What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Help - Infostealer.Gampass

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am getting a:

Realtime Protection Scan
Virus Found!
Infostealer.Gampass
c:\WINDOWS\SYSTEM32\4881250.dll
c:\WINDOWS\SYSTEM32
Peter
Peter
Clean failed: Quarantine failed: Access denied

Message form my Symantec AntiVirus Notification.
This virus or whatever it is has stopped my internet connection

Here is the Hijack This log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:55:00 AM, on 6/13/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\RegCure\regcure.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec…amp;gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirec…amp;gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirec…p;gc=1&q=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\userinit.exe,C:\Documents and Settings\Peter\owcv.exe \s
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.65.122 knocker
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [txki] C:\WINDOWS\system32\txki.exe \u
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Advanced Uninstaller PRO Installation Monitor] "C:\Program Files\Innovative Solutions\Advanced Uninstaller PRO - Version 9\monitor.exe"
O4 - Global Startup: Monitor.lnk = C:\Program Files\SanDisk\SanDisk TransferMate\SD Monitor.exe
O4 - Global Startup: SentriLockCardUtility.lnk = ?
O4 - Global Startup: Spyder3Utility.lnk = C:\Program Files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\WEB2~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\4881250.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\4881250.dll
O16 - DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} (Virgin Digital Music Class) - http://www.virgindigital.co.uk/activeX/VirginWMA.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} (PrintRoomUploader Class) - http://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB
O16 - DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} (AlamyUploader Class) - http://www.alamy.com/uploader/alamy_uploader.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123506939171
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123506924625
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} (Image Uploader Control) - http://www.printroom.com/ImageUploader4.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir…l/installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v…acheManager.CAB
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

–
End of file - 14157 bytes


Please advise
Post #2
Hi,

Please do the following:

You will need to have access to download the tools I will need to properly diagnose and fix your computer.
Download them to a USB and transfer them over.

STEP #1

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



STEP #2


Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.
Post #3
Thanks for the response

Here's the DDS:

DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 10:34:24.92 on Sat 06/13/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.792 [GMT -4:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Sygate\SPF\smc.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\RegCure\regcure.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
H:\dds.pif

============== Pseudo HJT Report ===============

uSearch Page = hxxp://search.live.com
uDefault_Page_URL = hxxp://www.dellnet.com
uSearch Bar = hxxp://search.live.com/sphome.aspx
mDefault_Search_URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
mStart Page = hxxp://www.dellnet.com
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\documents and settings\peter\owcv.exe \s
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [Advanced Uninstaller PRO Installation Monitor] "c:\program files\innovative solutions\advanced uninstaller pro - version 9\monitor.exe"
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [vptray] c:\progra~1\symant~1\symant~1\vptray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [PinnacleDriverCheck] c:\windows\system32\PSDrvCheck.exe -CheckReg
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [DwlClient] c:\program files\common files\dell\eusw\Support.exe
mRun: [DVDSentry] c:\windows\system32\DSentry.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Verizon_McciTrayApp] c:\program files\verizon\McciTrayApp.exe
mRun: []
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monitor.lnk - c:\program files\sandisk\sandisk transfermate\SD Monitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sentri~1.lnk - c:\windows\installer\{c9b8d365-a6c3-4c4d-9624-0f0078feb1b4}\Icon037926361.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spyder~1.lnk - c:\program files\datacolor\spyder3pro\utility\Spyder3Utility.exe
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - {A1EDC4A1-940F-48E0-8DFD-E38F1D501021}
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mic273~1\web2~1\office12\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: c:\windows\system32\4881250.dll
DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} - hxxp://www.virgindigital.co.uk/activeX/VirginWMA.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} - hxxp://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB
DPF: {3E0D93BD-ABC6-4723-A70F-2A57D33C0186} - hxxp://www.alamy.com/uploader/alamy_uploader.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www2.snapfish.com/SnapfishActivia.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123506939171
DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123506924625
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab
DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} - hxxp://www.printroom.com/ImageUploader4.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} - hxxp://www.candystand.com/assets/activex/virtools/CacheManager.CAB
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {ad0aca58-656f-61da-9dfe-5d20f4f611ba} - c:\windows\system32\cs1sa1f.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\peter\applic~1\mozilla\firefox\profiles\iiv1fu3w.default\
FF - prefs.js: browser.startup.homepage - hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_central
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg8\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\peter\application data\mozilla\firefox\profiles\iiv1fu3w.default\extensions\[removed]\plugins\npImgCtl.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint_03050024.dll
FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll
FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll

============= SERVICES / DRIVERS ===============

R0 inic1622;inic1622;c:\windows\system32\drivers\dmi1622.sys [2004-12-24 45056]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-3-19 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-6-13 327688]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-6-13 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-13 108552]
R1 magicpvt;magicpvt;c:\windows\system32\drivers\magicpvt.sys [2008-1-28 9728]
R2 NAVAPEL;NAVAPEL;c:\progra~1\symant~1\symant~1\NAVAPEL.SYS [2003-5-2 30208]
R2 Norton AntiVirus Server;Symantec AntiVirus Client;c:\progra~1\symant~1\symant~1\Rtvscan.exe [2003-5-21 610304]
R2 P1C1394;Phase One 1394 Camera Driver;c:\windows\system32\drivers\p1c1394.sys [2004-6-9 23168]
R3 NAVAP;NAVAP;c:\progra~1\symant~1\symant~1\NAVAP.sys [2003-5-2 224256]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090612.003\NAVENG.sys [2009-6-12 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090612.003\NAVEX15.sys [2009-6-12 876144]
R3 SCR3xx USB Smart Card Reader;SCR3xx USB Smart Card Reader;c:\windows\system32\drivers\SCR3XX2K.sys [2008-12-5 47488]
R3 Spyder3;Datacolor Spyder3;c:\windows\system32\drivers\Spyder3.sys [2008-3-19 12288]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-6-13 298776]
S2 navapsvc;Norton AntiVirus Auto Protect Service;"c:\program files\norton systemworks\norton antivirus\navapsvc.exe" –> c:\program files\norton systemworks\norton antivirus\navapsvc.exe [?]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2004-5-14 32896]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-4-26 348752]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-4-26 1095560]
S3 SNL320XP;SONIX MULTIMEDIA USB DEVICE DRIVER;c:\windows\system32\drivers\9kdUSBXP.sys [2008-12-29 16000]
S4 .anattns;.anattns; [x]

=============== Created Last 30 ================

2009-06-13 09:54 –d—– c:\program files\Trend Micro
2009-06-13 08:55 –d—– c:\docume~1\alluse~1\applic~1\RegCure
2009-06-13 00:52 108,552 a——- c:\windows\system32\drivers\avgtdix.sys
2009-06-13 00:52 11,952 a——- c:\windows\system32\avgrsstx.dll
2009-06-13 00:52 327,688 a——- c:\windows\system32\drivers\avgldx86.sys
2009-06-13 00:51 –d—– c:\windows\system32\drivers\Avg
2009-06-13 00:39 –d—– c:\program files\Safer Networking
2009-06-13 00:29 –d—– c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-06-13 00:21 300 a——- c:\windows\wininit.ini
2009-06-13 00:01 –d—– c:\program files\AVG
2009-06-13 00:01 –d—– c:\docume~1\alluse~1\applic~1\avg8
2009-06-10 14:06 –d—– c:\temp\logs
2009-06-10 14:06 –d—– C:\Temp
2009-06-01 21:59 –d—– c:\docume~1\peter\applic~1\Auslogics
2009-06-01 21:59 –d—– c:\program files\Auslogics
2009-05-27 16:48 –d—– c:\program files\F1 Challenge 99-02
2009-05-18 16:29 542 a——- c:\windows\eReg.dat
2009-05-18 15:41 149,504 a——- C:\UNWISE.EXE
2009-05-18 15:41 –d—– C:\Programme

==================== Find3M ====================

2009-06-03 17:22 2,004 a——- c:\windows\registration\e10f24f0-652e-11dd-ad8b-0800200c9a66.dll
2009-05-15 21:32 130,936 a——- c:\windows\system32\drivers\PCTCore.sys
2009-05-08 08:35 139,264 ——– c:\windows\system32\4881250.dll
2009-05-08 08:35 15,872 a——- c:\windows\system32\drivers\BEEP.SYS
2008-01-29 12:25 439,296 a——- c:\documents and settings\peter\GoToAssist_phone__317_en.exe
2005-12-12 14:40 46,296 ac—— c:\docume~1\peter\applic~1\GDIPFONTCACHEV1.DAT
2004-03-24 09:46 8,350 ac—— c:\program files\INSTALL.LOG
2009-02-14 12:50 61 —sh— c:\windows\cnerolf.dat
2005-05-26 18:15 174,080 ac-sh— c:\windows\system32\sfpsys.exe

============= FINISH: 10:35:11.14 ===============



Here's the Attach


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume4
Install Date: 10/12/2003 10:34:57 AM
System Uptime: 6/13/2009 7:52:56 AM (3 hours ago)

