What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Unremovable Spyware

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

My log is below. When I run AdAware it tells me I have virtumode.
Thanks in advance for any assistance.

—–
Logfile of HijackThis v1.99.1
Scan saved at 8:52:25 PM, on 30/06/2008
Platform: Unknown Windows (WinNT 6.00.1905 SP1)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3D4900F1-40B0-40F4-AC5A-48302648C349} - C:\Windows\system32\yATNhggE.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O20 - AppInit_DLLs: C:\Windows\system32\__c00C2E4E.dat
O21 - SSODL: WLogon - {C222CF11-145F-2FF2-31AC-F613D471C63D} - C:\Windows\system32\wlogon32.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
Post #2
Hi, and Welcome to WhatTheTech :)

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
As I am still training, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.

jpshortstuff
Post #4
Hi

Please remove HijackThis from your computer and download the newest version:
HijackThis version 2.0.2


Download ComboFix by sUBs from here or here

Note: If you already have a copy of ComboFix on your system it is essential that you delete it before downloading this copy.

**Save it to your desktop**

We need to disable one or more of your security programs so that they do not interfere with ComboFix.

Ad-Aware Ad-Watch
  • Right click on the Ad-Watch icon in the system tray.
  • At the bottom of the screen there will be two checkable items called "Active" and "Automatic".
    • Active: This will turn Ad-Watch On\Off without closing it.
    • Automatic: Suspicious activity will be blocked automatically.
  • Uncheck both of those boxes.
  • (When done, you can re-enable it using the same steps but this time check both boxes.)
Double click on ComboFix.exe & follow the prompts.
When finished, it shall produce a log for you. Please save that log to post in your next reply along with a fresh HJT log

Notes:
  • Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  • ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
  • Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.
  • ComboFix disconnects your machine from the internet when it runs. This connection should be automatically restored when ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

You don't appear to be running any Anti-Virus software.

Install Anti-Virus software! Without any anti-virus software, your computer is wide open to infection. If you don't have any Anti-Virus software I strongly recommend you download Avast! or AVG Free


I need to see another log from HijackThis.
  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.
Thanks.
Post #5
Thank you,

Logs and stuff below

—-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:52:39 PM, on 5/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\notepad.exe
C:\Windows\Explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Duncan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O20 - AppInit_DLLs: C:\Windows\system32\__c00C2E4E.dat
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

–
End of file - 5966 bytes
—-

now combofix

—-

ComboFix 08-07-04.2 - Duncan 2008-07-05 13:47:16.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2148 [GMT 10:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\ekyqrbpo.dll
C:\Windows\system32\uepsrkcy.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
.

2008-06-28 22:45 . 2008-06-28 22:45 d——– C:\Users\Duncan\AppData\Roaming\Uniblue
2008-06-28 22:43 . 2008-06-28 22:45 d–h—– C:\Users\All Users\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
2008-06-28 22:43 . 2008-06-28 22:45 d–h—– C:\ProgramData\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
2008-06-25 00:27 . 2008-06-25 00:28 d——– C:\Users\All Users\Lavasoft
2008-06-25 00:27 . 2008-06-25 00:28 d——– C:\ProgramData\Lavasoft
2008-06-25 00:27 . 2008-06-25 00:27 d——– C:\Program Files\Lavasoft
2008-06-25 00:05 . 2008-07-05 13:26 2,000 –ah—– C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2008-06-25 00:05 . 2008-07-05 13:26 2,000 –ah—– C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2008-06-18 12:55 . 2008-06-29 20:19 d——– C:\Users\Duncan\AppData\Roaming\SPORE Creature Creator
2008-06-18 12:55 . 2008-06-18 12:55 107,888 –a—— C:\Windows\System32\CmdLineExt.dll
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Videos
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Searches
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Saved Games
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Pictures
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Music
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Links
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Downloads
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Documents
2008-06-18 12:53 . 2008-06-18 12:53 d——– C:\Users\All Users\Electronic Arts
2008-06-18 12:53 . 2008-06-18 12:53 d——– C:\ProgramData\Electronic Arts
2008-06-18 12:53 . 2008-06-18 12:53 1,912 –a—— C:\Windows\System32\ealregsnapshot1.reg
2008-06-18 12:52 . 2008-06-18 12:53 d——– C:\Program Files\Electronic Arts
2008-06-17 23:04 . 2008-06-17 23:04 d——– C:\Users\Duncan\AppData\Roaming\Media Player Classic
2008-06-15 14:20 . 2008-06-15 14:20 d——– C:\Users\Duncan\Phone Browser
2008-06-15 14:20 . 2008-06-15 14:20 0 –ah—– C:\Windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-06-15 14:18 . 2008-06-15 14:19 d——– C:\Users\All Users\PC Suite
2008-06-15 14:18 . 2008-06-15 14:19 d——– C:\ProgramData\PC Suite
2008-06-15 14:10 . 2008-06-15 14:19 d——– C:\Users\Duncan\AppData\Roaming\Nokia
2008-06-15 14:09 . 2008-06-15 14:09 d——– C:\Program Files\DIFX
2008-06-15 14:09 . 2008-06-15 14:09 d——– C:\Program Files\Common Files\PCSuite
2008-06-15 14:09 . 2008-06-15 14:09 d——– C:\Program Files\Common Files\Nokia
2008-06-15 14:08 . 2008-06-15 14:18 d——– C:\Users\Duncan\AppData\Roaming\PC Suite
2008-06-15 14:08 . 2008-06-15 14:08 d——– C:\Program Files\PC Connectivity Solution
2008-06-15 14:06 . 2008-06-15 14:09 d——– C:\Program Files\Nokia
2008-06-15 14:06 . 2007-02-22 11:15 90,624 –a—— C:\Windows\System32\nmwcdcls.dll
2008-06-15 14:02 . 2008-06-15 14:40 d——– C:\Users\Duncan\AV Stuff
2008-06-15 14:02 . 2008-06-15 14:03 d——– C:\Users\All Users\Installations
2008-06-15 14:02 . 2008-06-15 14:03 d——– C:\ProgramData\Installations
2008-06-15 00:17 . 2008-06-15 00:17 319 –a—— C:\Windows\game.ini
2008-06-14 23:56 . 2008-06-14 23:56 d——– C:\Program Files\Activision
2008-06-14 23:52 . 2008-06-14 23:52 d–hs—- C:\Windows\ftpcache
2008-06-14 21:00 . 2008-06-14 21:00 d——– C:\Program Files\Steam Buster
2008-06-11 18:40 . 2008-04-25 12:12 1,383,424 –a—— C:\Windows\System32\mshtml.tlb
2008-06-11 18:40 . 2008-04-26 18:08 1,314,816 –a—— C:\Windows\System32\quartz.dll
2008-06-11 18:40 . 2008-04-25 14:35 826,880 –a—— C:\Windows\System32\wininet.dll
2008-06-11 18:40 . 2008-05-10 11:33 113,664 –a—— C:\Windows\System32\drivers\rmcast.sys
2008-06-08 16:19 . 2007-03-23 04:05 29,272 -ra—— C:\Windows\System32\AdobePDF.dll
2008-06-05 23:48 . 2008-06-18 23:31 156 –a—— C:\Windows\Twunk001.MTX
2008-06-05 23:48 . 2008-06-18 23:31 2 –a—— C:\Windows\Twain001.Mtx
2008-06-05 23:48 . 2008-06-05 23:48 0 –a—— C:\Windows\Twunk002.MTX
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\Users\All Users\Apple Computer
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\ProgramData\Apple Computer
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\Program Files\QuickTime Alternative
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\Program Files\Media Player Classic
2008-06-05 22:03 . 2006-09-01 16:14 65,536 –a—— C:\Windows\System32\QuickTimeVR.qtx
2008-06-05 22:03 . 2006-09-01 16:14 49,152 –a—— C:\Windows\System32\QuickTime.qts
2008-06-05 21:56 . 2008-06-05 21:57 d——– C:\Users\Duncan\AppData\Roaming\Autodesk
2008-06-05 21:47 . 2008-06-05 21:47 d——– C:\Users\All Users\FLEXnet
2008-06-05 21:47 . 2008-06-05 21:47 d——– C:\ProgramData\FLEXnet
2008-06-05 21:42 . 2008-06-05 21:52 d——– C:\Users\All Users\WinZip
2008-06-05 21:42 . 2008-06-05 21:52 d——– C:\ProgramData\WinZip
2008-06-05 21:33 . 2008-06-05 22:00 d——– C:\Program Files\QuickTime
2008-06-05 21:29 . 2007-02-20 16:04 2,463,976 –a—— C:\Windows\System32\NPSWF32.dll
2008-06-05 21:29 . 2007-02-20 16:04 190,696 –a—— C:\Windows\System32\NPSWF32_FlashUtil.exe
2008-06-05 21:24 . 2008-06-05 21:24 d——– C:\Program Files\ASIO4ALL v2
2008-06-05 21:24 . 2006-06-20 18:56 225,280 –a—— C:\Windows\System32\rewire.dll
2008-06-05 21:23 . 2008-06-05 21:23 d——– C:\Program Files\Bonjour
2008-06-05 21:23 . 2002-07-08 08:14 1,294,336 –a—— C:\Windows\System32\vorbis.acm
2008-06-05 21:19 . 2008-06-05 21:24 d——– C:\Program Files\Image-Line
2008-06-05 21:15 . 2008-06-05 21:15 d——– C:\Program Files\Common Files\Macrovision Shared
2008-06-05 20:43 . 2008-06-05 20:43 231 –a—— C:\Windows\System32\3dsmax.ini
2008-06-05 20:43 . 2008-06-05 20:43 43 –a—— C:\Windows\System32\InstallSettings.ini
2008-06-05 20:41 . 2008-06-08 01:19 d——– C:\Users\All Users\Autodesk
2008-06-05 20:41 . 2008-06-08 01:19 d——– C:\ProgramData\Autodesk
2008-06-05 20:41 . 2008-06-05 20:43 d——– C:\Program Files\Common Files\Autodesk Shared
2008-06-05 20:40 . 2008-06-05 20:43 d——– C:\Program Files\Autodesk
2008-06-05 20:40 . 2007-05-16 16:45 3,497,832 –a—— C:\Windows\System32\d3dx9_34.dll
2008-06-05 20:40 . 2006-11-29 13:06 3,426,072 –a—— C:\Windows\System32\d3dx9_32.dll
2008-06-05 20:40 . 2006-09-28 16:05 2,414,360 –a—— C:\Windows\System32\d3dx9_31.dll
2008-06-05 20:40 . 2007-05-16 16:45 1,124,720 –a—— C:\Windows\System32\D3DCompiler_34.dll
2008-06-05 20:40 . 2007-05-16 16:45 443,752 –a—— C:\Windows\System32\d3dx10_34.dll
2008-06-05 20:40 . 2006-11-29 13:06 440,080 –a—— C:\Windows\System32\d3dx10.dll
2008-06-05 20:16 . 2008-06-05 20:16 d——– C:\Users\Duncan\AppData\Roaming\CyberLink
2008-06-05 20:16 . 2008-06-05 20:16 d——– C:\Users\All Users\CyberLink
2008-06-05 20:16 . 2008-06-05 20:16 d——– C:\ProgramData\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-05 03:38 ——— d—–w C:\Program Files\Steam
2008-07-02 09:04 ——— d—–w C:\Program Files\EA GAMES
2008-07-02 08:46 ——— d—–w C:\Users\Duncan\AppData\Roaming\LimeWire
2008-06-30 09:17 ——— d—–w C:\ProgramData\Microsoft Help
2008-06-24 14:26 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-24 14:12 ——— d—–w C:\Users\Duncan\AppData\Roaming\Winamp
2008-06-23 09:05 ——— d—–w C:\ProgramData\Google Updater
2008-06-18 13:45 ——— d—a-w C:\ProgramData\TEMP
2008-06-18 06:09 22,328 —-a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-06-18 06:09 107,832 —-a-w C:\Windows\System32\PnkBstrB.exe
2008-06-18 02:53 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-11 11:05 ——— d—–w C:\Program Files\Common Files\Steam
2008-06-05 11:37 ——— d—–w C:\Program Files\Common Files\Adobe
2008-06-05 11:24 ——— d—–w C:\Program Files\Vstplugins
2008-06-01 04:58 ——— d—–w C:\Users\Duncan\AppData\Roaming\Publish Providers
2008-06-01 04:37 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-05-31 13:07 ——— d—–w C:\Users\Duncan\AppData\Roaming\Sony
2008-05-31 13:05 ——— d—–w C:\ProgramData\Sony
2008-05-31 13:05 ——— d—–w C:\Program Files\Sony
2008-05-31 13:02 ——— d—–w C:\Program Files\Sony Setup
2008-05-29 12:54 ——— d—–w C:\Program Files\K-Lite Codec Pack
2008-05-28 11:38 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
2008-05-27 08:16 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-05-17 04:21 ——— d—–w C:\Users\Duncan\AppData\Roaming\Lionhead Studios
2008-05-17 02:36 ——— d—–w C:\Program Files\Winamp
2008-05-16 01:58 12,632 —-a-w C:\Windows\System32\lsdelete.exe
2008-04-26 14:11 174 –sha-w C:\Program Files\desktop.ini
2008-04-26 11:53 82,432 —-a-w C:\Windows\System32\axaltocm.dll
2008-04-26 11:53 101,888 —-a-w C:\Windows\System32\ifxcardm.dll
2008-04-03 14:04 22,328 —-a-w C:\Users\Duncan\AppData\Roaming\PnkBstrK.sys
.

((((((((((((((((((((((((((((( snapshot@2008-06-30_21.27.52.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-30 11:14:47 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-07-05 03:26:36 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-06-30 11:14:47 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-07-05 03:26:36 2,048 –sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-06-30 11:19:27 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-07-05 03:37:18 262,144 –sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-07-05 03:37:18 262,144 —ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-06-30 11:25:21 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-07-05 03:50:20 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-07-05 03:50:20 262,144 —ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-06-30 10:39:32 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-05 03:26:37 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-30 10:39:32 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-05 03:26:37 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-30 10:39:32 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-07-05 03:26:37 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-30 11:10:36 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-07-05 03:47:12 262,144 —-a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2008-06-30 11:21:08 44,072 —-a-w C:\Windows\System32\perfc009.dat
+ 2008-07-05 03:32:48 44,072 —-a-w C:\Windows\System32\perfc009.dat
- 2008-06-30 11:21:08 324,038 —-a-w C:\Windows\System32\perfh009.dat
+ 2008-07-05 03:32:48 324,038 —-a-w C:\Windows\System32\perfh009.dat
- 2008-06-30 10:41:24 7,536 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3841210806-3274275398-1418194437-1003_UserData.bin
+ 2008-07-05 03:40:12 7,958 —-a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3841210806-3274275398-1418194437-1003_UserData.bin
- 2008-06-30 10:41:24 67,290 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-07-05 03:40:11 67,958 —-a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-06-24 13:13:58 2,852 —-a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-06-30 13:39:39 2,582 —-a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-06-30 10:41:22 34,820 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-07-05 03:40:10 34,916 —-a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2008-04-06 21:21 1271032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe" [2008-06-28 22:59 2468200]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 16:06 86016]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 16:06 81920]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 16:06 8530464]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-11 09:53 4702208 C:\Windows\RtHDVCpl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\Windows\system32\__c00C2E4E.dat

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
–a—— 2008-01-11 19:54 623992 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
–a—— 2007-02-28 23:06 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
–a—— 2008-01-19 17:33 125952 C:\Windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
–a—— 2007-05-15 14:55 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
–a—— 2006-12-05 21:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2007-03-01 14:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
–a—— 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2006-11-23 14:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
–a—— 2007-05-15 14:55 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
–a—— 2008-01-19 17:33 1233920 C:\Program Files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2008-04-02 04:49 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
–a—— 2008-01-19 17:38 1008184 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
–a—— 2006-11-02 19:45 215552 C:\Windows\WindowsMobile\wmdSync.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{032CE906-D98A-4F7C-8882-BD6B6027F39B}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"UDP Query User{03238BFA-1ED4-4392-B522-DBB432379DFD}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"TCP Query User{5A50A9D5-51C2-4AA1-9537-F27D756984B3}C:\\program files\\steam\\steamapps\\dunkywunky87\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\dunkywunky87\team fortress 2\hl2.exe:hl2
"UDP Query User{7119E488-4B31-4D09-989F-A14FB76C66A9}C:\\program files\\steam\\steamapps\\dunkywunky87\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\dunkywunky87\team fortress 2\hl2.exe:hl2
"{7845FBB6-935A-4095-9A01-45FBC61A7381}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{937DCE26-79AC-42D3-BD81-01DAB58DC8FB}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{3708ECC7-4AFE-44E5-9722-B816399D272A}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{82AE795A-C1C9-4156-9DB8-D4364ADCFF39}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{D14F0CB6-1F83-411B-9572-7F33E4D52995}C:\\program files\\steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"= UDP:C:\program files\steam\steamapps\common\call of duty 4\iw3mp.exe:iw3mp
"UDP Query User{D4696304-C931-4224-A4C1-31E66E8DA5B3}C:\\program files\\steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"= TCP:C:\program files\steam\steamapps\common\call of duty 4\iw3mp.exe:iw3mp
"{9D721D3F-8F04-49E8-95E7-E82A4CE26729}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{5F8B14FE-FB81-44F7-B19A-EDBED14C293A}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{227FD99D-FAEA-48AD-8A9C-D293B371A95F}"= UDP:990:LocalSubnet:LocalSubnet|IF={F2BB9D2D-ADFD-466A-A87F-31D1EDB42E32}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"{097839AA-23CC-47FA-BD97-7E1D08E5AEA8}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{35C09811-CFD2-47E2-A066-1BC60941885C}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{1C5C6777-802C-4C3F-B8A4-6262F89DD97F}"= UDP:C:\Program Files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{DD72027B-F33F-495F-9EE4-3E19FA20EC9F}"= TCP:C:\Program Files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{1EF54CB2-E6E8-45EE-A92E-59685260BD30}"= UDP:C:\Program Files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{D2E23938-1619-4766-9D4F-DF60ECB64236}"= TCP:C:\Program Files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{5EFACA49-1C72-458D-A049-89481DE2D623}"= UDP:C:\Program Files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{478367DD-5265-4FEC-9CC3-4F3D40FB9A71}"= TCP:C:\Program Files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{DFD3CC30-FE80-43AD-8D06-E3253699B189}"= UDP:C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe:Autodesk 3ds Max 2008 32-bit
"{067ED1AA-7D4A-413E-8C76-98AE6C231CF5}"= TCP:C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe:Autodesk 3ds Max 2008 32-bit
"TCP Query User{55DD29E7-061B-4BE9-99DF-402F00ECD6A6}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"UDP Query User{D2C34F13-9A78-4E30-8E23-2373E69A3AF7}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"{5D24860E-12B4-49F2-82D8-A6EE116AC17E}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare™
"{38A4CD90-859F-40CF-9BE3-84D010ECBAD5}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare™
"TCP Query User{C458D026-8B4E-462E-8B87-3B81DE022469}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{2FDF7A7B-F111-4029-9941-96DE3C07D075}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

R0 ViBus;ViBus;C:\Windows\system32\DRIVERS\ViBus.sys [2007-03-26 14:26]
R0 ViPrt;VIA SATA IDE Device Driver;C:\Windows\system32\DRIVERS\ViPrt.sys [2007-03-26 14:26]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;"C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe" [2008-01-11 16:50]
R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 17:33]
R2 WcesComm;Windows Mobile 2003-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 17:33]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ []
S3 UMPass;Microsoft UMPass Driver;C:\Windows\system32\DRIVERS\umpass.sys [2008-01-19 15:53]
S4 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-11 19:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

.
Contents of the 'Scheduled Tasks' folder
"2008-07-04 14:02:32 C:\Windows\Tasks\User_Feed_Synchronization-{FD0202AF-F6DA-4189-B778-86E88B78E6A1}.job"
- C:\Windows\system32\msfeedssync.exe
.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{ACED1C9F-2718-4512-9F69-F4E28C1F484F} - C:\Windows\system32\mljJCtrQ.dll
MSConfigStartUp-40da9b6b - C:\Windows\system32\ohuimkbf.dll
MSConfigStartUp-MSServer - C:\Windows\system32\mljJCtrQ.dll
MSConfigStartUp-Uniblue RegistryBooster 2 - c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-05 13:50:24
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-05 13:51:26
ComboFix-quarantined-files.txt 2008-07-05 03:51:24
ComboFix2.txt 2008-06-30 11:28:21

Pre-Run: 78,339,846,144 bytes free
Post-Run: 78,361,870,336 bytes free

291 — E O F — 2008-07-04 06:32:40
—–
and then from Hijackthis

—-
Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Add or Remove Adobe Creative Suite 3 Web Premium
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe BridgeTalk Plugin CS3
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Creative Suite 3 Web Premium
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe ExtendScript Toolkit 2
Adobe Extension Manager CS3
Adobe Flash CS3
Adobe Flash Player 9 ActiveX
Adobe Flash Player 9 Plugin
Adobe Flash Player ActiveX
Adobe Flash Video Encoder
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe MotionPicture Color Files
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 8.1.2
Adobe Setup
Adobe Setup
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WAS CS3
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Agere Systems PCI-SV92PP Soft Modem
AHV content for Acrobat and Flash
ASIO4ALL
Autodesk 3ds Max 2008 32-bit
Autodesk 3ds Max 2008 32-bit Help
Backburner
Black and White
Business Contact Manager for Outlook 2007 SP1
Business Contact Manager for Outlook 2007 SP1
Call of Duty 4: Modern Warfare
Call of Duty® 4 - Modern Warfare™ 1.6 Patch
Counter-Strike: Source
DVD Suite
EA Download Manager
FBX Plugin 2006.11.1 for Max 2008
FL Studio 7
Google Earth
Google Updater
Half-Life 2
Half-Life 2: Episode One
Half-Life 2: Episode Two
Half-Life 2: Lost Coast
HijackThis 2.0.2
IL Download Manager
Java™ 6 Update 5
K-Lite Mega Codec Pack 3.9.0
LimeWire 4.16.7
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office Small Business Connectivity Components
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
Nero 7 Essentials
neroxml
Nokia Connectivity Cable Driver
Nokia PC Suite
Nokia PC Suite
NVIDIA Drivers
PC Connectivity Solution
PDF Settings
Peggle Extreme
Portal
PowerDVD
PowerProducer
PunkBuster Services
QuickTime Alternative 1.77
Realtek High Definition Audio Driver
RollerCoaster Tycoon 3 Platinum
Sid Meier's Civilization IV
Sid Meier's Civilization IV: Beyond the Sword
Sid Meier's Civilization IV: Warlords
Sony Vegas Pro 8.0
Source SDK
Source SDK Base
Source SDK Base - Orange Box
Spelling Dictionaries Support For Adobe Reader 8
SPORE™ Creature Creator Trial Edition
Steam
Steam Buster 1.9
Team Fortress 2
The Movies
The Sims 2
The Sims 2 University
Uniblue RegistryBooster
Uniblue RegistryBooster
Ventrilo Client
VIA Platform Device Manager
Winamp
Windows Driver Package - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (02/15/2007 3.1)
Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1)
WinZip 11.2
World of Warcraft
—–
Post #6
Hi

From your logs it appears that at some point you were infected with something called Trojan-Spy.Banker. Due to the nature of this infection I recommend that you change all passwords for any sensitive information sites (online banking, email etc) once this computer is clean (or from another clean computer).

LimeWire
You have LimeWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm
See Clean/Infected P2P Programs here

I would recommend that you uninstall LimeWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Programs.

If you wish to keep it, please do not use it until your computer is cleaned.


Please disable Ad-Adware as before.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\Windows\system32\__c00C2E4E.dat

DirLook::
C:\Users\All Users\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
C:\ProgramData\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Please right click Internet Explorer on your desktop and then select "Run As Administrator". Next, go to Kaspersky website and perform an online antivirus scan.

NOTE: Internet Explorer will temporarily have administrator privileges, this is required for the scan but dangerous for normal surfing so do NOT open any other websites in IE until after the scan has finished and this window has been closed.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Also, please give a detailed description of how your computer is running and behaving at the moment, listing any remaining problems.

Thanks.
Post #7
Mate,

Whenever I attempt to run the .txt file thingy, I get the attached error with combofix.

I am sure that I have turned of Adaware and anything else I can think of, and I have tried in safe mode.


Currently, my PC is fine, however about a fortnight ago I was getting annoying popups during normal surfing (The "YOUR COMPUTER IS INFECTED" sort of popups), which I never get. And my internet connection was very, VERY slow (on 14mps ADSL2 normally). I thought I deleted the things that were causing the problem. However they kept coming back and I still fear that they are lurking somewhere in my registry.

Thanks for the note about Limewire, I shall blame my *insert rude words here* brother for that one.

:) thank you again for your help so far,

Attachments:

Post #8
Hi

Lets try a lightly different script.

Please disable Ad-Adware as before.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\Windows\system32\__c00C2E4E.dat

DirLook::
C:\Users\All Users\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
C:\ProgramData\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

Please right click Internet Explorer on your desktop and then select "Run As Administrator". Next, go to Kaspersky website and perform an online antivirus scan.

NOTE: Internet Explorer will temporarily have administrator privileges, this is required for the scan but dangerous for normal surfing so do NOT open any other websites in IE until after the scan has finished and this window has been closed.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Also, please give a detailed description of how your computer is running and behaving at the moment, listing any remaining problems.

Thanks.
Post #9
Mate, Thanks for that, however when I run this script after a few seconds (after combo fix does the registry backup and it comes up with the "this may take 10 minutes" screen) my computer crashes (Vista Blue Screen of Death). Happened twice, so I decided to stop :) Scan from the virus site report is as follows: —— ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, July 8, 2008 Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, July 08, 2008 08:46:50 Records in database: 926126 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Files scanned: 253526 Threat name: 3 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 02:14:18 File name / Threat name / Threats count C:\QooBox\Quarantine\C\Windows\System32\ekyqrbpo.dll.vir Infected: Trojan.Win32.Monder.wj 1 C:\QooBox\Quarantine\C\Windows\System32\hekhmbsh.dll.vir Infected: Trojan.Win32.Monder.gen 1 C:\QooBox\Quarantine\C\Windows\System32\uepsrkcy.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\Windows\System32\yATNhggE.dll.vir Infected: Trojan.Win32.Monderc.gen 1 C:\QooBox\Quarantine\C\Windows\System32\__c00C2E4E.dat.vir Infected: Trojan.Win32.Monder.gen 1 The selected area was scanned. —— Thanks :)
Post #10
Please post the contents of C:\ComboFix.txt (if it's there) and also post a new HijackThis log.

Hows the computer running at the moment?
Post #11
ComboFix 08-07-04.2 - Duncan 2008-07-06 2:02:27.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2121 [GMT 10:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
.

2008-06-28 22:45 . 2008-06-28 22:45 d——– C:\Users\Duncan\AppData\Roaming\Uniblue
2008-06-28 22:43 . 2008-06-28 22:45 d–h—– C:\Users\All Users\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
2008-06-28 22:43 . 2008-06-28 22:45 d–h—– C:\ProgramData\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}
2008-06-25 00:27 . 2008-06-25 00:28 d——– C:\Users\All Users\Lavasoft
2008-06-25 00:27 . 2008-06-25 00:28 d——– C:\ProgramData\Lavasoft
2008-06-25 00:27 . 2008-06-25 00:27 d——– C:\Program Files\Lavasoft
2008-06-25 00:05 . 2008-07-06 02:00 2,000 –ah—– C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2008-06-25 00:05 . 2008-07-06 02:00 2,000 –ah—– C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2008-06-18 12:55 . 2008-06-29 20:19 d——– C:\Users\Duncan\AppData\Roaming\SPORE Creature Creator
2008-06-18 12:55 . 2008-06-18 12:55 107,888 –a—— C:\Windows\System32\CmdLineExt.dll
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Videos
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Searches
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Saved Games
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Pictures
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Music
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Links
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Downloads
2008-06-18 12:53 . 2008-06-18 12:53 dr——- C:\Windows\System32\config\systemprofile\Documents
2008-06-18 12:53 . 2008-06-18 12:53 d——– C:\Users\All Users\Electronic Arts
2008-06-18 12:53 . 2008-06-18 12:53 d——– C:\ProgramData\Electronic Arts
2008-06-18 12:53 . 2008-06-18 12:53 1,912 –a—— C:\Windows\System32\ealregsnapshot1.reg
2008-06-18 12:52 . 2008-06-18 12:53 d——– C:\Program Files\Electronic Arts
2008-06-17 23:04 . 2008-06-17 23:04 d——– C:\Users\Duncan\AppData\Roaming\Media Player Classic
2008-06-15 14:20 . 2008-06-15 14:20 d——– C:\Users\Duncan\Phone Browser
2008-06-15 14:20 . 2008-06-15 14:20 0 –ah—– C:\Windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-06-15 14:18 . 2008-06-15 14:19 d——– C:\Users\All Users\PC Suite
2008-06-15 14:18 . 2008-06-15 14:19 d——– C:\ProgramData\PC Suite
2008-06-15 14:10 . 2008-06-15 14:19 d——– C:\Users\Duncan\AppData\Roaming\Nokia
2008-06-15 14:09 . 2008-06-15 14:09 d——– C:\Program Files\DIFX
2008-06-15 14:09 . 2008-06-15 14:09 d——– C:\Program Files\Common Files\PCSuite
2008-06-15 14:09 . 2008-06-15 14:09 d——– C:\Program Files\Common Files\Nokia
2008-06-15 14:08 . 2008-06-15 14:18 d——– C:\Users\Duncan\AppData\Roaming\PC Suite
2008-06-15 14:08 . 2008-06-15 14:08 d——– C:\Program Files\PC Connectivity Solution
2008-06-15 14:06 . 2008-06-15 14:09 d——– C:\Program Files\Nokia
2008-06-15 14:06 . 2007-02-22 11:15 90,624 –a—— C:\Windows\System32\nmwcdcls.dll
2008-06-15 14:02 . 2008-06-15 14:40 d——– C:\Users\Duncan\AV Stuff
2008-06-15 14:02 . 2008-06-15 14:03 d——– C:\Users\All Users\Installations
2008-06-15 14:02 . 2008-06-15 14:03 d——– C:\ProgramData\Installations
2008-06-15 00:17 . 2008-06-15 00:17 319 –a—— C:\Windows\game.ini
2008-06-14 23:56 . 2008-06-14 23:56 d——– C:\Program Files\Activision
2008-06-14 23:52 . 2008-06-14 23:52 d–hs—- C:\Windows\ftpcache
2008-06-14 21:00 . 2008-06-14 21:00 d——– C:\Program Files\Steam Buster
2008-06-11 18:40 . 2008-04-25 12:12 1,383,424 –a—— C:\Windows\System32\mshtml.tlb
2008-06-11 18:40 . 2008-04-26 18:08 1,314,816 –a—— C:\Windows\System32\quartz.dll
2008-06-11 18:40 . 2008-04-25 14:35 826,880 –a—— C:\Windows\System32\wininet.dll
2008-06-11 18:40 . 2008-05-10 11:33 113,664 –a—— C:\Windows\System32\drivers\rmcast.sys
2008-06-08 16:19 . 2007-03-23 04:05 29,272 -ra—— C:\Windows\System32\AdobePDF.dll
2008-06-05 23:48 . 2008-06-18 23:31 156 –a—— C:\Windows\Twunk001.MTX
2008-06-05 23:48 . 2008-06-18 23:31 2 –a—— C:\Windows\Twain001.Mtx
2008-06-05 23:48 . 2008-06-05 23:48 0 –a—— C:\Windows\Twunk002.MTX
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\Users\All Users\Apple Computer
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\ProgramData\Apple Computer
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\Program Files\QuickTime Alternative
2008-06-05 22:03 . 2008-06-05 22:03 d——– C:\Program Files\Media Player Classic
2008-06-05 22:03 . 2006-09-01 16:14 65,536 –a—— C:\Windows\System32\QuickTimeVR.qtx
2008-06-05 22:03 . 2006-09-01 16:14 49,152 –a—— C:\Windows\System32\QuickTime.qts
2008-06-05 21:56 . 2008-06-05 21:57 d——– C:\Users\Duncan\AppData\Roaming\Autodesk
2008-06-05 21:47 . 2008-06-05 21:47 d——– C:\Users\All Users\FLEXnet
2008-06-05 21:47 . 2008-06-05 21:47 d——– C:\ProgramData\FLEXnet
2008-06-05 21:42 . 2008-06-05 21:52 d——– C:\Users\All Users\WinZip
2008-06-05 21:42 . 2008-06-05 21:52 d——– C:\ProgramData\WinZip
2008-06-05 21:33 . 2008-06-05 22:00 d——– C:\Program Files\QuickTime
2008-06-05 21:29 . 2007-02-20 16:04 2,463,976 –a—— C:\Windows\System32\NPSWF32.dll
2008-06-05 21:29 . 2007-02-20 16:04 190,696 –a—— C:\Windows\System32\NPSWF32_FlashUtil.exe
2008-06-05 21:24 . 2008-06-05 21:24 d——– C:\Program Files\ASIO4ALL v2
2008-06-05 21:24 . 2006-06-20 18:56 225,280 –a—— C:\Windows\System32\rewire.dll
2008-06-05 21:23 . 2008-06-05 21:23 d——– C:\Program Files\Bonjour
2008-06-05 21:23 . 2002-07-08 08:14 1,294,336 –a—— C:\Windows\System32\vorbis.acm
2008-06-05 21:19 . 2008-06-05 21:24 d——– C:\Program Files\Image-Line
2008-06-05 21:15 . 2008-06-05 21:15 d——– C:\Program Files\Common Files\Macrovision Shared
2008-06-05 20:43 . 2008-06-05 20:43 231 –a—— C:\Windows\System32\3dsmax.ini
2008-06-05 20:43 . 2008-06-05 20:43 43 –a—— C:\Windows\System32\InstallSettings.ini
2008-06-05 20:41 . 2008-06-08 01:19 d——– C:\Users\All Users\Autodesk
2008-06-05 20:41 . 2008-06-08 01:19 d——– C:\ProgramData\Autodesk
2008-06-05 20:41 . 2008-06-05 20:43 d——– C:\Program Files\Common Files\Autodesk Shared
2008-06-05 20:40 . 2008-06-05 20:43 d——– C:\Program Files\Autodesk
2008-06-05 20:40 . 2007-05-16 16:45 3,497,832 –a—— C:\Windows\System32\d3dx9_34.dll
2008-06-05 20:40 . 2006-11-29 13:06 3,426,072 –a—— C:\Windows\System32\d3dx9_32.dll
2008-06-05 20:40 . 2006-09-28 16:05 2,414,360 –a—— C:\Windows\System32\d3dx9_31.dll
2008-06-05 20:40 . 2007-05-16 16:45 1,124,720 –a—— C:\Windows\System32\D3DCompiler_34.dll
2008-06-05 20:40 . 2007-05-16 16:45 443,752 –a—— C:\Windows\System32\d3dx10_34.dll
2008-06-05 20:40 . 2006-11-29 13:06 440,080 –a—— C:\Windows\System32\d3dx10.dll
2008-06-05 20:16 . 2008-06-05 20:16 d——– C:\Users\Duncan\AppData\Roaming\CyberLink
2008-06-05 20:16 . 2008-06-05 20:16 d——– C:\Users\All Users\CyberLink
2008-06-05 20:16 . 2008-06-05 20:16 d——– C:\ProgramData\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-05 03:38 ——— d—–w C:\Program Files\Steam
2008-07-02 09:04 ——— d—–w C:\Program Files\EA GAMES
2008-07-02 08:46 ——— d—–w C:\Users\Duncan\AppData\Roaming\LimeWire
2008-06-30 09:17 ——— d—–w C:\ProgramData\Microsoft Help
2008-06-24 14:26 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-24 14:12 ——— d—–w C:\Users\Duncan\AppData\Roaming\Winamp
2008-06-23 09:05 ——— d—–w C:\ProgramData\Google Updater
2008-06-18 13:45 ——— d—a-w C:\ProgramData\TEMP
2008-06-18 06:09 22,328 —-a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-06-18 06:09 107,832 —-a-w C:\Windows\System32\PnkBstrB.exe
2008-06-18 02:53 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-11 11:05 ——— d—–w C:\Program Files\Common Files\Steam
2008-06-05 11:37 ——— d—–w C:\Program Files\Common Files\Adobe
2008-06-05 11:24 ——— d—–w C:\Program Files\Vstplugins
2008-06-01 04:58 ——— d—–w C:\Users\Duncan\AppData\Roaming\Publish Providers
2008-06-01 04:37 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-05-31 13:07 ——— d—–w C:\Users\Duncan\AppData\Roaming\Sony
2008-05-31 13:05 ——— d—–w C:\ProgramData\Sony
2008-05-31 13:05 ——— d—–w C:\Program Files\Sony
2008-05-31 13:02 ——— d—–w C:\Program Files\Sony Setup
2008-05-29 12:54 ——— d—–w C:\Program Files\K-Lite Codec Pack
2008-05-28 11:38 0 —ha-w C:\Windows\system32\drivers\Msft_User_WpdRapi_01_00_00.Wdf
2008-05-27 08:16 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-05-17 04:21 ——— d—–w C:\Users\Duncan\AppData\Roaming\Lionhead Studios
2008-05-17 02:36 ——— d—–w C:\Program Files\Winamp
2008-05-16 01:58 12,632 —-a-w C:\Windows\System32\lsdelete.exe
2008-04-26 14:11 174 –sha-w C:\Program Files\desktop.ini
2008-04-26 11:53 82,432 —-a-w C:\Windows\System32\axaltocm.dll
2008-04-26 11:53 101,888 —-a-w C:\Windows\System32\ifxcardm.dll
2008-04-03 14:04 22,328 —-a-w C:\Users\Duncan\AppData\Roaming\PnkBstrK.sys
.

((((((((((((((((((((((((((((( snapshot_2008-07-05_13.50.57.67 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-05 03:50:20 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-07-05 16:04:41 262,144 –sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-07-05 16:04:41 262,144 —ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-07-05 03:26:37 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-07-05 15:57:48 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-07-05 03:26:37 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-05 15:57:48 32,768 –sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-07-05 03:26:37 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-07-05 15:57:48 16,384 –sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2008-04-06 21:21 1271032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe" [2008-06-28 22:59 2468200]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 16:06 86016]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 16:06 81920]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 16:06 8530464]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-11 09:53 4702208 C:\Windows\RtHDVCpl.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{ACED1C9F-2718-4512-9F69-F4E28C1F484F}"= "C:\Windows\system32\mljJCtrQ.dll" [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\Windows\system32\__c00C2E4E.dat

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\Windows\pss\Google Updater.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
–a—— 2008-01-11 19:54 623992 C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
–a—— 2007-02-28 23:06 2321600 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
–a—— 2008-01-19 17:33 125952 C:\Windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
–a—— 2007-05-15 14:55 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
–a—— 2006-12-05 21:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2007-03-01 14:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
–a—— 2007-06-18 15:10 271360 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
——— 2006-11-23 14:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
–a—— 2007-05-15 14:55 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
–a—— 2008-01-19 17:33 1233920 C:\Program Files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 04:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
–a—— 2008-04-02 04:49 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
–a—— 2008-01-19 17:38 1008184 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile-based device management]
–a—— 2006-11-02 19:45 215552 C:\Windows\WindowsMobile\wmdSync.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{032CE906-D98A-4F7C-8882-BD6B6027F39B}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"UDP Query User{03238BFA-1ED4-4392-B522-DBB432379DFD}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"TCP Query User{5A50A9D5-51C2-4AA1-9537-F27D756984B3}C:\\program files\\steam\\steamapps\\dunkywunky87\\team fortress 2\\hl2.exe"= UDP:C:\program files\steam\steamapps\dunkywunky87\team fortress 2\hl2.exe:hl2
"UDP Query User{7119E488-4B31-4D09-989F-A14FB76C66A9}C:\\program files\\steam\\steamapps\\dunkywunky87\\team fortress 2\\hl2.exe"= TCP:C:\program files\steam\steamapps\dunkywunky87\team fortress 2\hl2.exe:hl2
"{7845FBB6-935A-4095-9A01-45FBC61A7381}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{937DCE26-79AC-42D3-BD81-01DAB58DC8FB}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{3708ECC7-4AFE-44E5-9722-B816399D272A}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{82AE795A-C1C9-4156-9DB8-D4364ADCFF39}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{D14F0CB6-1F83-411B-9572-7F33E4D52995}C:\\program files\\steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"= UDP:C:\program files\steam\steamapps\common\call of duty 4\iw3mp.exe:iw3mp
"UDP Query User{D4696304-C931-4224-A4C1-31E66E8DA5B3}C:\\program files\\steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"= TCP:C:\program files\steam\steamapps\common\call of duty 4\iw3mp.exe:iw3mp
"{9D721D3F-8F04-49E8-95E7-E82A4CE26729}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{5F8B14FE-FB81-44F7-B19A-EDBED14C293A}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{227FD99D-FAEA-48AD-8A9C-D293B371A95F}"= UDP:990:LocalSubnet:LocalSubnet|IF={F2BB9D2D-ADFD-466A-A87F-31D1EDB42E32}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"{097839AA-23CC-47FA-BD97-7E1D08E5AEA8}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{35C09811-CFD2-47E2-A066-1BC60941885C}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{1C5C6777-802C-4C3F-B8A4-6262F89DD97F}"= UDP:C:\Program Files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{DD72027B-F33F-495F-9EE4-3E19FA20EC9F}"= TCP:C:\Program Files\Autodesk\Backburner\monitor.exe:backburner 2.3 monitor
"{1EF54CB2-E6E8-45EE-A92E-59685260BD30}"= UDP:C:\Program Files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{D2E23938-1619-4766-9D4F-DF60ECB64236}"= TCP:C:\Program Files\Autodesk\Backburner\manager.exe:backburner 2.3 manager
"{5EFACA49-1C72-458D-A049-89481DE2D623}"= UDP:C:\Program Files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{478367DD-5265-4FEC-9CC3-4F3D40FB9A71}"= TCP:C:\Program Files\Autodesk\Backburner\server.exe:backburner 2.3 server
"{DFD3CC30-FE80-43AD-8D06-E3253699B189}"= UDP:C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe:Autodesk 3ds Max 2008 32-bit
"{067ED1AA-7D4A-413E-8C76-98AE6C231CF5}"= TCP:C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe:Autodesk 3ds Max 2008 32-bit
"TCP Query User{55DD29E7-061B-4BE9-99DF-402F00ECD6A6}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= UDP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"UDP Query User{D2C34F13-9A78-4E30-8E23-2373E69A3AF7}C:\\program files\\steam\\steamapps\\dunkywunky87\\counter-strike source\\hl2.exe"= TCP:C:\program files\steam\steamapps\dunkywunky87\counter-strike source\hl2.exe:hl2
"{5D24860E-12B4-49F2-82D8-A6EE116AC17E}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare™
"{38A4CD90-859F-40CF-9BE3-84D010ECBAD5}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty® 4 - Modern Warfare™
"TCP Query User{C458D026-8B4E-462E-8B87-3B81DE022469}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager
"UDP Query User{2FDF7A7B-F111-4029-9941-96DE3C07D075}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

R0 ViBus;ViBus;C:\Windows\system32\DRIVERS\ViBus.sys [2007-03-26 14:26]
R0 ViPrt;VIA SATA IDE Device Driver;C:\Windows\system32\DRIVERS\ViPrt.sys [2007-03-26 14:26]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;"C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe" [2008-01-11 16:50]
R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 17:33]
R2 WcesComm;Windows Mobile 2003-based device connectivity;C:\Windows\system32\svchost.exe [2008-01-19 17:33]
S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ []
S3 UMPass;Microsoft UMPass Driver;C:\Windows\system32\DRIVERS\umpass.sys [2008-01-19 15:53]
S4 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-11 19:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9051156-e148-11dc-a301-806e6f6e6963}]
\shell\AutoRun\command - H:\Autorun.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-07-05 14:43:27 C:\Windows\Tasks\User_Feed_Synchronization-{FD0202AF-F6DA-4189-B778-86E88B78E6A1}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-06 02:04:50
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-06 2:05:50
ComboFix-quarantined-files.txt 2008-07-05 16:05:47
ComboFix2.txt 2008-07-05 03:51:27
ComboFix3.txt 2008-06-30 11:28:21

Pre-Run: 77,021,937,664 bytes free
Post-Run: 77,001,846,784 bytes free

262 — E O F — 2008-07-04 06:32:40
for the .txt file for combfix…


And the Hijack this:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:16, on 2008-07-12
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Steam\Steam.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Users\Duncan\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.wikipedia.org/wiki/Main_Page
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/co…ex/qtplugin.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u…ows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

–
End of file - 6050 bytes




Currently the only thing I am concerned about, is that my PC seems to take ALOT longer then normal to start up. And when I look at folders within my documents, there is not thumbnail icon or anything like that.. Seems odd, not sure if it is related.
Post #12
Hi

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\Windows\system32\__c00C2E4E.dat
C:\Windows\system32\mljJCtrQ.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows\\AppInit_DLLs
hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecueHooks\\{ACED1C9F-2718-4512-9F69-F4E28C1F484F}
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste Standard List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt2
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


1. Go to Start->Run and type in notepad and hit OK.

2. Then copy and paste the content of the following codebox into Notepad:

@echo off
if exist C:\log.txt del C:\log.txt
DIR "C:\Users\All Users\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}" >> C:\log.txt
DIR "C:\ProgramData\{F9AC68EC-7828-47BE-96E8-705EE2D1CF7D}" >> C:\log.txt
start C:\log.txt
del find.bat
exit
3. Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes. Once saved, the icon to click should look like this on your desktop: [external image: Posted Image]

4. Double click find.bat. If will open a log in notepad, which can also be found at C:\log.txt. Post this log in your next reply.

Also include a new HijackThis log.

Thanks.
Post #14
Sorry mate, busy week and havent been at home. I will do as instructed tomorrow (about 16 hours from posting this) Cheers, and thanks for your paitence.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI