post #6June 10, 2009, 8:45 PM UTC

Hi beroo,

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This changed from what we know in 2006 read this article:

http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Click on start > run > and then paste the following into the "open" field: appwiz.cpl and press OK. From within Add or Remove Programs uninstall the following if they exist: Viewpoint, Viewpoint Manager, Viewpoint Media Player.

Run OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

beroo

Post #7June 11, 2009, 3:42 AM UTC

SpySentinel, I had done all and finish this result. Is it ok? Thanks for helping me Thanks so much ========== OTL ========== HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\CustomizeSearch| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully! ========== COMMANDS ========== File delete failed. C:\Documents and Settings\Kelly chen\Local Settings\Temp\etilqs_adDVZXCGgMoWXjeonMfE scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\JETE956.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_4a8.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 06112009_113210 Files moved on Reboot… File C:\Documents and Settings\Kelly chen\Local Settings\Temp\etilqs_adDVZXCGgMoWXjeonMfE not found! File C:\WINDOWS\temp\JETE956.tmp not found! File C:\WINDOWS\temp\Perflib_Perfdata_4a8.dat not found! Registry entries deleted on Reboot…

SpySentinel

Post #8June 12, 2009, 9:24 PM UTC last edited June 12, 2009, 9:25 PM UTC

Hi beroo, sorry for the delay.

You did it perfectly

Download and scan with SUPERAntiSpyware Free for Home Users

Double-click SUPERAntiSpyware.exe and use the default settings for installation.
An icon will be created on your desktop. Double-click that icon to launch the program.
If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
Under "Configuration and Preferences", click the Preferences button.
Click the Scanning Control tab.
Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen.
Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
On the left, make sure you check C:\Fixed Drive.
On the right, under "Complete Scan", choose Perform Complete Scan.
Click "Next" to start the scan. Please be patient while it scans your computer.
After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
Make sure everything has a checkmark next to it and click "Next".
A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
If asked if you want to reboot, click "Yes".
To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.

beroo

Post #9June 13, 2009, 12:52 PM UTC

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/13/2009 at 08:39 PM

Application Version : 4.26.1004

Core Rules Database Version : 3938
Trace Rules Database Version: 1881

Scan type : Complete Scan
Total Scan Time : 01:42:08

Memory items scanned : 560
Memory threats detected : 0
Registry items scanned : 4368
Registry threats detected : 0
File items scanned : 45886
File threats detected : 11

Adware.Tracking Cookie
C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@msnportal.112.2o7[1].txt
C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@doubleclick[1].txt
C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@atdmt[1].txt
C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@apmebf[1].txt
C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@mediaplex[1].txt
C:\Documents and Settings\Kelly chen\Cookies\kelly_chen@2o7[2].txt
C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@2o7[2].txt
C:\Documents and Settings\Dylan chan\Cookies\[removed][1].txt
C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@apmebf[1].txt
C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@atdmt[1].txt
C:\Documents and Settings\Dylan chan\Cookies\dylan_chan@doubleclick[1].txt

beroo

Post #10June 13, 2009, 3:42 PM UTC

——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Saturday, June 13, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Saturday, June 13, 2009 14:23:54 Records in database: 2339079 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ Scan statistics: Files scanned: 50971 Threat name: 0 Infected objects: 0 Suspicious objects: 0 Duration of the scan: 01:38:08 No malware has been detected. The scan area is clean. The selected area was scanned.

SpySentinel

Post #11June 13, 2009, 10:19 PM UTC

Hi beroo,

How is your computer running?

Download TFC by OldTimer to your desktop

Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
It will close all programs when run, so make sure you have saved all your work before you begin.
Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<

beroo

Post #12June 15, 2009, 2:29 PM UTC

Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-06-15 22:27:57
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 68 GB (89%) free of 76 GB
Total RAM: 1015 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:18 PM, on 6/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\wdm\stacsv.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sttray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aol\aol toolbar 5.0\AolTbServer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kelly chen\Local Settings\Temporary Internet Files\Content.IE5\DXXT5QAJ\RSIT[1].exe
C:\Program Files\Trend Micro\HijackThis\Kelly chen.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…ion&pf=cnnb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IDTSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe /TrayMode
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &AOL Toolbar Search - C:\Documents and Settings\All Users\Application Data\AOL\ieToolbar\resources\en-MY\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) - Unknown owner - C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
O23 - Service: BOTService - Sonic Solutions - C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\wdm\stacsv.exe

–
End of file - 7845 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll [2009-02-01 340848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\IPSBHO.DLL [2009-02-01 107896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-08-02 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
AOL Toolbar BHO - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2008-07-02 1185120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\16.0.0.125\coIEPlg.dll [2009-02-01 340848]
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AOL Toolbar - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll [2008-07-02 1185120]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2008-02-15 135168]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2008-02-15 159744]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2008-02-15 131072]
"IDTSysTrayApp"=C:\WINDOWS\sttray.exe [2008-09-11 446556]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2008-09-11 446556]
"AESTFltr"=C:\WINDOWS\system32\AESTFltr.exe [2008-12-03 729088]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-12-05 1410344]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-08-02 144784]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"HP Mobile Broadband"=c:\SWsetup\HPQWWAN\HPMobileBroadband.exe [2008-07-08 439600]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2008-04-15 488752]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2008-04-15 208952]
"IMEKRMIG6.1"=C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE [2008-04-15 44032]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2008-04-15 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-15 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-15 455168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-02-06 3885408]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-05-26 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2008-02-15 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-19 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

======List of files/folders created in the last 1 months======

2009-06-15 22:27:57 —-D—- C:\rsit
2009-06-15 22:19:15 —-A—- C:\WINDOWS\WORDPAD.INI
2009-06-13 18:43:57 —-D—- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2009-06-13 18:43:37 —-D—- C:\Program Files\SUPERAntiSpyware
2009-06-13 18:43:37 —-D—- C:\Documents and Settings\Kelly chen\Application Data\SUPERAntiSpyware.com
2009-06-13 18:42:59 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2009-06-13 18:41:15 —-D—- C:\WINDOWS\Sun
2009-06-11 11:32:10 —-D—- C:\_OTL
2009-06-09 13:52:20 —-A—- C:\Rooter.txt
2009-06-09 13:51:28 —-D—- C:\Rooter$
2009-06-09 13:46:14 —-D—- C:\Documents and Settings\Kelly chen\Application Data\Malwarebytes
2009-06-09 13:45:55 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-06-09 13:45:53 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2009-06-09 13:42:25 —-HDC—- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-06-09 13:42:11 —-HDC—- C:\WINDOWS\$NtUninstallKB952954$
2009-06-09 13:41:55 —-HDC—- C:\WINDOWS\$NtUninstallKB959426$
2009-06-09 13:41:29 —-HDC—- C:\WINDOWS\$NtUninstallKB961373$
2009-06-09 13:41:16 —-HDC—- C:\WINDOWS\$NtUninstallKB956803$
2009-06-09 13:41:01 —-HDC—- C:\WINDOWS\$NtUninstallKB955839$
2009-06-09 13:40:32 —-HDC—- C:\WINDOWS\$NtUninstallKB951978$
2009-06-09 13:40:02 —-HDC—- C:\WINDOWS\$NtUninstallKB961503$
2009-06-09 13:39:48 —-HDC—- C:\WINDOWS\$NtUninstallKB950974$
2009-06-09 13:37:16 —-D—- C:\WINDOWS\ie7updates
2009-06-09 13:36:49 —-HDC—- C:\WINDOWS\$NtUninstallKB960225$
2009-06-09 13:36:05 —-HDC—- C:\WINDOWS\$NtUninstallKB956572$
2009-06-09 13:35:49 —-HDC—- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-06-09 13:35:29 —-HDC—- C:\WINDOWS\$NtUninstallKB952004$
2009-06-09 13:35:16 —-HDC—- C:\WINDOWS\$NtUninstallKB941569$
2009-06-09 13:34:44 —-HDC—- C:\WINDOWS\$NtUninstallKB950762$
2009-06-09 13:34:30 —-HDC—- C:\WINDOWS\$NtUninstallKB957097$
2009-06-09 13:34:20 —-HDC—- C:\WINDOWS\$NtUninstallKB960715$
2009-06-09 13:34:06 —-HDC—- C:\WINDOWS\$NtUninstallKB958687$
2009-06-09 13:33:49 —-HDC—- C:\WINDOWS\$NtUninstallKB952287$
2009-06-09 13:33:26 —-HDC—- C:\WINDOWS\$NtUninstallKB967715$
2009-06-09 13:33:14 —-HDC—- C:\WINDOWS\$NtUninstallKB929399$
2009-06-09 13:32:43 —-HDC—- C:\WINDOWS\$NtUninstallKB950760$
2009-06-09 13:32:34 —-HDC—- C:\WINDOWS\$NtUninstallKB939683$
2009-06-09 13:31:57 —-HDC—- C:\WINDOWS\$NtUninstallKB951066$
2009-06-09 13:31:42 —-HDC—- C:\WINDOWS\$NtUninstallKB958690$
2009-06-09 13:31:21 —-HDC—- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-06-09 13:31:09 —-HDC—- C:\WINDOWS\$NtUninstallKB954459$
2009-06-09 13:30:56 —-HDC—- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-06-09 13:30:39 —-HDC—- C:\WINDOWS\$NtUninstallKB951748$
2009-06-09 13:30:23 —-HDC—- C:\WINDOWS\$NtUninstallKB960803$
2009-06-09 13:30:10 —-HDC—- C:\WINDOWS\$NtUninstallKB954600$
2009-06-09 13:29:58 —-HDC—- C:\WINDOWS\$NtUninstallKB958644$
2009-06-09 13:29:43 —-HDC—- C:\WINDOWS\$NtUninstallKB955069$
2009-06-09 13:29:27 —-HDC—- C:\WINDOWS\$NtUninstallKB956802$
2009-06-09 13:29:16 —-HDC—- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-06-09 13:28:56 —-HDC—- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-06-09 13:28:04 —-HDC—- C:\WINDOWS\$NtUninstallKB923561$
2009-06-07 23:51:31 —-A—- C:\WINDOWS\system32\muweb.dll
2009-06-07 23:51:31 —-A—- C:\WINDOWS\system32\mucltui.dll.mui
2009-06-07 23:51:31 —-A—- C:\WINDOWS\system32\mucltui.dll
2009-06-06 07:14:34 —-D—- C:\Program Files\Trend Micro
2009-06-05 13:57:41 —-A—- C:\WINDOWS\system32\pdh.dll
2009-06-05 13:57:40 —-A—- C:\WINDOWS\system32\sc.exe
2009-06-05 13:57:40 —-A—- C:\WINDOWS\system32\rpcss.dll
2009-06-05 13:57:39 —-A—- C:\WINDOWS\system32\services.exe
2009-06-05 13:57:37 —-A—- C:\WINDOWS\system32\ntdll.dll
2009-06-05 13:57:37 —-A—- C:\WINDOWS\system32\lsasrv.dll
2009-06-05 13:57:37 —-A—- C:\WINDOWS\system32\advapi32.dll
2009-06-05 13:57:35 —-A—- C:\WINDOWS\system32\ntoskrnl.exe
2009-06-05 13:57:32 —-A—- C:\WINDOWS\system32\ntkrnlpa.exe
2009-06-05 13:50:01 —-A—- C:\WINDOWS\system32\netapi32.dll
2009-06-05 13:46:02 —-N—- C:\WINDOWS\system32\xpsp4res.dll
2009-06-05 13:21:25 —-A—- C:\WINDOWS\system32\inetcomm.dll
2009-06-05 13:15:22 —-D—- C:\Program Files\Microsoft
2009-06-05 13:14:54 —-D—- C:\Program Files\Windows Live SkyDrive
2009-06-05 13:14:18 —-D—- C:\Program Files\Windows Live
2009-06-05 13:07:05 —-D—- C:\Documents and Settings\Kelly chen\Application Data\Mozilla
2009-06-05 13:04:18 —-A—- C:\WINDOWS\system32\strmdll.dll
2009-06-05 13:01:22 —-D—- C:\Program Files\KMP
2009-06-05 12:56:43 —-A—- C:\WINDOWS\system32\msxml3.dll
2009-06-05 12:54:40 —-D—- C:\Program Files\Mozilla Firefox
2009-06-05 12:51:47 —-D—- C:\Program Files\Common Files\Windows Live
2009-06-05 00:12:22 —-D—- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-06-04 23:23:23 —-D—- C:\WINDOWS\system32\PreInstall
2009-06-04 23:23:15 —-HDC—- C:\WINDOWS\$NtUninstallKB898461$
2009-06-02 22:07:38 —-A—- C:\WINDOWS\system32\wuweb.dll
2009-06-02 22:07:35 —-A—- C:\WINDOWS\system32\wucltui.dll
2009-06-02 22:07:34 —-A—- C:\WINDOWS\system32\wuaueng.dll
2009-06-02 22:07:33 —-A—- C:\WINDOWS\system32\wuauclt.exe
2009-06-02 22:07:32 —-A—- C:\WINDOWS\system32\wuapi.dll
2009-06-02 22:07:31 —-A—- C:\WINDOWS\system32\cdm.dll
2009-05-30 21:05:03 —-A—- C:\WINDOWS\system32\S32EVNT1.DLL
2009-05-30 21:05:01 —-D—- C:\Program Files\Symantec
2009-05-30 21:05:01 —-D—- C:\Program Files\Common Files\Symantec Shared
2009-05-30 01:09:26 —-ASH—- C:\Documents and Settings\Kelly chen\Application Data\desktop.ini
2009-05-30 01:09:24 —-SD—- C:\Documents and Settings\Kelly chen\Application Data\Microsoft
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\TMP
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\Sun
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\MigoMobile
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\Macromedia
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\InstallShield
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\Identities
2009-05-30 01:09:24 —-D—- C:\Documents and Settings\Kelly chen\Application Data\Adobe
2009-05-29 10:21:54 —-A—- C:\WINDOWS\system32\wmpns.dll
2009-05-29 10:20:49 —-RASH—- C:\bootsect.exe
2009-05-29 10:20:49 —-RASH—- C:\BCDEDIT.EXE
2009-05-29 10:20:49 —-A—- C:\WINDOWS\system32\bcdedit.exe
2009-05-29 10:20:10 —-SHD—- C:\Boot
2009-05-29 10:19:51 —-A—- C:\WINDOWS\system32\BootSect.exe
2009-05-29 10:14:28 —-D—- C:\WINDOWS\Prefetch
2009-05-29 10:11:26 —-A—- C:\WINDOWS\system32\uniime.dll
2009-05-29 10:11:23 —-A—- C:\WINDOWS\system32\kbdlk41j.dll
2009-05-29 10:11:23 —-A—- C:\WINDOWS\system32\kbdlk41a.dll
2009-05-29 10:11:23 —-A—- C:\WINDOWS\system32\kbdibm02.dll
2009-05-29 10:11:23 —-A—- C:\WINDOWS\system32\kbd106n.dll
2009-05-29 10:11:23 —-A—- C:\WINDOWS\system32\f3ahvoas.dll
2009-05-29 10:11:23 —-A—- C:\WINDOWS\system32\c_g18030.dll
2009-05-29 10:11:22 —-A—- C:\WINDOWS\system32\kbdax2.dll
2009-05-29 10:11:22 —-A—- C:\WINDOWS\system32\kbd101.dll
2009-05-29 10:11:22 —-A—- C:\WINDOWS\system32\imjp81k.dll
2009-05-29 10:11:20 —-A—- C:\WINDOWS\system32\Thawbrkr.dll
2009-05-29 10:11:20 —-A—- C:\WINDOWS\system32\kbdusa.dll
2009-05-29 10:11:20 —-A—- C:\WINDOWS\system32\c_iscii.dll
2009-05-29 10:11:18 —-A—- C:\WINDOWS\system32\msir3jp.dll
2009-05-29 10:11:18 —-A—- C:\WINDOWS\system32\korwbrkr.dll
2009-05-29 10:11:18 —-A—- C:\WINDOWS\system32\ftlx041e.dll
2009-05-29 10:11:18 —-A—- C:\WINDOWS\system32\chtbrkr.dll
2009-05-29 10:11:18 —-A—- C:\WINDOWS\system32\chsbrkr.dll
2009-05-29 10:11:11 —-A—- C:\WINDOWS\system32\kbd101a.dll
2009-05-29 10:11:06 —-A—- C:\WINDOWS\system32\kbdnecNT.dll
2009-05-29 10:11:06 —-A—- C:\WINDOWS\system32\kbdnecAT.dll
2009-05-29 10:11:06 —-A—- C:\WINDOWS\system32\kbdnec95.dll
2009-05-29 10:10:58 —-A—- C:\WINDOWS\system32\c_is2022.dll
2009-05-29 10:10:55 —-A—- C:\WINDOWS\system32\kbdkor.dll
2009-05-29 10:10:55 —-A—- C:\WINDOWS\system32\kbdjpn.dll
2009-05-29 10:10:55 —-A—- C:\WINDOWS\system32\kbd106.dll
2009-05-29 10:10:55 —-A—- C:\WINDOWS\system32\kbd103.dll
2009-05-29 10:10:55 —-A—- C:\WINDOWS\system32\kbd101c.dll
2009-05-29 10:10:51 —-A—- C:\WINDOWS\system32\kbd101b.dll

======List of files/folders modified in the last 1 months======

2009-06-15 22:28:01 —-D—- C:\WINDOWS\temp
2009-06-15 22:27:16 —-D—- C:\WINDOWS\system32
2009-06-15 22:27:16 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-15 22:23:20 —-SD—- C:\WINDOWS\Tasks
2009-06-15 22:21:52 —-A—- C:\WINDOWS\SchedLgU.Txt
2009-06-15 22:19:15 —-D—- C:\WINDOWS
2009-06-15 21:35:24 —-D—- C:\WINDOWS\system32\CatRoot2
2009-06-15 21:03:34 —-D—- C:\WINDOWS\Network Diagnostic
2009-06-15 20:48:48 —-HD—- C:\WINDOWS\inf
2009-06-13 19:10:00 —-SHD—- C:\System Volume Information
2009-06-13 19:09:14 —-D—- C:\WINDOWS\Registration
2009-06-13 18:43:46 —-SHD—- C:\WINDOWS\Installer
2009-06-13 18:43:37 —-RD—- C:\Program Files
2009-06-13 18:42:59 —-D—- C:\Program Files\Common Files
2009-06-13 18:31:25 —-HD—- C:\WINDOWS\$hf_mig$
2009-06-09 14:24:31 —-D—- C:\Program Files\Internet Explorer
2009-06-09 14:24:29 —-D—- C:\WINDOWS\system32\wbem
2009-06-09 14:24:27 —-D—- C:\WINDOWS\AppPatch
2009-06-09 13:46:02 —-D—- C:\WINDOWS\system32\drivers
2009-06-09 13:42:30 —-RSHD—- C:\WINDOWS\system32\dllcache
2009-06-09 13:42:19 —-A—- C:\WINDOWS\imsins.BAK
2009-06-09 13:38:19 —-D—- C:\WINDOWS\system32\en-US
2009-06-09 13:35:51 —-D—- C:\WINDOWS\WinSxS
2009-06-05 13:15:03 —-SD—- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-06-05 13:15:03 —-D—- C:\Program Files\Common Files\Microsoft Shared
2009-06-05 13:14:28 —-RSD—- C:\WINDOWS\Fonts
2009-06-05 12:12:00 —-D—- C:\WINDOWS\Microsoft.NET
2009-06-05 12:11:59 —-RSD—- C:\WINDOWS\assembly
2009-06-05 00:20:47 —-SHD—- C:\RECYCLER
2009-06-02 22:10:12 —-D—- C:\WINDOWS\SoftwareDistribution
2009-06-02 22:07:40 —-D—- C:\WINDOWS\Help
2009-06-02 21:59:17 —-D—- C:\WINDOWS\system32\ias
2009-06-02 21:42:23 —-A—- C:\WINDOWS\setuplog.txt
2009-05-30 21:05:38 —-D—- C:\Documents and Settings\All Users\Application Data\Norton
2009-05-30 01:09:54 —-A—- C:\WINDOWS\OEWABLog.txt
2009-05-30 01:09:24 —-D—- C:\Documents and Settings
2009-05-29 15:19:53 —-D—- C:\Program Files\Hewlett-Packard
2009-05-29 10:22:59 —-D—- C:\WINDOWS\system32\config
2009-05-29 10:22:57 —-HD—- C:\System.sav
2009-05-29 10:22:57 —-AD—- C:\SwSetup
2009-05-29 10:21:15 —-D—- C:\WINDOWS\repair
2009-05-29 10:21:06 —-D—- C:\WINDOWS\system32\Restore
2009-05-29 10:20:10 —-SHD—- C:\System Rollback Data
2009-05-29 10:19:47 —-RD—- C:\Program Files\Online Services
2009-05-29 10:17:00 —-D—- C:\WINDOWS\system32\oobe
2009-05-29 10:16:56 —-RASH—- C:\boot.ini
2009-05-29 10:14:52 —-D—- C:\WINDOWS\security
2009-05-29 10:11:30 —-A—- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 BHDrvx86;Symantec Heuristics Driver; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\BHDrvx86.sys []
R1 ccHP;Symantec Hash Provider; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\ccHPx86.sys []
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
R1 IDSxpx86;IDSxpx86; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20090610.006\IDSxpx86.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-15 36352]
R1 SaibVd32;Virtual Disk Driver; C:\WINDOWS\System32\Drivers\SaibVd32.sys [2008-12-11 25584]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R1 SRTSPX;SRTSPX; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSPX.SYS []
R1 SYMTDI;SYMTDI; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMTDI.SYS []
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R3 AESTAud;AE Audio Service; C:\WINDOWS\system32\drivers\AESTAud.sys [2008-12-03 112128]
R3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2009-02-01 1294200]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-15 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2008-02-15 5854752]
R3 NAVENG;NAVENG; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090613.003\NAVENG.SYS []
R3 NAVEX15;NAVEX15; \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090613.003\NAVEX15.SYS []
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
R3 SRTSP;SRTSP; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSP.SYS []
R3 STHDA;IDT High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2008-09-11 1390323]
R3 SYMDNS;SYMDNS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMDNS.SYS []
R3 SymEvent;SymEvent; \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS []
R3 SYMFW;SYMFW; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMFW.SYS []
R3 SYMIDS;SYMIDS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMIDS.SYS []
R3 SymIMMP;SymIMMP; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-02-01 35888]
R3 SYMNDIS;SYMNDIS; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMNDIS.SYS []
R3 SYMREDRV;SYMREDRV; \??\C:\WINDOWS\system32\drivers\NIS\1000000.07D\SYMREDRV.SYS []
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-12-05 204976]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
R3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
R3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2008-06-27 289024]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-15 60800]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-15 61824]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-15 79232]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\WINDOWS\system32\DRIVERS\SymIM.sys [2009-02-01 35888]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-29 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-29 82944]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-14 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-14 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-14 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-14 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-18 13952]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-14 40960]
S4 sr;System Restore Filter Driver; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-15 73472]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-14 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service; C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe [2008-12-11 125424]
R2 BOTService;BOTService; C:\Program Files\Roxio\BackOnTrack\Instant Restore\BOTService.exe [2008-12-25 203248]
R2 Norton Internet Security;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [2009-02-01 115560]
R2 STacSV;Audio Service; c:\program files\idt\wdm\stacsv.exe [2008-09-11 237650]
R3 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2008-04-16 165192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-19 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336]

—————–EOF—————–

beroo

Post #13June 15, 2009, 2:31 PM UTC

info.txt logfile of random's system information tool 1.06 2009-06-15 22:28:25 ======Uninstall list====== –>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Acrobat.com–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 Acrobat.com–>MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07} Adobe AIR–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall Adobe AIR–>MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F} Adobe Flash Player 10 ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 9–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001} AIM 6–>C:\Program Files\AIM6\uninst.exe AOL Toolbar 5.0–>"C:\Program Files\AOL\AOL Toolbar 5.0\uninstall.exe" Broadcom 802.11 Wireless LAN Adapter–>"C:\Program Files\Broadcom\Broadcom 802.11\Driver\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Broadcom\Broadcom 802.11\Driver" Choice Guard–>MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E} Compatibility Pack for the 2007 Office system–>MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} Critical Update for Windows Media Player 11 (KB959772)–>"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe" HijackThis 2.0.2–>"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Hotfix for Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Hotfix for Windows XP (KB949764)–>"C:\WINDOWS\$NtUninstallKB949764$\spuninst\spuninst.exe" Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" HP BatteryCheck 2.10 A2–>"C:\Program Files\InstallShield Installation Information\{69DAC00A-7665-4E9B-B441-093D40736429}\Setup.exe" -runfromtemp -l0x0009 -removeonly uninst HP Doc Viewer–>MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F} HP Help and Support–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}\setup.exe" -l0x9 -removeonly HP Mobile Broadband Setup Utility–>MsiExec.exe /I{4F2AF17E-94F0-4F22-943D-216CE46AC502} HP User Guides 0130–>MsiExec.exe /X{B5B25043-42A0-4490-A425-C7A6284213E6} HP Wireless Assistant–>MsiExec.exe /I{9ADABDDE-9644-461B-9E73-83FA3EFCAB50} IDT Audio–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}\setup.exe" -l0x9 -remove -removeonly Intel® Graphics Media Accelerator Driver–>C:\WINDOWS\system32\igxpun.exe -uninstall Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} Junk Mail filter update–>MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3} Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" Marvell Miniport Driver–>MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B} Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 2.0–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Kernel-Mode Driver Framework Feature Pack 1.7–>"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe" Microsoft Office PowerPoint Viewer 2007 (English)–>MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE} Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Works–>MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8} MigoMobile DESKTOP 4–>MsiExec.exe /X{275E7C8F-5407-4E2D-9506-0DC5BC59B14E} Mozilla Firefox (3.0.10)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSN–>C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP MSVCRT–>MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 6.0 Parser–>MsiExec.exe /I{909B62B0-8ACA-4061-A83B-09CAEF609619} Norton Internet Security–>C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\16.0.0.125\InstStub.exe /X Roxio BackOnTrack–>C:\Documents and Settings\All Users\Application Data\Uninstall\{32F9BACF-FCD3-4B6A-AD85-255A449B6FA5}\setup.exe /x {32F9BACF-FCD3-4B6A-AD85-255A449B6FA5} Roxio BackOnTrack–>MsiExec.exe /I{5A06423A-210C-49FB-950E-CB0EB8C5CEC7} Roxio Disaster Recovery–>MsiExec.exe /I{87A83C6F-F53C-448A-B078-FF00E3EAEB29} Roxio Instant Restore Recovery Disk–>MsiExec.exe /I{2B682751-E749-441C-A4B3-1F538E26E56E} Roxio Instant Restore–>MsiExec.exe /I{0517F875-BBB2-4812-A63E-733B33CEF215} Roxio Update Manager–>MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E} Security Update for Windows Internet Explorer 7 (KB938127-v2)–>"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe" Security Update for Windows Internet Explorer 7 (KB963027)–>"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe" Security Update for Windows Media Player (KB952069)–>"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Security Update for Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Security Update for Windows XP (KB923561)–>"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe" Security Update for Windows XP (KB938464-v2)–>"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Security Update for Windows XP (KB952004)–>"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe" Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Security Update for Windows XP (KB954459)–>"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe" Security Update for Windows XP (KB954600)–>"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe" Security Update for Windows XP (KB955069)–>"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe" Security Update for Windows XP (KB956572)–>"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe" Security Update for Windows XP (KB956802)–>"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe" Security Update for Windows XP (KB956803)–>"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" Security Update for Windows XP (KB957097)–>"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe" Security Update for Windows XP (KB958644)–>"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" Security Update for Windows XP (KB958687)–>"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe" Security Update for Windows XP (KB958690)–>"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe" Security Update for Windows XP (KB959426)–>"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe" Security Update for Windows XP (KB960225)–>"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe" Security Update for Windows XP (KB960715)–>"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe" Security Update for Windows XP (KB960803)–>"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe" Security Update for Windows XP (KB961373)–>"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe" Segoe UI–>MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7} SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} Synaptics Pointing Device Driver–>rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Update for Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" Update for Windows XP (KB955839)–>"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe" Update for Windows XP (KB961503)–>"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe" Update for Windows XP (KB967715)–>"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe" Windows Backup Utility–>MsiExec.exe /I{76EFFC7C-17A6-479D-9E47-8E658C1695AE} Windows Driver Package - SMSC LAN9500 USB 2.0 to Ethernet 10/100 Adapter x86 Driver (05/12/2008 1.52.0000.0000)–>C:\PROGRA~1\DIFX\335EFD92411812DC\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\net9500-x8_8CECCF3B6A7FEEACAEF12BF75CF81F511ABC2E6A\net9500-x86-n51m.inf Windows Live Call–>MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE} Windows Live Communications Platform–>MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52} Windows Live Essentials–>C:\Program Files\Windows Live\Installer\wlarp.exe Windows Live Essentials–>MsiExec.exe /I{C6CA8874-5F22-4AF0-9BE3-016BF299C536} Windows Live Mail–>MsiExec.exe /I{63C1109E-D977-49ED-BCE3-D00D0BF187D6} Windows Live Messenger–>MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C} Windows Live Sign-in Assistant–>MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5} Windows Live Upload Tool–>MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238} Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" ======Security center information====== AV: Norton Internet Security FW: Norton Internet Security ======System event log====== Computer Name: PC183754137168 Event Code: 20169 Message: Unable to contact a DHCP server. The Automatic Private IP Address 169.254.20.39 will be assigned to dial-in clients. Clients may be unable to access resources on the network. Record Number: 131 Source Name: RemoteAccess Time Written: 20090602215856.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 16 Message: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection. Record Number: 125 Source Name: Windows Update Agent Time Written: 20090602214125.000000+480 Event Type: error User: Computer Name: PC183754137168 Event Code: 240 Message: A request to suspend power was denied by winlogon.exe. Record Number: 80 Source Name: Win32k Time Written: 20090530210726.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 240 Message: A request to suspend power was denied by winlogon.exe. Record Number: 79 Source Name: Win32k Time Written: 20090530210723.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 240 Message: A request to suspend power was denied by winlogon.exe. Record Number: 78 Source Name: Win32k Time Written: 20090530210719.000000+480 Event Type: warning User: =====Application event log===== Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 49 Source Name: RstLogonComponent Time Written: 20090530223541.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 40 Source Name: RstLogonComponent Time Written: 20090530210434.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 29 Source Name: RstLogonComponent Time Written: 20090530100825.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 17 Source Name: RstLogonComponent Time Written: 20090530010941.000000+480 Event Type: warning User: Computer Name: PC183754137168 Event Code: 0 Message: Record Number: 6 Source Name: RstLogonComponent Time Written: 20090529151539.000000+480 Event Type: warning User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\ "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 28 Stepping 2, GenuineIntel "PROCESSOR_REVISION"=1c02 "NUMBER_OF_PROCESSORS"=2 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "OnlineServices"=Online Services "Platform"=MCD "PCBRAND"=Pavilion —————–EOF—————–

beroo

Post #14June 15, 2009, 2:42 PM UTC last edited June 15, 2009, 2:44 PM UTC

I am afraid my laptop is still having a anoying file in shared documents C:\Documents and Settings\All Users\Documents microsoft/IdentityCRL/Production = but this file has 0 bytes Everytime this deleted file just keep show up again and again no matter how many times i delete it. haiz….. Do you know wat is it?

SpySentinel

Post #15June 16, 2009, 7:18 PM UTC

I am afraid my laptop is still having a anoying file in shared documents
C:\Documents and Settings\All Users\Documents
microsoft/IdentityCRL/Production = but this file has 0 bytes
Everytime this deleted file just keep show up again and again no matter how many times i delete it.
haiz…..
Do you know wat is it?

Yes it is malicious, we will go ahead and remove it.

Please download the OTM by OldTimer.

Save it to your desktop.
Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:processes
explorer.exe

:Files
C:\Documents and Settings\All Users\Documents\microsoft/IdentityCRL/Production

:commands
[purity]
[emptytemp]
[start explorer]

Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

[external image: Posted Image] Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 14.
Click the "Download" button to the right.
Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
Click on Continue.
Click on the link to download Windows Offline Installation (jre-6u14-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u14-windows-i586.exe and select "Run as an Administrator.")

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Please help me to understand more

✨ Ask AI

Ask AI