Motherboard: Dell Computer Corp. | | 0M2035
Processor: Intel® Pentium® 4 CPU 2.60GHz | Microprocessor | 2593/800mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 56.638 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 233 GiB total, 161.754 GiB free.
G: is FIXED (NTFS) - 298 GiB total, 226.164 GiB free.
H: is Removable
I: is Removable
J: is Removable
K: is Removable
L: is FIXED (NTFS) - 596 GiB total, 256.967 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1685: 3/20/2009 12:39:35 PM - Removed Adobe Photoshop CS2
RP1686: 4/5/2009 11:37:15 PM - System Checkpoint
RP1687: 4/7/2009 12:37:31 AM - System Checkpoint
RP1688: 4/16/2009 3:55:10 PM - System Checkpoint
RP1689: 4/21/2009 7:43:59 AM - Installed Napster
RP1690: 4/21/2009 7:44:35 AM - Installed Napster Burn Engine
RP1691: 4/21/2009 7:52:49 AM - Removed Napster
RP1692: 4/21/2009 7:53:21 AM - Removed Napster Burn Engine
RP1693: 4/21/2009 1:48:25 PM - Removed Diskeeper Professional Edition
RP1694: 4/21/2009 1:48:49 PM - Installed Diskeeper 2009 Pro Premier.
RP1695: 4/21/2009 2:36:52 PM - Removed Diskeeper 2009 Pro Premier.
RP1696: 4/21/2009 2:41:00 PM - Installed Diskeeper 2009 Pro Premier.
RP1697: 4/22/2009 8:25:38 PM - System Checkpoint
RP1698: 4/22/2009 8:38:26 PM - Installed QuickTime
RP1699: 4/24/2009 2:30:43 PM - System Checkpoint
RP1700: 4/29/2009 8:37:08 AM - System Checkpoint
RP1701: 5/3/2009 5:40:03 PM - System Checkpoint
RP1702: 5/6/2009 6:55:48 PM - System Checkpoint
RP1703: 5/8/2009 8:18:30 AM - System Checkpoint
RP1704: 5/10/2009 9:30:43 AM - System Checkpoint
RP1705: 5/11/2009 11:55:28 AM - System Checkpoint
RP1706: 5/12/2009 4:13:47 PM - System Checkpoint
RP1707: 5/14/2009 9:00:05 AM - System Checkpoint
RP1708: 5/15/2009 11:17:22 AM - System Checkpoint
RP1709: 5/16/2009 5:23:21 PM - System Checkpoint
RP1710: 5/18/2009 8:42:11 AM - System Checkpoint
RP1711: 5/19/2009 4:08:51 PM - System Checkpoint
RP1712: 5/20/2009 7:03:37 PM - System Checkpoint
RP1713: 5/22/2009 8:41:41 AM - System Checkpoint
RP1714: 5/23/2009 2:41:54 PM - System Checkpoint
RP1715: 5/24/2009 7:22:23 PM - System Checkpoint
RP1716: 5/26/2009 9:24:27 AM - System Checkpoint
RP1717: 5/27/2009 9:37:22 AM - System Checkpoint
RP1718: 5/28/2009 12:53:32 PM - System Checkpoint
RP1719: 5/29/2009 3:29:53 PM - System Checkpoint
RP1720: 5/30/2009 10:03:39 PM - System Checkpoint
RP1721: 6/1/2009 10:54:48 AM - System Checkpoint
RP1722: 6/1/2009 8:58:54 PM - Removed Diskeeper 2009 Pro Premier.
RP1723: 6/1/2009 9:04:54 PM - Installed Diskeeper 2009 Pro Premier.
RP1724: 6/1/2009 9:15:20 PM - Removed Diskeeper 2009 Pro Premier.
RP1725: 6/1/2009 9:47:21 PM - Installed Diskeeper 2009 Pro Premier.
RP1726: 6/1/2009 9:54:33 PM - Removed Diskeeper 2009 Pro Premier.
RP1727: 6/2/2009 11:24:54 PM - System Checkpoint
RP1728: 6/4/2009 1:03:12 PM - System Checkpoint
RP1729: 6/5/2009 4:27:51 PM - System Checkpoint
RP1730: 6/6/2009 5:48:21 PM - System Checkpoint
RP1731: 6/8/2009 8:35:32 AM - System Checkpoint
RP1732: 6/9/2009 3:14:26 PM - System Checkpoint
RP1733: 6/11/2009 5:37:57 PM - System Checkpoint
RP1734: 6/13/2009 12:02:21 AM - Installed AVG Free 8.5
RP1735: 6/13/2009 12:29:45 AM - Installed AVG Free 8.5
RP1736: 6/13/2009 12:39:30 AM - Installed AVG Free 8.5

==== Installed Programs ======================


3D Groove Playback Engine
3DVIA player 4.1
ABBYY FineReader 5.0 Sprint
Active Camera 2004 fix version 2.1 (FS9.0)
Active Camera 2004 version 2.1 for FS 9.0
Add or Remove Adobe Creative Suite 3 Master Collection
Adobe Acrobat 7.0.1 and Reader 7.0.1 Update
Adobe Acrobat 7.0.2 and Reader 7.0.2 Update
Adobe After Effects CS3
Adobe After Effects CS3 Presets
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge 1.0
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Common File Installer
Adobe Contribute CS3
Adobe Creative Suite 2
Adobe Creative Suite 3 Master Collection
Adobe Default Language CS3
Adobe Device Central CS3
Adobe Dreamweaver CS3
Adobe Encore CS3
Adobe Encore CS3 Codecs
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Fireworks CS3
Adobe Flash CS3
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Center 1.0
Adobe Help Viewer CS3
Adobe Illustrator CS3
Adobe InDesign CS3
Adobe InDesign CS3 Icon Handler
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Premiere Pro CS3
Adobe Premiere Pro CS3 Functional Content
Adobe Premiere Pro CS3 Third Party Content
Adobe Reader 7.0
Adobe Reader for Palm OS, 3.05
Adobe Setup
Adobe Shockwave Player
Adobe SING CS3
Adobe Soundbooth CS3
Adobe Soundbooth CS3 Codecs
Adobe Stock Photos CS3
Adobe SVG Viewer 3.0
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe Version Cue CS3 Server
Adobe Video Profiles
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP DVA Panels CS3
Adobe XMP Panels CS3
Advanced Uninstaller PRO - Version 9
Aerodesigns Airbus A318
aerosoft's - London Heathrow 2008
AHV content for Acrobat and Flash
Airbus Series Vol.1 Deluxe (FS2004)
Airbus Series Vol.2 (FS2004)
Apple Software Update
Ask Toolbar
Audio Mid Recorder 3.65
AusLogics Disk Defrag
AutoRotation Premium
AVG Free 8.5
AVS Video Converter 6
AVS4YOU Software Navigator 1.3
BCM V.92 56K Modem
BeerSmith Brewing Software
BitTorrent
BookSmart™ 1.8.1 1.8.1
C1 PRO 3.5
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon EOS-1Ds Mark II WIA Driver
Canon EOS 5D WIA Driver
Canon EOS Kiss_N REBEL_XT 350D WIA Driver
Canon iP1600
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities Digital Photo Professional 2.1
Canon Utilities Easy-PhotoPrint
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
Capture One 3.7.4
Capture One 3.7.8
Capture One PRO 3.6
CDex extraction audio
CERTS Writer
Cleaner 5 EZ
CLOUD9 Washington 1.01
CLOUD9 Washington 1.01 upd
Color Efex Pro 3.0 Complete
DAO
DeMoirize
Dfine 2.0
Digital Studio v5 5
DMI SATA RAID Manager
DNA
Documents To Go
DocuSign Express 2.5
doPDF 6.0 printer
DS21Patch
DUBAÏ 2004
DUBAÏ landclass
DUBAÏ mesh
DV NETWORK SOLUTION DISK
DVD X Copy Platinum 4.0.3
DVD X Rescue
DVDSentry
Earthmate Image Tagger
Easy-WebPrint
EPSON Perf 4870 Reference Guide
EPSON Scan
ETCC 2003 Mod
Extensis Mask Pro 3.0
Extensis PhotoGraphics 1.0
Extensis PhotoTools 2.0
F1 Challenge 99-02
FileAlyzer
FileZilla (remove only)
FileZilla Client [removed]
Form Viewer
FPCleaner [removed]
FSAutoStart
GamesBar 1.1.0.5
Google Earth
Google Toolbar for Internet Explorer
Google Updater
HijackThis 2.0.2
Hollywood FX Pack 26 - Extra FX
Hotfix for MDAC 2.80 (KB911562)
Hotfix for Windows XP (KB926239)
HP Deskjet D1500 Printer Driver Software 10.0 Rel .3
HP Imaging Device Functions 10.0
HP Photosmart Essential 2.5
HP Smart Web Printing
ICC Color Profiles
IF Plugin Pack
iFly 747-400
iFly 747-400 Service Pack 1
iFly 747-400 Service Pack 2
Intel® PRO Network Adapters and Drivers
Intel® PROSet
IsoBuster 2.5
J2SE Runtime Environment 5.0 Update 5
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Just Flight - Spitfire Mk1a v1.00
LiveUpdate 1.90 (Symantec Corporation)
Logitech® Camera Driver
Macromedia Extension Manager
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.5
Microsoft Color Control Panel Applet for Windows XP
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Expression Web 2
Microsoft Expression Web 2 MUI (English)
Microsoft Kernel-Mode Driver Framework Feature Pack 1.1
Microsoft Location Finder
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Silverlight
Microsoft Streets & Trips 2006
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Works 2002 Setup Launcher
Modem Helper
Move Networks Media Player for Internet Explorer
Mozilla Firefox (3.0.11)
MSN
MSN Music Assistant
MSXML 6.0 Parser (KB925673)
Netflix Movie Viewer
Netscape (7.2)
Next Generation Visualisations
nik Color Efex Pro Classic Set
NVIDIA Drivers
PDF Settings
PhotoTools 1.0 Professional Edition
Pinnacle Hollywood FX 4.6
PMDG 747-400 FS9 Update V1R12 (Unifies to FSX)
PMDG_747-400_Sound_Update
PMDG747_400 Queen of the Skies
PowerDVD
Qimage
QualityWings 757-200 v1.00 (Model Package Beta)
Quicken 2002 New User Edition
QuickTime
QuickTime 3.0
Real Alternative 1.50
RealAir Spitfire XIV
RegCure 1.6.0.0
SanDisk TransferMate
SCRABBLE Deluxe
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB958644)
Sentrilock Card Utility
Sharpener Pro 3.0
Shockwave
Shop for HP Supplies
Silver Efex Pro
SilverFast Epson
SilverFast Epson TWAIN
SilverFast SE CD Documentation 6.1.1
SmartDraw 2008
SmartDraw PDF Filter
Sonic MyDVD
Sonic RecordNow!
Spybot - Search & Destroy 1.4
Spyder3Pro
Spyware Doctor 6.0
SSC Service Utility v4.00
Studio 8
Studio Content CD
Sygate Personal Firewall Pro
Symantec AntiVirus Client
System Requirements Lab
The Panorama Factory
The Panorama Factory V4 m32 Edition
The Panorama Factory V5 m32 Edition
TweakNow RegCleaner Standard
Update for Windows XP (KB898461)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Verizon Online
Verizon Online Help and Support
Version 1.0
VideoLAN VLC media player 0.8.5
Viewpoint Media Player (Remove Only)
Virtual Earth 3D (Beta)
Viveza
WebEx
What's Running 2.2
Windows Driver Package - SCM Microsystems Inc. (SCR3xx USB Smart Card Reader) SmartCardReader (11/07/2006 4.35.00.01)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Player 11
Windows Presentation Foundation
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinPcap 3.1 beta3
WinRAR archiver
XnView 1.92
ZipForm Desktop

==== Event Viewer Messages From Past Week ========

6/7/2009 7:55:58 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PenClass
6/7/2009 7:55:58 AM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
6/7/2009 7:55:25 AM, error: Service Control Manager [7000] - The Norton AntiVirus Auto Protect Service service failed to start due to the following error: The system cannot find the path specified.
6/7/2009 7:55:20 AM, error: SCardSvr [610] - Smart Card Reader 'SCM Microsystems Inc. SCR35xx USB Smart Card Reader 0' rejected IOCTL GET_ATTRIBUTE: The request is not supported.
6/13/2009 12:51:22 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
6/13/2009 12:02:17 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the AVG Free8 WatchDog service to connect.
6/13/2009 12:02:17 AM, error: Service Control Manager [7000] - The AVG Free8 WatchDog service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/12/2009 11:07:58 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
6/12/2009 10:44:37 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/12/2009 10:44:14 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec magicpvt MRxSmb NetBIOS NetBT PenClass RasAcd Rdbss Tcpip wpsdrvnt WS2IFSL
6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
6/12/2009 10:44:14 PM, error: Service Control Manager [7001] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/12/2009 10:43:56 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/12/2009 10:12:04 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SHIRA that believes that it is the master browser for the domain on transport NetBT_Tcpip_{80E6BA5C-44B2-4E8E-8D5. The master browser is stopping or an election is being forced.

==== End Of File ===========================


Here's the GMER

GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-13 19:45:57
Windows 5.1.2600 Service Pack 2


—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwAllocateVirtualMemory [0xB7683B30]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF746C514]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF745B282]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF745B474]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwCreateThread [0xB76836F0]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF746CD00]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF746CFB8]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwMapViewOfSection [0xB7683470]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF746B3FA]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwProtectVirtualMemory [0xB7683C50]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF746D422]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF746C7D8]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwShutdownSystem [0xB7683990]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF745AF32]
SSDT \??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.) ZwWriteVirtualMemory [0xB7683D60]

INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B6D0716D
INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B6D06FC2

—- Kernel code sections - GMER 1.0.15 —-

? C:\WINDOWS\System32\Drivers\Beep.SYS The system cannot find the file specified. !
.text tcpip.sys!IPTransmit + 10BC B73F4CFA 6 Bytes CALL F7882C20 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text tcpip.sys!IPTransmit + 2810 B73F644E 6 Bytes CALL F7882C20 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text tcpip.sys!ARPRcv + 506D B73FB4E0 6 Bytes CALL F7882C20 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
.text wanarp.sys B76263FD 7 Bytes CALL F7882D70 Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!MmLockPagableDataSection] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeCancelTimer] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!MmUnlockPagableImageSection] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoStartNextPacket] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeSetTimer] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!_allmul] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoStartPacket] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeInitializeEvent] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeInitializeTimer] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeInitializeDpc] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoCreateDevice] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!RtlInitUnicodeString] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoAcquireCancelSpinLock] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeRemoveDeviceQueue] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!KeRemoveEntryDeviceQueue] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoReleaseCancelSpinLock] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IoDeleteDevice] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[ntoskrnl.exe!IofCompleteRequest] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[HAL.dll!ExReleaseFastMutex] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[HAL.dll!KfRaiseIrql] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[HAL.dll!KfLowerIrql] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[HAL.dll!HalMakeBeep] 00000000
IAT \SystemRoot\System32\Drivers\Beep.SYS[HAL.dll!ExAcquireFastMutex] 00000000
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F7883670] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F7883810] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F7883970] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F78838D0] Teefer.sys (Teefer Driver/Sygate Technologies, Inc.)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device \Driver\Tcpip \Device\Ip wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Tcp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Udp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\RawIp wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\IPMULTICAST wpsdrvnt.sys (wpsdrvnt/Sygate Technologies, Inc.)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 …
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 …
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E …
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 …
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 …
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 …
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x97 0x20 0x4E 0x9A …
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0xAA 0x52 0xC6 0x00 …
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 …
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x37 0xA4 0xAA 0xC3 …
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 …
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\System32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F …

—- Files - GMER 1.0.15 —-

File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\fujitsu_modem.gif 4241 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\other.jpg 45629 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell_2110_dual_connect.gif 6579 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\6100_front.jpg 6790 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\6100_setup_ethernet.jpg 20255 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\6100_setup_usb.jpg 20909 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\ActionTecLightsClose.gif 6504 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\action_gate.gif 6249 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\acttec_setup_eth.png 26732 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\acttec_usb.png 26770 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\acttec_wireless.png 25988 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\fujitsuLights.gif 3912 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\fujitsu_modem_power.gif 3838 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\fujitsu_setup.png 28000 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\fujitsu_speed_port.gif 4295 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\HomeNetworkRouter.gif 15421 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\Linksys.gif 5008 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\linksys_gateway.gif 5124 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\linksys_setup.png 20499 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\linksys_sm1.gif 6630 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\VersalinkLights_450.jpg 30092 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\Versalink_200.jpg 14531 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\VersaLink_setup_eth.png 22681 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\VersaLink_setup_wireless.png 22302 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\Westel.gif 4169 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell.gif 2463 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell1.gif 3254 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell2.gif 2788 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westellEthernetLights.gif 6097 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell_2200_dual_connect.gif 6699 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell_ethernet.gif 6195 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell_modem.gif 3727 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell_modem_1.gif 3245 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\westell_modem_power.gif 4734 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\west_22_dual_eth.png 20499 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\west_22_dual_usb.png 21142 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\west_dual_eth.png 19435 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\west_dual_usb.png 21343 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\west_eth_mod.png 21397 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\images\CPE\west_versa.gif 3276 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_displayVisableSSIDs.html 7104 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\startWireless.html 20477 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_CheckCables.html 2757 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_checkSettings.html 4957 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_connIssueFixed.html 1931 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_finalConnTest.html 1518 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_finalTest.html 5289 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_manualCheckModemSync.html 13738 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_manualModemRestart.html 2551 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_manualRouterRestart.html 2438 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_notNDIS.html 3111 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_noWNIC.html 3672 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_ReleaseNewIP.html 5374 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_resetWModem.html 12892 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_RouterModemConnected.html 2113 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_SSIDNotInList.html 4648 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\ConnectivityAssistant\wireless\wireless_staticModemInterfaceHelp.html 4325 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\Escalator\DSL\yahoo\Encoder.xsd 7906 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\Escalator\DSL\yahoo\Escalator.htm 35702 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\Escalator\DSL\yahoo\footer.htm 2474 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\Escalator\DSL\yahoo\ServiceConfig.xml 168700 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\Escalator\DSL\yahoo\Start.htm 1458 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\1800.js 2608 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\accntMgmt.js 579 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\alert.js 714 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\askToResetModem.js 859 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\asstError.js 687 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\bottom.js 445 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\bulletin.js 743 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\checkAMVersion.js 438 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\checkCable.js 2707 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\checkDialer.js 248 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\checkModem.js 1143 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\checkNetworkSettings.js 384 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\clientStat.js 418 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstCancel.js 551 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstEntry.js 737 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstModFail.js 924 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstNicFail.js 1268 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstNicFailUSB.js 783 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstRestorePassTestFail.js 1186 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstRestorePassTestPass.js 617 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstTestFail.js 1816 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstTestFailSameSettings.js 840 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstTestPass.js 1716 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstTestPassSameSettings.js 1488 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connDiag.js 568 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connRestoreFailed.js 731 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\cookie.js 932 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\dialerpassWd.js 468 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\dunRestoreFailed.js 1051 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\dunSuccess.js 1308 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\entry_reboot.js 565 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\entry_restart.js 791 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\escalator.js 2053 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\footer.js 1022 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\MotivePClient.js 434 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\nicselect.js 1319 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\nictest1.js 378 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\nictest2Multiple.js 1189 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\nictest2MultipleFail.js 952 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\noConnection.js 601 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\noProfileError.js 535 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\noStackError.js 722 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\OfflineDispatcher_UI.js 1240 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\passWd.js 507 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\performanceTest.js 1077 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\postinstall_passWd.js 596 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\post_install_Entry.js 395 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\pppoerestore.js 1207 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\pppoeRestoreFailed.js 1087 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\pppoeRestoreSuccess.js 1353 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\profilecreate.js 858 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\proxyRestoreFailed.js 1051 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\reboot.js 866 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\rebootNICPause.js 618 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\rebootProxyPause.js 620 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\restart.js 683 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\restoreDUNSettings.js 851 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\restoreNetworkSettings.js 921 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\restorePPPOESettings.js 896 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\restoreProxySettings.js 867 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\RouterSetupHelp.js 570 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\solution.js 727 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\stack1800.js 1488 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\start.js 929 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\survey.js 1909 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\thanks.js 384 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\tour_intro.js 346 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\welcome.js 1864 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\checkPPPOE.js 594 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\connAsstTest.js 1192 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\en\noModem.js 513 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\McciFirewall\McciScriptBaseFirewall.js 59999 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\McciFirewall\McciScriptFirewall.js 3696 bytes
File C:\Program Files\Verizon\OCB\48f0f770-6b1e-493d-9bfc-32ff32a6ee86\scripts\McciFirewall\McciScriptWindowsFirewall.js 46307 bytes
File C:\Program Files\Verizon\OCB\McciScripts\McciInstrumentation\BrowserInfo.js 38787 bytes
File C:\Program Files\Verizon\OCB\McciScripts\McciInstrumentation\EmailAccount.js 180103 bytes
File C:\Program Files\Verizon\OCB\McciScripts\McciInstrumentation\EmailClient.js 17391 bytes
File C:\Program Files\Verizon\OCB\McciScripts\McciInstrumentation\MachineInfo.js 85012 bytes
File C:\Program Files\Verizon\OCB\McciScripts\McciInstrumentation\NetworkInfo.js 82355 bytes
File C:\Program Files\Verizon\OCB\McciScripts\McciInstrumentation\VerizonCustom.js 35946 bytes
File C:\Program Files\Verizon\TechWizard\CW_setup.msi 7896064 bytes
File C:\Program Files\Verizon\TechWizard\devcon.exe 77312 bytes executable
File C:\Program Files\Verizon\TechWizard\FiOS.ico 25214 bytes
File C:\Program Files\Verizon\TechWizard\info.html 15379 bytes
File C:\Program Files\Verizon\TechWizard\myFios.ini 328 bytes
File C:\Program Files\Verizon\TechWizard\myJobInfo.ini 954 bytes
File C:\Program Files\Verizon\TechWizard\myWizard.ini 648 bytes
File C:\Program Files\VideoLAN\VLC\AUTHORS.txt 7983 bytes
File C:\Program Files\VideoLAN\VLC\COPYING.txt 18332 bytes
File C:\Program Files\VideoLAN\VLC\Documentation.url 54 bytes
File C:\Program Files\VideoLAN\VLC\http 0 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs 0 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\browse 2007 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\footer 1612 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\input 9717 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\main 5910 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\mosaic 6305 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\playlist 5869 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\sout 12577 bytes
File C:\Program Files\VideoLAN\VLC\http\dialogs\vlm 9816 bytes
File C:\Program Files\VideoLAN\VLC\http\favicon.ico 86358 bytes
File C:\Program Files\VideoLAN\VLC\http\iehacks.css 1426 bytes
File C:\Program Files\VideoLAN\VLC\http\images 0 bytes
File C:\Program Files\VideoLAN\VLC\http\images\prev.png 163 bytes
File C:\Program Files\VideoLAN\VLC\http\images\delete.png 198 bytes
File C:\Program Files\VideoLAN\VLC\http\images\delete_small.png 165 bytes
File C:\Program Files\VideoLAN\VLC\http\images\eject.png 155 bytes
File C:\Program Files\VideoLAN\VLC\http\images\empty.png 178 bytes
File C:\Program Files\VideoLAN\VLC\http\images\fullscreen.png 194 bytes
File C:\Program Files\VideoLAN\VLC\http\images\help.png 203 bytes
File C:\Program Files\VideoLAN\VLC\http\images\info.png 229 bytes
File C:\Program Files\VideoLAN\VLC\http\images\loop.png 173 bytes
File C:\Program Files\VideoLAN\VLC\http\images\minus.png 204 bytes
File C:\Program Files\VideoLAN\VLC\http\images\next.png 162 bytes
File C:\Program Files\VideoLAN\VLC\http\images\pause.png 149 bytes
File C:\Program Files\VideoLAN\VLC\http\images\play.png 178 bytes
File C:\Program Files\VideoLAN\VLC\http\images\playlist.png 147 bytes
File C:\Program Files\VideoLAN\VLC\http\images\playlist_small.png 145 bytes
File C:\Program Files\VideoLAN\VLC\http\images\plus.png 208 bytes
File C:\Program Files\VideoLAN\VLC\http\images\refresh.png 277 bytes
File C:\Program Files\VideoLAN\VLC\http\images\repeat.png 179 bytes
File C:\Program Files\VideoLAN\VLC\http\images\sd.png 194 bytes
File C:\Program Files\VideoLAN\VLC\http\images\shuffle.png 180 bytes
File C:\Program Files\VideoLAN\VLC\http\images\slider_bar.png 190 bytes
File C:\Program Files\VideoLAN\VLC\http\images\slider_left.png 203 bytes
File C:\Program Files\VideoLAN\VLC\http\images\slider_point.png 237 bytes
File C:\Program Files\VideoLAN\VLC\http\images\slider_right.png 204 bytes
File C:\Program Files\VideoLAN\VLC\http\images\slow.png 163 bytes
File C:\Program Files\VideoLAN\VLC\http\images\sort.png 182 bytes
File C:\Program Files\VideoLAN\VLC\http\images\sout.png 172 bytes
File C:\Program Files\VideoLAN\VLC\http\images\speaker.png 269 bytes
File C:\Program Files\VideoLAN\VLC\http\images\speaker_mute.png 446 bytes
File C:\Program Files\VideoLAN\VLC\http\images\stop.png 146 bytes
File C:\Program Files\VideoLAN\VLC\http\images\vlc16x16.png 618 bytes
File C:\Program Files\VideoLAN\VLC\http\images\volume_down.png 209 bytes
File C:\Program Files\VideoLAN\VLC\http\images\volume_up.png 225 bytes
File C:\Program Files\VideoLAN\VLC\http\images\white.png 169 bytes
File C:\Program Files\VideoLAN\VLC\http\images\white_cross_small.png 165 bytes
File C:\Program Files\VideoLAN\VLC\http\index.html 2473 bytes
File C:\Program Files\VideoLAN\VLC\http\js 0 bytes
File C:\Program Files\VideoLAN\VLC\http\js\functions.js 37376 bytes
File C:\Program Files\VideoLAN\VLC\http\js\mosaic.js 11058 bytes
File C:\Program Files\VideoLAN\VLC\http\js\vlm.js 31404 bytes
File C:\Program Files\VideoLAN\VLC\http\mosaic.html 2355 bytes
File C:\Program Files\VideoLAN\VLC\http\old 0 bytes
File C:\Program Files\VideoLAN\VLC\http\old\admin 0 bytes
File C:\Program Files\VideoLAN\VLC\http\old\admin\browse.html 2520 bytes
File C:\Program Files\VideoLAN\VLC\http\old\admin\dboxfiles.html 762 bytes
File C:\Program Files\VideoLAN\VLC\http\old\admin\index.html 4432 bytes
File C:\Program Files\VideoLAN\VLC\http\old\cone_minus.png 924 bytes
File C:\Program Files\VideoLAN\VLC\http\old\cone_plus.png 973 bytes
File C:\Program Files\VideoLAN\VLC\http\old\index.html 10093 bytes
File C:\Program Files\VideoLAN\VLC\http\old\info.html 630 bytes
File C:\Program Files\VideoLAN\VLC\http\old\style.css 1352 bytes
File C:\Program Files\VideoLAN\VLC\http\old\vlm 0 bytes
File C:\Program Files\VideoLAN\VLC\http\old\vlm\edit.html 3401 bytes
File C:\Program Files\VideoLAN\VLC\http\old\vlm\index.html 5977 bytes
File C:\Program Files\VideoLAN\VLC\http\old\vlm\new.html 2680 bytes
File C:\Program Files\VideoLAN\VLC\http\old\vlm\show.html 3352 bytes
File C:\Program Files\VideoLAN\VLC\http\old\webcam.html 1484 bytes
File C:\Program Files\VideoLAN\VLC\http\requests 0 bytes
File C:\Program Files\VideoLAN\VLC\http\requests\browse.xml 1945 bytes
File C:\Program Files\VideoLAN\VLC\http\requests\playlist.xml 2925 bytes
File C:\Program Files\VideoLAN\VLC\http\requests\readme.txt 2480 bytes
File C:\Program Files\VideoLAN\VLC\http\requests\status.xml 7010 bytes
File C:\Program Files\VideoLAN\VLC\http\requests\vlm.xml 4505 bytes
File C:\Program Files\VideoLAN\VLC\http\requests\vlm_cmd.xml 1511 bytes
File C:\Program Files\VideoLAN\VLC\http\style.css 4916 bytes
File C:\Program Files\VideoLAN\VLC\http\vlm.html 2040 bytes
File C:\Program Files\VideoLAN\VLC\http\vlm_export.html 301 bytes
File C:\Program Files\VideoLAN\VLC\libvlc.dll 7260160 bytes executable
File C:\Program Files\VideoLAN\VLC\locale 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ca 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo 138810 bytes
File C:\Program Files\VideoLAN\VLC\locale\da 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo 90496 bytes
File C:\Program Files\VideoLAN\VLC\locale\de 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo 371740 bytes
File C:\Program Files\VideoLAN\VLC\locale\en_GB 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\es 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\fr 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\gl 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\he 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\hi 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\hu 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\it 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ja 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ka 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ko 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\nl 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\oc 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\pt_BR 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ro 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\ru 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\sv 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\tr 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\zh_CN 0 bytes
File C:\Program Files\VideoLAN\VLC\locale\zh_TW 0 bytes
File C:\Program Files\VideoLAN\VLC\MAINTAINERS.txt 0 bytes
File C:\Program Files\VideoLAN\VLC\NEWS.txt 0 bytes
File C:\Program Files\VideoLAN\VLC\osdmenu 0 bytes
File C:\Program Files\VideoLAN\VLC\plugins 0 bytes
File C:\Program Files\VideoLAN\VLC\README.txt 0 bytes
File C:\Program Files\VideoLAN\VLC\skins 0 bytes
File C:\Program Files\VideoLAN\VLC\THANKS.txt 0 bytes
File C:\Program Files\VideoLAN\VLC\uninstall.exe 0 bytes
File C:\Program Files\VideoLAN\VLC\uninstall.log 0 bytes
File C:\Program Files\VideoLAN\VLC\VLC media player.url 0 bytes
File C:\Program Files\VideoLAN\VLC\vlc.exe 0 bytes
File C:\Program Files\VideoLAN\VLC\vlc.exe.manifest 0 bytes

—- EOF - GMER 1.0.15 —-



Thanks

Peter
Post #4
Hi,

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Post #5
Hi Here's the ComboFix text

ComboFix 09-06-13.05 - Peter 06/13/2009 23:17.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.843 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\progra~1\COMMON~1\{F4A84~1
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\INSTALL.LOG
c:\program files\WinPCap\NetMonInstaller.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\program files\WinPCap\Uninstall.exe
c:\windows\SYSTEM32\4881250.dll
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
G:\resycled
c:\documents and settings\New Folder (2)\AUTORUN.INF
c:\documents and settings\New Folder\AUTORUN.INF
c:\documents and settings\Peter\Application Data\wiaserva.log
c:\program files\INSTALL.LOG
c:\windows\patch.exe
c:\windows\system32\cs1sa1f.dll
c:\windows\system32\player.dll
c:\windows\system32\regsvr.exe
c:\windows\system32\uninstall.exe
F:\install.exe

c:\windows\system32\grpconv.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\grpconv.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_NPF


((((((((((((((((((((((((( Files Created from 2009-05-14 to 2009-06-14 )))))))))))))))))))))))))))))))
.

2009-06-14 03:28 . 2004-08-04 07:56 39424 —-a-w- c:\windows\system32\grpconv.exe
2009-06-14 03:28 . 2004-08-04 07:56 39424 —-a-w- c:\windows\system32\dllcache\grpconv.exe
2009-06-14 01:24 . 2009-06-14 02:05 ——– d–h–w- C:\$AVG8.VAULT$
2009-06-13 13:54 . 2009-06-13 13:54 ——– d—–w- c:\program files\Trend Micro
2009-06-13 12:55 . 2009-06-13 12:55 ——– d—–w- c:\documents and settings\All Users\Application Data\RegCure
2009-06-13 12:55 . 2009-06-13 14:15 ——– d—–w- c:\program files\RegCure
2009-06-13 12:49 . 2009-06-13 12:49 ——– d—–w- c:\documents and settings\Peter\Local Settings\Application Data\AVG Security Toolbar
2009-06-13 12:20 . 2009-06-13 12:20 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Help
2009-06-13 05:00 . 2009-06-02 17:37 1004800 —-a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-06-13 04:54 . 2009-06-13 04:54 ——– d—–w- c:\documents and settings\Administrator.HOME\Local Settings\Application Data\AVG Security Toolbar
2009-06-13 04:52 . 2009-06-13 04:52 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-13 04:52 . 2009-06-13 04:52 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-06-13 04:52 . 2009-06-13 04:52 327688 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-13 04:52 . 2009-06-13 04:52 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-13 04:51 . 2009-06-13 04:51 ——– d—–w- c:\windows\system32\drivers\Avg
2009-06-13 04:39 . 2009-06-13 04:39 ——– d—–w- c:\program files\Safer Networking
2009-06-13 04:29 . 2009-06-13 05:00 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-13 04:01 . 2009-06-13 04:01 ——– d—–w- c:\program files\AVG
2009-06-13 04:01 . 2009-06-13 04:51 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-06-13 02:44 . 2009-06-13 02:44 ——– d—–w- c:\documents and settings\Administrator.HOME\Local Settings\Application Data\Mozilla
2009-06-10 18:06 . 2009-06-10 18:06 ——– d—–w- c:\temp\logs
2009-06-10 18:06 . 2009-06-10 18:06 ——– d—–w- C:\Temp
2009-06-02 01:59 . 2009-06-02 01:59 ——– d—–w- c:\documents and settings\Peter\Application Data\Auslogics
2009-06-02 01:59 . 2009-06-02 01:59 ——– d—–w- c:\program files\Auslogics
2009-05-27 20:48 . 2009-05-27 23:38 ——– d—–w- c:\program files\F1 Challenge 99-02
2009-05-18 20:29 . 2009-05-18 20:29 542 —-a-w- c:\windows\eReg.dat
2009-05-18 19:41 . 2009-05-18 19:41 ——– d—–w- C:\Programme
2009-05-18 19:41 . 1999-06-25 13:55 149504 —-a-w- C:\UNWISE.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-14 03:33 . 2008-11-13 15:31 ——– d—–w- c:\program files\DNA
2009-06-14 03:33 . 2008-11-13 15:31 ——– d—–w- c:\documents and settings\Peter\Application Data\DNA
2009-06-14 03:31 . 2008-01-28 15:52 16 —-a-w- c:\windows\system32\magicpvt.dat
2009-06-13 18:12 . 2008-05-25 14:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-13 05:05 . 2008-11-20 13:32 ——– d—–w- c:\documents and settings\Peter\Application Data\HPAppData
2009-06-13 04:21 . 2007-04-13 01:33 ——– d—–w- c:\program files\BearShare
2009-06-13 03:15 . 2005-08-03 01:54 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-13 02:00 . 2007-03-22 06:12 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-12 13:57 . 2004-07-15 00:32 ——– d—–w- c:\documents and settings\Peter\Application Data\XnView
2009-06-09 01:39 . 2008-11-13 15:31 ——– d—–w- c:\documents and settings\Peter\Application Data\BitTorrent
2009-06-09 00:27 . 2007-09-05 19:11 ——– d—–w- c:\documents and settings\Peter\Application Data\dvdcss
2009-06-03 21:22 . 2009-04-22 22:55 2004 —-a-w- c:\windows\Registration\e10f24f0-652e-11dd-ad8b-0800200c9a66.dll
2009-06-02 01:33 . 2004-07-26 19:00 ——– d—–w- c:\program files\Innovative Solutions
2009-05-19 23:16 . 2004-03-13 22:20 ——– d—–w- c:\program files\Qimage
2009-05-19 19:24 . 2007-03-22 06:12 ——– d—–w- c:\program files\Spyware Doctor
2009-05-18 20:29 . 2008-12-22 18:39 ——– d—–w- c:\program files\EA SPORTS
2009-05-16 01:32 . 2009-03-19 17:24 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-05-13 12:17 . 2005-07-20 15:27 ——– d—–w- c:\program files\ZipForm Desktop
2009-04-23 02:22 . 2009-04-22 23:06 ——– d—–w- c:\documents and settings\Peter\Application Data\Nik Software
2009-04-23 00:46 . 2009-04-23 00:46 ——– d—–w- c:\documents and settings\Peter\Application Data\Apple Computer
2009-04-23 00:39 . 2003-10-07 18:41 ——– d—–w- c:\program files\QuickTime
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\program files\Apple Software Update
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-04-22 21:48 . 2009-04-22 21:48 ——– d—–w- c:\documents and settings\Peter\Application Data\onOne Software
2009-04-22 21:48 . 2009-04-22 21:48 ——– d—–w- c:\documents and settings\All Users\Application Data\onOne Software
2009-04-22 21:48 . 2006-06-12 04:57 ——– d—–w- c:\program files\onOne Software
2009-04-22 21:48 . 2003-10-07 18:41 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-04-22 21:14 . 2005-01-09 00:58 ——– d—–w- c:\program files\Extensis
2009-04-21 11:53 . 2008-02-23 02:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Napster
2009-03-22 14:14 . 2003-10-12 14:35 71384 -c–a-w- c:\documents and settings\Peter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-02-14 16:50 . 2008-01-30 16:07 61 –sh–w- c:\windows\cnerolf.dat
2005-05-26 22:15 . 2005-10-04 02:59 174080 -csha-w- c:\windows\SYSTEM32\sfpsys.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 22:20 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-02 17:37 1004800 —-a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-07 342848]
"Advanced Uninstaller PRO Installation Monitor"="c:\program files\Innovative Solutions\Advanced Uninstaller PRO - Version 9\monitor.exe" [2008-11-26 1340389]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2005-08-02 2376928]
"vptray"="c:\progra~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-10-08 221184]
"PinnacleDriverCheck"="c:\windows\System32\PSDrvCheck.exe" [2003-12-04 406016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-09-19 294912]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-13 1948440]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2007-12-05 1626112]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Monitor.lnk - c:\program files\SanDisk\SanDisk TransferMate\SD Monitor.exe [2008-12-30 114688]
SentriLockCardUtility.lnk - c:\windows\Installer\{C9B8D365-A6C3-4C4D-9624-0F0078FEB1B4}\Icon037926361.exe [2008-12-5 84480]
Spyder3Utility.lnk - c:\program files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe [2008-3-19 6333954]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-13 04:52 11952 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\beep.sys]
@="beep"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^DMI RAID Manager.lnk]
backup=c:\windows\pss\DMI RAID Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^palmOne Registration.lnk]
backup=c:\windows\pss\palmOne Registration.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo 2200

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MagicTuneEngine"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpnsvr.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\WINDOWS\\SYSTEM32\\dxdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"c:\\Program Files\\Microsoft Expression\\Web 2\\WebDesigner\\EXPRWD.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R0 inic1622;inic1622;c:\windows\SYSTEM32\DRIVERS\dmi1622.sys [12/24/2004 12:35 PM 45056]
R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [3/19/2009 1:24 PM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [6/13/2009 12:52 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [6/13/2009 12:52 AM 108552]
R1 magicpvt;magicpvt;c:\windows\SYSTEM32\DRIVERS\magicpvt.sys [1/28/2008 11:52 AM 9728]
R2 P1C1394;Phase One 1394 Camera Driver;c:\windows\SYSTEM32\DRIVERS\p1c1394.sys [6/9/2004 6:12 PM 23168]
R3 SCR3xx USB Smart Card Reader;SCR3xx USB Smart Card Reader;c:\windows\SYSTEM32\DRIVERS\SCR3XX2K.sys [12/5/2008 10:28 AM 47488]
R3 Spyder3;Datacolor Spyder3;c:\windows\SYSTEM32\DRIVERS\Spyder3.sys [3/19/2008 4:26 PM 12288]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [6/13/2009 12:51 AM 298776]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/26/2008 12:55 PM 348752]
S3 SNL320XP;SONIX MULTIMEDIA USB DEVICE DRIVER;c:\windows\SYSTEM32\DRIVERS\9kdUSBXP.sys [12/29/2008 2:01 PM 16000]
S4 .anattns;.anattns; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-06-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-25 15:47]

2003-10-12 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 07:56]

2009-06-14 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-14 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-13 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-14 c:\windows\Tasks\SDMsgUpdate (SD).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-02-18 19:39]

2009-06-14 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-02-02 22:38]
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{AD0ACA58-656F-61DA-9DFE-5D20F4F611BA} - c:\windows\system32\cs1sa1f.dll


.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.dellnet.com
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
LSP: c:\windows\system32\4881250.dll
DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} - hxxp://www.virgindigital.co.uk/activeX/VirginWMA.cab
DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} - hxxp://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB
DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} - hxxp://www.printroom.com/ImageUploader4.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-13 23:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,28,2d,d3,bf,81,
87,09,da,e2,63,26,f1,3f,c8,ff,68,c8,19,07,00,81,c0,17,ab,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,74,00,0d,8d,b6,
87,52,3e,6a,9c,d6,61,af,45,84,18,ab,e2,ef,4f,de,4d,a7,75,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,03,bc,e7,ee,b1,
ae,ec,e4,ff,7c,85,e0,43,d4,0e,fe,ab,4e,74,ac,f0,df,59,2b,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,fe,3c,a9,b6,2f,
02,3b,f9,86,8c,21,01,be,91,eb,e7,45,4d,91,14,29,87,aa,b7,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,7b,b7,fb,0e,11,
3c,d1,85,f5,1d,4d,73,a8,13,5c,05,58,5f,15,6d,5a,14,1f,04,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ad,7e,84,e5,3c,
86,48,52,df,20,58,62,78,6b,cf,c8,60,c8,11,04,99,74,4f,dd,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,27,a4,45,8f,1f,
d8,db,f8,fb,a7,78,e6,12,2f,9a,ea,98,dc,1d,42,15,c7,1b,5a,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,f7,05,35,16,94,
89,6d,14,01,3a,48,fc,e8,04,4a,f1,68,e2,ce,fe,e5,29,ec,a2,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ea,60,f2,2d,8a,
3b,5e,72,f6,0f,4e,58,98,5b,89,c9,07,4d,d9,3c,2b,3b,2e,a9,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,ee,d2,5e,d5,93,
8f,ea,a3,3d,ce,ea,26,2d,45,aa,78,a9,d8,4c,08,8c,b4,c6,c9,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,ab,62,2e,91,5f,
68,c1,fe,2a,b7,cc,b5,b9,7f,41,e7,0d,c5,1a,0c,f0,b4,53,5c,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,e2,5b,25,9d,08,
c1,2a,1b,6c,43,2d,1e,aa,22,2f,9c,ee,72,de,f9,4c,96,a0,a6,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1552)
c:\windows\system32\nview.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\scardsvr.exe
c:\progra~1\SYMANT~1\SYMANT~1\DefWatch.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSvc.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\SYMANT~1\SYMANT~1\Rtvscan.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\SYSTEM32\CF19978.exe
c:\windows\SYSTEM32\rundll32.exe
c:\windows\SYSTEM32\rundll32.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-14 23:42 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-14 03:42

Pre-Run: 60,730,232,832 bytes free
Post-Run: 60,707,409,920 bytes free

346


The computer seems a lot better but I'm still totally un-able to get online.

Thanks

Peter
Post #6
OK,

Lets try a few things to see if we can get you back connected:

Please try the following:

Please reset IE

  • Go to Start > Control Panel, and choose Network Connections.
  • Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
  • Click the Networking tab
  • Double-click on the Internet Protocol (TCP/IP) item.
  • Write down the settings in case you should need to change them back.
  • Select the radio button that says "Obtain DNS servers automatically".
  • Click OK twice to get out of the properties screen and restart your computer.
  • If not prompted to reboot go ahead and reboot manually.

In I.E.
  • Check internet options settings.
  • Tools > Internet Options > Connections
  • LAN settings
  • Choose "automatically detect settings"
  • uncheck both proxy settings boxes

In FireFox
  • Click on Advanced -> Network -> Setttings…
  • the No Proxy option should be selected

If still no luck - try this:

  • Go to Start > Run > type: cmd
  • Press OK or Hit Enter.
  • At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
  • Hit Enter.
  • You will get a confirmation that the flush was successful.
  • Close the command box.


Then Try this:

  • Go to Start > Control Panel > Network Connections.
  • Right click on the Network icon > select "Repair"

[external image: Posted Image]


If no luck still - try this:

Try the IPconfig command.

Go to Start > Run then type: CMD into the run box

You will now see a black DOS-like screen.

Type the following at the command prompt:

IPconfig /Renew (Note the space between the "g" and the slash / it needs to be there)

Hit enter

See if you get your connection back


If you are back connected - please let me know which option worked.

Thanks
Post #7
I did everything you suggested, but unfortunately still have no connection I tried to ping goggle.com, but the request timed out. The ping statistics were: packet: sent = 4, received = 0, lost = 4 Thank you so much for all of your help. Do you have any other suggestions?!?!
Post #8 last edited
Hi,

Not as far as getting you back on line, no

I'll have to send you to our tech experts for that,


One last ditch effort - You have Sygate Personal Firewall Pro installed. Try uninstalling that for the moment - it can always be reinstalled - see if that is blocking your access.

in the mean time we can continue cleaning your system:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

File::
c:\windows\cnerolf.dat

Driver::
.anattns

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Still more programs to download and transfer over:

Download Flash_Disinfector.exe from HERE and save it to your desktop.

  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.

NEXT

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
Post #9
Touch wood, everything seems to be ok now. I ran all the scans you suggested and now I even have internet connection again. Thanks for all your help. Peter
Post #10 last edited
Hi, we're not finished yet…so stay with me, we have some clean up to do.

just for my reference - what got you back on line?

can you post the log from malware bytes.

Now you are back on line, there is one more scan i need you to run:

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner


1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #11
I don't know what exactly got me back on-line because I ran so many different scans etc. But it seemed to come back after I uninstalled Symantec and Sygate. Here's the Malwarebyte log Malwarebytes' Anti-Malware 1.37 Database version: 2276 Windows 5.1.2600 Service Pack 2 6/14/2009 12:56:21 PM mbam-log-2009-06-14 (12-56-21).txt Scan type: Quick Scan Objects scanned: 109703 Time elapsed: 4 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #12 last edited
That's good… Did you re-install symantec and Sygate or do you wish me to recommend alternatives? (I'd like to see the latest ComboFix log as well please)
Post #13
I didn't re-install them, if you have alternatives that would be great.
Here's the other log

ComboFix 09-06-13.05 - Peter 06/14/2009 12:27.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1535.948 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Peter\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\cnerolf.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\cnerolf.dat

.
((((((((((((((((((((((((( Files Created from 2009-05-14 to 2009-06-14 )))))))))))))))))))))))))))))))
.

2009-06-14 14:31 . 2002-01-08 21:00 176128 —-a-w- c:\windows\system32\RcdScan.dll
2009-06-14 14:31 . 1998-06-18 03:00 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2009-06-14 03:28 . 2004-08-04 07:56 39424 —-a-w- c:\windows\system32\grpconv.exe
2009-06-14 03:28 . 2004-08-04 07:56 39424 —-a-w- c:\windows\system32\dllcache\grpconv.exe
2009-06-14 01:24 . 2009-06-14 02:05 ——– d–h–w- C:\$AVG8.VAULT$
2009-06-13 13:54 . 2009-06-13 13:54 ——– d—–w- c:\program files\Trend Micro
2009-06-13 12:55 . 2009-06-13 12:55 ——– d—–w- c:\documents and settings\All Users\Application Data\RegCure
2009-06-13 12:55 . 2009-06-13 14:15 ——– d—–w- c:\program files\RegCure
2009-06-13 12:49 . 2009-06-13 12:49 ——– d—–w- c:\documents and settings\Peter\Local Settings\Application Data\AVG Security Toolbar
2009-06-13 12:20 . 2009-06-13 12:20 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Help
2009-06-13 05:00 . 2009-06-02 17:37 1004800 —-a-w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar\IEToolbar.dll
2009-06-13 04:54 . 2009-06-13 04:54 ——– d—–w- c:\documents and settings\Administrator.HOME\Local Settings\Application Data\AVG Security Toolbar
2009-06-13 04:52 . 2009-06-13 04:52 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-06-13 04:52 . 2009-06-13 04:52 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-06-13 04:52 . 2009-06-13 04:52 327688 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-13 04:52 . 2009-06-13 04:52 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-13 04:51 . 2009-06-13 04:51 ——– d—–w- c:\windows\system32\drivers\Avg
2009-06-13 04:39 . 2009-06-13 04:39 ——– d—–w- c:\program files\Safer Networking
2009-06-13 04:29 . 2009-06-13 05:00 ——– d—–w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-06-13 04:01 . 2009-06-13 04:01 ——– d—–w- c:\program files\AVG
2009-06-13 04:01 . 2009-06-14 15:39 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-06-13 02:44 . 2009-06-13 02:44 ——– d—–w- c:\documents and settings\Administrator.HOME\Local Settings\Application Data\Mozilla
2009-06-10 18:06 . 2009-06-10 18:06 ——– d—–w- c:\temp\logs
2009-06-10 18:06 . 2009-06-10 18:06 ——– d—–w- C:\Temp
2009-06-02 01:59 . 2009-06-02 01:59 ——– d—–w- c:\documents and settings\Peter\Application Data\Auslogics
2009-06-02 01:59 . 2009-06-02 01:59 ——– d—–w- c:\program files\Auslogics
2009-05-27 20:48 . 2009-05-27 23:38 ——– d—–w- c:\program files\F1 Challenge 99-02
2009-05-18 20:29 . 2009-05-18 20:29 542 —-a-w- c:\windows\eReg.dat
2009-05-18 19:41 . 2009-05-18 19:41 ——– d—–w- C:\Programme
2009-05-18 19:41 . 1999-06-25 13:55 149504 —-a-w- C:\UNWISE.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-14 16:32 . 2008-01-28 15:52 16 —-a-w- c:\windows\system32\magicpvt.dat
2009-06-14 15:46 . 2004-02-02 13:29 ——– d—–w- c:\program files\Symantec_Client_Security
2009-06-14 15:44 . 2004-02-02 13:29 ——– d—–w- c:\program files\Symantec
2009-06-14 15:44 . 2004-02-02 13:29 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-06-14 14:50 . 2008-11-20 13:32 ——– d—–w- c:\documents and settings\Peter\Application Data\HPAppData
2009-06-14 14:33 . 2003-10-07 18:41 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-06-14 13:14 . 2008-11-13 15:31 ——– d—–w- c:\documents and settings\Peter\Application Data\DNA
2009-06-14 11:42 . 2008-09-05 17:21 ——– d—–w- c:\program files\Verizon
2009-06-14 11:26 . 2008-11-13 15:31 ——– d—–w- c:\program files\DNA
2009-06-13 18:12 . 2008-05-25 14:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2009-06-13 04:21 . 2007-04-13 01:33 ——– d—–w- c:\program files\BearShare
2009-06-13 03:15 . 2005-08-03 01:54 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-06-13 02:00 . 2007-03-22 06:12 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-12 13:57 . 2004-07-15 00:32 ——– d—–w- c:\documents and settings\Peter\Application Data\XnView
2009-06-09 01:39 . 2008-11-13 15:31 ——– d—–w- c:\documents and settings\Peter\Application Data\BitTorrent
2009-06-09 00:27 . 2007-09-05 19:11 ——– d—–w- c:\documents and settings\Peter\Application Data\dvdcss
2009-06-03 21:22 . 2009-04-22 22:55 2004 —-a-w- c:\windows\Registration\e10f24f0-652e-11dd-ad8b-0800200c9a66.dll
2009-06-02 01:33 . 2004-07-26 19:00 ——– d—–w- c:\program files\Innovative Solutions
2009-05-19 23:16 . 2004-03-13 22:20 ——– d—–w- c:\program files\Qimage
2009-05-19 19:24 . 2007-03-22 06:12 ——– d—–w- c:\program files\Spyware Doctor
2009-05-18 20:29 . 2008-12-22 18:39 ——– d—–w- c:\program files\EA SPORTS
2009-05-16 01:32 . 2009-03-19 17:24 130936 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2009-05-13 12:17 . 2005-07-20 15:27 ——– d—–w- c:\program files\ZipForm Desktop
2009-04-23 02:22 . 2009-04-22 23:06 ——– d—–w- c:\documents and settings\Peter\Application Data\Nik Software
2009-04-23 00:46 . 2009-04-23 00:46 ——– d—–w- c:\documents and settings\Peter\Application Data\Apple Computer
2009-04-23 00:39 . 2003-10-07 18:41 ——– d—–w- c:\program files\QuickTime
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\program files\Apple Software Update
2009-04-23 00:38 . 2009-04-23 00:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2009-04-22 21:48 . 2009-04-22 21:48 ——– d—–w- c:\documents and settings\Peter\Application Data\onOne Software
2009-04-22 21:48 . 2009-04-22 21:48 ——– d—–w- c:\documents and settings\All Users\Application Data\onOne Software
2009-04-22 21:48 . 2006-06-12 04:57 ——– d—–w- c:\program files\onOne Software
2009-04-22 21:14 . 2005-01-09 00:58 ——– d—–w- c:\program files\Extensis
2009-04-21 11:53 . 2008-02-23 02:04 ——– d—–w- c:\documents and settings\All Users\Application Data\Napster
2009-03-22 14:14 . 2003-10-12 14:35 71384 -c–a-w- c:\documents and settings\Peter\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2005-05-26 22:15 . 2005-10-04 02:59 174080 -csha-w- c:\windows\SYSTEM32\sfpsys.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-06-14_03.34.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2003-01-03 15:36 . 2003-01-03 15:36 20480 c:\windows\SYSTEM32\ControlSuite.exe
+ 2002-08-20 18:54 . 2002-08-20 18:54 94208 c:\windows\SYSTEM32\cabw32.dll
+ 2002-12-26 20:53 . 2002-12-26 20:53 36864 c:\windows\SYSTEM32\BSelList.dll
+ 2003-01-03 15:36 . 2003-01-03 15:36 98304 c:\windows\SYSTEM32\BacsTray.exe
+ 2009-06-14 11:42 . 2009-06-14 13:27 29696 c:\windows\Installer\{F9AD4AFD-0533-4172-98CA-2D3D418FB18D}\IconF0CEFCC9.exe
+ 2008-06-13 14:39 . 2008-03-04 21:58 77312 c:\windows\DEVCON.EXE
+ 2000-11-10 18:57 . 2000-11-10 18:57 5025 c:\windows\SYSTEM32\patterns.dat
+ 2002-03-13 19:20 . 2002-03-13 19:20 6057 c:\windows\SYSTEM32\DRIVERS\BASFND.sys
+ 2002-12-09 17:58 . 2002-12-09 17:58 393216 c:\windows\SYSTEM32\BMAPI.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-07-17 22:20 279944 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced Uninstaller PRO Installation Monitor"="c:\program files\Innovative Solutions\Advanced Uninstaller PRO - Version 9\monitor.exe" [2008-11-26 1340389]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-10-08 221184]
"PinnacleDriverCheck"="c:\windows\System32\PSDrvCheck.exe" [2003-12-04 406016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2003-09-19 294912]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2007-12-05 1626112]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Monitor.lnk - c:\program files\SanDisk\SanDisk TransferMate\SD Monitor.exe [2008-12-30 114688]
SentriLockCardUtility.lnk - c:\windows\Installer\{C9B8D365-A6C3-4C4D-9624-0F0078FEB1B4}\Icon037926361.exe [2008-12-5 84480]
Spyder3Utility.lnk - c:\program files\Datacolor\Spyder3Pro\Utility\Spyder3Utility.exe [2008-3-19 6333954]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-06-13 04:52 11952 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\beep.sys]
@="beep"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HotSync Manager.lnk]
backup=c:\windows\pss\HotSync Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^DMI RAID Manager.lnk]
backup=c:\windows\pss\DMI RAID Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Peter^Start Menu^Programs^Startup^palmOne Registration.lnk]
backup=c:\windows\pss\palmOne Registration.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MagicTuneEngine"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpnsvr.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\WINDOWS\\SYSTEM32\\dxdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"c:\\Program Files\\Microsoft Expression\\Web 2\\WebDesigner\\EXPRWD.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

R0 inic1622;inic1622;c:\windows\SYSTEM32\DRIVERS\dmi1622.sys [12/24/2004 12:35 PM 45056]
R0 PCTCore;PCTools KDS;c:\windows\SYSTEM32\DRIVERS\PCTCore.sys [3/19/2009 1:24 PM 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [6/13/2009 12:52 AM 327688]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [6/13/2009 12:52 AM 108552]
R1 magicpvt;magicpvt;c:\windows\SYSTEM32\DRIVERS\magicpvt.sys [1/28/2008 11:52 AM 9728]
R2 P1C1394;Phase One 1394 Camera Driver;c:\windows\SYSTEM32\DRIVERS\p1c1394.sys [6/9/2004 6:12 PM 23168]
R3 Spyder3;Datacolor Spyder3;c:\windows\SYSTEM32\DRIVERS\Spyder3.sys [3/19/2008 4:26 PM 12288]
S2 avg8wd;AVG Free8 WatchDog; [x]
S3 PciCon;PciCon;\??\d:\pcicon.sys –> d:\PciCon.sys [?]
S3 SCR3xx USB Smart Card Reader;SCR3xx USB Smart Card Reader;c:\windows\SYSTEM32\DRIVERS\SCR3XX2K.sys [12/5/2008 10:28 AM 47488]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [4/26/2008 12:55 PM 348752]
S3 SNL320XP;SONIX MULTIMEDIA USB DEVICE DRIVER;c:\windows\SYSTEM32\DRIVERS\9kdUSBXP.sys [12/29/2008 2:01 PM 16000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-06-14 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-25 15:47]

2003-10-12 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 07:56]

2009-06-14 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-14 c:\windows\Tasks\RegCure Startup.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-13 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2009-06-10 22:28]

2009-06-14 c:\windows\Tasks\SDMsgUpdate (SD).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-02-18 19:39]

2009-06-14 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-02-02 22:38]
.
- - - - ORPHANS REMOVED - - - -

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
ShellExecuteHooks-{AD0ACA58-656F-61DA-9DFE-5D20F4F611BA} - (no file)


.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.dellnet.com
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=%s
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
DPF: {15AC034D-14DF-4AF8-9D02-29E1F56A8235} - hxxp://www.virgindigital.co.uk/activeX/VirginWMA.cab
DPF: {2AD5DBAE-2DDB-11D4-A96C-00E09872DF17} - hxxp://www.printroom.com/_vti_dnl/PrintroomUploaderX3.CAB
DPF: {85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326} - hxxp://www.printroom.com/ImageUploader4.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-14 12:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,28,2d,d3,bf,81,
87,09,da,e2,63,26,f1,3f,c8,ff,68,c8,19,07,00,81,c0,17,ab,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,74,00,0d,8d,b6,
87,52,3e,6a,9c,d6,61,af,45,84,18,ab,e2,ef,4f,de,4d,a7,75,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,03,bc,e7,ee,b1,
ae,ec,e4,ff,7c,85,e0,43,d4,0e,fe,ab,4e,74,ac,f0,df,59,2b,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,fe,3c,a9,b6,2f,
02,3b,f9,86,8c,21,01,be,91,eb,e7,45,4d,91,14,29,87,aa,b7,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,7b,b7,fb,0e,11,
3c,d1,85,f5,1d,4d,73,a8,13,5c,05,58,5f,15,6d,5a,14,1f,04,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,ad,7e,84,e5,3c,
86,48,52,df,20,58,62,78,6b,cf,c8,60,c8,11,04,99,74,4f,dd,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:97,20,4e,9a,c7,f1,35,ee,27,a4,45,8f,1f,
d8,db,f8,fb,a7,78,e6,12,2f,9a,ea,98,dc,1d,42,15,c7,1b,5a,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,f7,05,35,16,94,
89,6d,14,01,3a,48,fc,e8,04,4a,f1,68,e2,ce,fe,e5,29,ec,a2,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ea,60,f2,2d,8a,
3b,5e,72,f6,0f,4e,58,98,5b,89,c9,07,4d,d9,3c,2b,3b,2e,a9,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,ee,d2,5e,d5,93,
8f,ea,a3,3d,ce,ea,26,2d,45,aa,78,a9,d8,4c,08,8c,b4,c6,c9,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,ab,62,2e,91,5f,
68,c1,fe,2a,b7,cc,b5,b9,7f,41,e7,0d,c5,1a,0c,f0,b4,53,5c,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\System32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,e2,5b,25,9d,08,
c1,2a,1b,6c,43,2d,1e,aa,22,2f,9c,ee,72,de,f9,4c,96,a0,a6,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3844)
c:\windows\system32\nview.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\scardsvr.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSvc.exe
c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\SYSTEM32\rundll32.exe
c:\program files\SentrilockCardUtility\SentriLockCardUtility.exe
c:\windows\SYSTEM32\rundll32.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-06-14 12:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-14 16:41
ComboFix2.txt 2009-06-14 16:16
ComboFix3.txt 2009-06-14 03:42

Pre-Run: 60,655,898,624 bytes free
Post-Run: 60,640,067,584 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

333
Post #14
Hi,

For an AntiVirus, I highly recommend one of the following free programs:

Avira AntiVir
Avast
AVG

set the one you choose to receive automatic updates so you are always as fully protected as possible from the newest virus threats.
NOTE: DO NOT install more than one anti-virus program as they will conflict, and provide less protection, not more.

For a third party Firewall, I highly recommend one of these free firewalls:

Comodo
Sunbelt Kerio
NOTE: DO NOT install more than one firewall.

Note: If you choose Comodo - Please be careful with the installation of the Comodo program, it comes bundled with an adware toolbar which you need to de-select when you are going through the installation process. It's not a malicious program, but it may be a privacy risk and I don't think you want it on your system.


Personally, I use Avira AntiVir and Comodo, but all the recommended programs are excellent.


I shall await the results of the Kaspersky scan, then we can do the final clean up.

please be patient with Kaspersky it can take several hours (takes 3hrs on my machine)
Post #15
Here's the Kasp log ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, June 15, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, June 15, 2009 12:27:39 Records in database: 2345167 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan statistics: Files scanned: 394440 Threat name: 6 Infected objects: 7 Suspicious objects: 2 Duration of the scan: 07:37:52 File name / Threat name / Threats count C:\data Infected: Trojan-Downloader.Win32.IstBar.ja 1 C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 2 C:\shira laptop\BSINSTALL.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1688\A0231459.exe Infected: not-a-virus:AdWare.Win32.180Solutions.ao 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1734\A0237349.exe Infected: not-a-virus:FraudTool.Win32.SecurityCenter.as 1 F:\temp\BSINSTALL.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z 1 F:\temp\BSINSTALL.exe Infected: not-a-virus:WebToolbar.Win32.WhenU.a 1 L:\temp\BSINSTALL.exe Infected: not-a-virus:AdWare.Win32.180Solutions.ao 1 The selected area was scanned.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI