What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Cpu running 100% computer hanging out

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Having problems with the computer, cpu running at 100% consuming out the resources and the system is hanging out for a lot of time. This is my Hijackthis log and Startup list.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:17:19 AM, on 10/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\tbctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\GILBERT\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124055239609
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security1.norton.com/SSC/SharedCont…c/bin/cabsa.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O21 - SSODL: mjd - {8A521329-067E-4204-87E5-29200ADB7582} - (no file)
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Avira Premium Security Suite MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

–
End of file - 14276 bytes


Startup list

StartupList report, 10/12/2008, 7:19:02 AM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16705)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\tbctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Avira\Avira Premium Security Suite\avwsc.exe

————————————————–

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Lexmark X73 Button Monitor = C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
NvCplDaemon = "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
PrinTray = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
DiskeeperSystray = "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
SunJavaUpdateSched = "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
nwiz = "nwiz.exe" /install
Lexmark X73 Button Manager = C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
VX3000 = C:\WINDOWS\vVX3000.exe
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
LifeCam = "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
Zune Launcher = "C:\Program Files\Zune\ZuneLauncher.exe"
GrooveMonitor = "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
InCD = C:\Program Files\Ahead\InCD\InCD.exe
avgnt = "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
TraySantaCruz = C:\WINDOWS\system32\tbctray.exe
MSConfig = C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
swg = C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
msnmsgr = "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
Veoh = "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
WMPNSCFG = C:\Program Files\Windows Media Player\WMPNSCFG.exe

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\DREAMA~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

btorbit.com - C:\Program Files\Orbitdownloader\orbitcth.dll - {000123B4-9B42-4900-B3F7-F4B073EFC214}
IDM Helper - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IDMIECC.dll - {0055C089-8582-441B-A0BF-17B458C2A3A8}
(no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll - {259F616C-A300-44F5-B04A-ED001A26C85C}
(no name) - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll - {3049C3E9-B461-4BC5-8870-4C09146192CA}
(no name) - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll - {72853161-30C5-4D22-B7F9-0BBC1D38A37E}
(no name) - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
(no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
(no name) - c:\program files\google\googletoolbar4.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

————————————————–

Enumerating Task Scheduler jobs:

Microsoft_Hardware_Launch_setup_exe.job
Microsoft_Hardware_Launch_vVX3000_exe.job
PCHealth Scheduler for Data Collection.job
Tune-up Application Start.job

————————————————–

Enumerating Download Program Files:

[SysProWmi Class]
InProcServer32 = C:\WINDOWS\system32\Dell\SystemProfiler\SysPro.ocx
CODEBASE = http://support.dell.com/systemprofiler/SysPro.CAB

[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Macromedia Authorware Web Player Control]
InProcServer32 = C:\WINDOWS\system32\macromed\authorwa\awswax.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa…are/awswaxf.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwa…director/sw.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://download.microsoft.com/download/0/5…heckControl.cab

[StreamPlug Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\STREAM~1.DLL
CODEBASE = http://www.streamplug.com/StreamPlug/beta/SP.cab

[Trend Micro ActiveX Scan Agent 6.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.1\Housecall_ActiveX.dll
CODEBASE = http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab

[Symantec AntiVirus scanner]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll
CODEBASE = http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab

[Snapfish Activia]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\SnapfishActivia1000.ocx
CODEBASE = http://photo.walgreens.com/WalgreensActivia.cab

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\System32\opuc.dll
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

[BDSCANONLINE Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\oscan8.ocx
CODEBASE = http://download.bitdefender.com/resources/scan8/oscan8.cab

[Symantec RuFSI Utility Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
CODEBASE = http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdat…b?1124055239609

[Trend Micro ActiveX Scan Agent 6.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Housecall_ActiveX.dll
CODEBASE = http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab

[InstallShield International Setup Player]
InProcServer32 = c:\windows\DOWNLO~1\isetupml.dll
CODEBASE = http://ftp.hp.com/pub/automatic/player/isetupML.cab

[DmiReader Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SYSPRO~1.DLL
CODEBASE = http://ftp.us.dell.com/fixes/PROFILER.CAB

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll
CODEBASE = http://security1.norton.com/SSC/SharedCont…c/bin/cabsa.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx
CODEBASE = http://fpdownload.macromedia.com/get/flash…ent/swflash.cab

[Driver Agent ActiveX Control]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\driveragent.ocx
CODEBASE = http://driveragent.com/files/driveragent.cab

[MSN Chat Control 4.5]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSNChat45.ocx
CODEBASE = http://chat.msn.com/controls/msnchat45.cab

————————————————–

Enumerating Winsock LSP files:

Protocol #1: avsda.dll (file MISSING)
Protocol #2: avsda.dll (file MISSING)
Protocol #26: avsda.dll (file MISSING)

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
mjd: *Registry key not found*

————————————————–
End of report, 11,777 bytes
Report generated in 0.219 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


thanks for help
Post #2
Hi and welcome to the forums here at WTT. :welcome:

I assume this is you over at Bleeping Computer?

http://www.bleepingcomputer.com/forums/topic173978.html

If it is then if you want help here I'd be happy to do so. Just do me a favor and have them close the thread over at BC, then follow the instructions below. It can get confusing and cause issues if you have more than one person helping you.

  • Download random's system information tool (RSIT) by random/random from here.
  • It is important that is saved to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
Post #3
Hi indigenus for your help.

Log.txt

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-10-15 06:28:01
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 12 GB (16%) free of 76 GB
Total RAM: 511 MB (7% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:29:34 AM, on 10/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\tbctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\GILBERT\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\GILBERT.exe
C:\WINDOWS\SoftwareDistribution\Download\Install\windows-kb890830-v2.3-delta.exe
f:\24c7e0554a6e382f2e4d2357f9\mrtstub.exe
C:\WINDOWS\system32\MRT.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download; by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab; video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Search; - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: Do&wnload; selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load; all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEExt.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\GILBERT\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124055239609
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security1.norton.com/SSC/SharedCont…c/bin/cabsa.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O21 - SSODL: mjd - {8A521329-067E-4204-87E5-29200ADB7582} - (no file)
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Avira Premium Security Suite MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

–
End of file - 14579 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Microsoft_Hardware_Launch_setup_exe.job
C:\WINDOWS\tasks\Microsoft_Hardware_Launch_vVX3000_exe.job
C:\WINDOWS\tasks\PCHealth Scheduler for Data Collection.job
C:\WINDOWS\tasks\Tune-up Application Start.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}]
Octh Class - C:\Program Files\Orbitdownloader\orbitcth.dll [2008-09-04 130248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
IDMIEHlprObj Class - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IDMIECC.dll [2008-07-24 91568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{259F616C-A300-44F5-B04A-ED001A26C85C}]
Solid Converter PDF - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll [2006-08-03 259592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-05-01 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-12-14 392240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-15 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2006-08-24 439872]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google; - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392]
{259F616C-A300-44F5-B04A-ED001A26C85C} - Solid Converter PDF - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll [2006-08-03 259592]
{D0943516-5076-4020-A3B5-AEFAF26AB263} - Veoh Browser Plug-in - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll [2008-06-19 352256]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Lexmark X73 Button Monitor"=C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe [2001-10-08 53248]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2003-10-06 5058560]
"PrinTray"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe [2001-10-12 36864]
"DiskeeperSystray"=C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe [2005-11-22 221184]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"nwiz"=nwiz.exe /install []
"Lexmark X73 Button Manager"=C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe [2001-07-11 53248]
"VX3000"=C:\WINDOWS\vVX3000.exe [2007-04-10 709992]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"LifeCam"=C:\Program Files\Microsoft LifeCam\LifeExp.exe [2007-05-17 279912]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-05-01 185896]
"Zune Launcher"=C:\Program Files\Zune\ZuneLauncher.exe [2008-09-12 160160]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2007-08-24 33648]
"InCD"=C:\Program Files\Ahead\InCD\InCD.exe [2006-03-23 1398272]
"avgnt"=C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe [2008-09-08 266497]
"TraySantaCruz"=C:\WINDOWS\system32\tbctray.exe [2003-06-23 290816]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-18 68856]
"msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2007-10-18 5724184]
"Veoh"=C:\Program Files\Veoh Networks\Veoh\VeohClient.exe [2008-08-28 3660848]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"helpsvc"=2
"AVG Anti-Spyware Guard"=2

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
WRLogonNTF.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
mjd - {8A521329-067E-4204-87E5-29200ADB7582}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"=C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]
"{8EB8B0AE-B706-419A-A5D6-E39C5E888AE8}"= []

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\hgGvvsQh

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe"="C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe:*:Disabled:backWeb-7288971"
"C:\WINDOWS\System32\fxsclnt.exe"="C:\WINDOWS\System32\fxsclnt.exe:*:Enabled:Microsoft Fax Console"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\DAP\DAP.EXE"="C:\Program Files\DAP\DAP.EXE:*:Enabled:Download Accelerator Plus (DAP)"
"C:\WINDOWS\System32\ZoneLabs\vsmon.exe"="C:\WINDOWS\System32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service"
"C:\Program Files\Microsoft LifeCam\LifeExp.exe"="C:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe"
"C:\Program Files\Microsoft LifeCam\LifeCam.exe"="C:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Orbitdownloader\orbitdm.exe"="C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit"
"C:\Program Files\Orbitdownloader\orbitnet.exe"="C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{286eaa18-05c3-11dc-ad66-0010b59b656f}]
shell\AutoRun\command - G:\JDSecure\Windows\JDSecure31.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32855622-5371-11dc-adbf-0010b59b656f}]
shell\AutoRun\command - D:\setupSNK.exe


======File associations======

.reg - open - regedit.exe "%1" %*

======List of files/folders created in the last 3 months======

2100-02-08 16:03:54 —-A—- C:\Program Files\ACMonitor_X73.exe
2100-02-08 15:53:34 —-A—- C:\WINDOWS\GtX73.ini
2100-02-08 15:53:34 —-A—- C:\Program Files\gtx73.ini
2008-10-15 06:28:01 —-D—- C:\rsit
2008-10-14 22:45:37 —-D—- C:\WINDOWS\LastGood
2008-10-13 10:02:10 —-D—- C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-10-12 07:07:45 —-D—- C:\Program Files\Trend Micro
2008-09-20 23:24:15 —-HDC—- C:\WINDOWS\$NtUninstallwinusb0100$
2008-09-20 23:21:35 —-HDC—- C:\WINDOWS\$NtUninstallWudf01007$
2008-09-20 22:55:50 —-N—- C:\WINDOWS\system32\imapi2fs.dll
2008-09-20 22:55:45 —-N—- C:\WINDOWS\system32\imapi2.dll
2008-09-12 18:48:22 —-A—- C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2008-09-12 18:46:32 —-A—- C:\WINDOWS\system32\ZuneBusEnum.exe
2008-09-12 18:32:14 —-A—- C:\WINDOWS\system32\ZuneTcp2Udp.dll
2008-09-12 18:32:12 —-A—- C:\WINDOWS\system32\ZuneRegUtil.dll
2008-09-12 18:32:12 —-A—- C:\WINDOWS\system32\ZunePTDNS.dll
2008-09-12 18:32:10 —-A—- C:\WINDOWS\system32\ZuneNetProxy.dll
2008-09-08 19:42:52 —-D—- C:\Documents and Settings\GILBERT\Application Data\Avira
2008-09-08 16:07:43 —-A—- C:\WINDOWS\SchedLog.Txt
2008-09-08 13:31:21 —-D—- C:\Documents and Settings\GILBERT\Application Data\Thinstall
2008-09-08 07:49:44 —-ASH—- C:\WINDOWS\system32\btfpykuh.ini
2008-09-08 07:48:58 —-A—- C:\WINDOWS\system32\a30b96df-.txt
2008-09-08 07:48:31 —-ASH—- C:\WINDOWS\system32\hQsvvGgh.ini2
2008-09-08 07:48:30 —-ASH—- C:\WINDOWS\system32\hQsvvGgh.ini
2008-09-08 07:46:58 —-A—- C:\WINDOWS\system32\avsda.dll
2008-09-08 07:46:56 —-D—- C:\Program Files\Avira
2008-09-08 07:46:56 —-D—- C:\Documents and Settings\All Users\Application Data\Avira
2008-08-27 16:19:00 —-A—- C:\WINDOWS\system32\WUDFUpdate_01007.dll
2008-08-27 16:19:00 —-A—- C:\WINDOWS\system32\WinUSBCoInstaller.dll
2008-08-15 17:25:11 —-D—- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-04 13:36:00 —-D—- C:\Program Files\My Product Name
2008-08-04 10:18:43 —-D—- C:\Program Files\Dream Aquarium
2008-08-02 11:28:09 —-D—- C:\Program Files\Common Files\EZB Systems
2008-08-02 11:27:46 —-D—- C:\Program Files\UltraISO
2008-07-28 11:52:10 —-A—- C:\WINDOWS\ARCHPR.INI
2008-07-27 12:17:45 —-D—- C:\Program Files\Microsoft Student
2008-07-26 11:13:08 —-D—- C:\downloads
2008-07-26 11:13:08 —-D—- C:\Documents and Settings\GILBERT\Application Data\GrabPro
2008-07-26 11:12:52 —-D—- C:\Documents and Settings\GILBERT\Application Data\Orbit
2008-07-26 11:12:45 —-D—- C:\Program Files\Orbitdownloader
2008-07-26 00:12:02 —-D—- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-07-24 19:15:30 —-A—- C:\WINDOWS\system32\msonpmon.dll
2008-07-24 19:02:41 —-D—- C:\Program Files\Microsoft Visual Studio
2008-07-24 19:02:40 —-D—- C:\Program Files\Common Files\DESIGNER
2008-07-24 19:00:50 —-D—- C:\Program Files\Microsoft.NET
2008-07-24 18:52:39 —-D—- C:\Program Files\Microsoft Visual Studio 8
2008-07-24 18:50:26 —-D—- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-07-24 18:47:41 —-RHD—- C:\MSOCache
2008-07-21 20:25:10 —-A—- C:\WINDOWS\system32\spmsgXP_2k3.dll
2008-07-21 20:25:07 —-HDC—- C:\WINDOWS\$NtUninstallWdf01007$
2008-07-21 19:58:51 —-D—- C:\WINDOWS\Prefetch
2008-07-21 18:10:28 —-D—- C:\WINDOWS\system32\scripting
2008-07-21 18:10:22 —-D—- C:\WINDOWS\l2schemas
2008-07-21 18:10:21 —-D—- C:\WINDOWS\system32\en
2008-07-21 07:58:47 —-A—- C:\WINDOWS\system32\wlanapi.dll
2008-07-21 07:58:34 —-A—- C:\WINDOWS\system32\tspkg.dll
2008-07-21 07:58:19 —-A—- C:\WINDOWS\system32\setupn.exe
2008-07-21 07:58:12 —-A—- C:\WINDOWS\system32\rasqec.dll
2008-07-21 07:58:12 —-A—- C:\WINDOWS\system32\qutil.dll
2008-07-21 07:58:10 —-A—- C:\WINDOWS\system32\qcliprov.dll
2008-07-21 07:58:10 —-A—- C:\WINDOWS\system32\qagentrt.dll
2008-07-21 07:58:10 —-A—- C:\WINDOWS\system32\qagent.dll
2008-07-21 07:58:05 —-A—- C:\WINDOWS\system32\onex.dll
2008-07-21 07:57:54 —-A—- C:\WINDOWS\system32\napstat.exe
2008-07-21 07:57:54 —-A—- C:\WINDOWS\system32\napmontr.dll
2008-07-21 07:57:54 —-A—- C:\WINDOWS\system32\napipsec.dll
2008-07-21 07:57:52 —-A—- C:\WINDOWS\system32\msxml6r.dll
2008-07-21 07:57:49 —-A—- C:\WINDOWS\system32\msshavmsg.dll
2008-07-21 07:57:49 —-A—- C:\WINDOWS\system32\mssha.dll
2008-07-21 07:57:28 —-A—- C:\WINDOWS\system32\mmcperf.exe
2008-07-21 07:57:28 —-A—- C:\WINDOWS\system32\mmcfxcommon.dll
2008-07-21 07:57:28 —-A—- C:\WINDOWS\system32\mmcex.dll
2008-07-21 07:57:28 —-A—- C:\WINDOWS\system32\microsoft.managementconsole.dll
2008-07-21 07:57:15 —-A—- C:\WINDOWS\system32\l2gpstore.dll
2008-07-21 07:57:15 —-A—- C:\WINDOWS\system32\kmsvc.dll
2008-07-21 07:57:14 —-A—- C:\WINDOWS\system32\kbdpash.dll
2008-07-21 07:57:14 —-A—- C:\WINDOWS\system32\kbdnepr.dll
2008-07-21 07:57:14 —-A—- C:\WINDOWS\system32\kbdiultn.dll
2008-07-21 07:57:14 —-A—- C:\WINDOWS\system32\kbdbhc.dll
2008-07-21 07:56:53 —-A—- C:\WINDOWS\006288_.tmp
2008-07-21 07:56:51 —-A—- C:\WINDOWS\system32\eapsvc.dll
2008-07-21 07:56:51 —-A—- C:\WINDOWS\system32\eapqec.dll
2008-07-21 07:56:51 —-A—- C:\WINDOWS\system32\eappprxy.dll
2008-07-21 07:56:50 —-A—- C:\WINDOWS\system32\eapphost.dll
2008-07-21 07:56:50 —-A—- C:\WINDOWS\system32\eappgnui.dll
2008-07-21 07:56:50 —-A—- C:\WINDOWS\system32\eappcfg.dll
2008-07-21 07:56:50 —-A—- C:\WINDOWS\system32\eapp3hst.dll
2008-07-21 07:56:50 —-A—- C:\WINDOWS\system32\eapolqec.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3ui.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3svc.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3msm.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3gpclnt.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3dlg.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3cfg.dll
2008-07-21 07:56:46 —-A—- C:\WINDOWS\system32\dot3api.dll
2008-07-21 07:56:44 —-A—- C:\WINDOWS\system32\dimsroam.dll
2008-07-21 07:56:44 —-A—- C:\WINDOWS\system32\dimsntfy.dll
2008-07-21 07:56:43 —-A—- C:\WINDOWS\system32\dhcpqec.dll
2008-07-21 07:56:39 —-A—- C:\WINDOWS\system32\credssp.dll
2008-07-21 07:56:31 —-A—- C:\WINDOWS\system32\bitsprx4.dll
2008-07-21 07:56:30 —-A—- C:\WINDOWS\system32\azroles.dll
2008-07-20 22:16:38 —-D—- C:\Program Files\Sun
2008-07-20 22:16:17 —-A—- C:\WINDOWS\system32\javaws.exe
2008-07-20 22:16:17 —-A—- C:\WINDOWS\system32\javaw.exe
2008-07-20 22:16:17 —-A—- C:\WINDOWS\system32\java.exe
2008-07-20 11:08:14 —-D—- C:\Documents and Settings\GILBERT\Application Data\Malwarebytes
2008-07-20 11:07:50 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-20 11:07:43 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-19 06:59:39 —-D—- C:\Documents and Settings\GILBERT\Application Data\IDM
2008-07-18 22:14:53 —-D—- C:\Program Files\FLV Player
2008-07-17 22:07:41 —-D—- C:\Program Files\uTorrent
2008-07-17 22:07:36 —-D—- C:\Documents and Settings\GILBERT\Application Data\uTorrent
2008-07-17 17:12:19 —-D—- C:\Documents and Settings\GILBERT\Application Data\DMCache
2008-07-17 09:51:59 —-D—- C:\Program Files\IVCsoft

======List of files/folders modified in the last 3 months======

2008-10-15 06:29:19 —-D—- C:\WINDOWS\Debug
2008-10-15 06:28:40 —-SHD—- C:\WINDOWS\Installer
2008-10-15 06:28:39 —-HD—- C:\Config.Msi
2008-10-15 05:01:36 —-D—- C:\WINDOWS\TEMP
2008-10-15 00:30:03 —-HD—- C:\WINDOWS\inf
2008-10-15 00:28:25 —-HD—- C:\WINDOWS\$hf_mig$
2008-10-15 00:28:23 —-D—- C:\WINDOWS
2008-10-14 22:55:23 —-A—- C:\WINDOWS\ModemLog_Motorola USB Modem.txt
2008-10-14 22:49:52 —-D—- C:\WINDOWS\system32\CatRoot
2008-10-14 22:49:52 —-D—- C:\Program Files\Motorola Phone Tools
2008-10-14 22:49:11 —-D—- C:\WINDOWS\system32\DRIVERS
2008-10-14 22:48:34 —-RSHD—- C:\WINDOWS\system32\dllcache
2008-10-14 22:45:39 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-10-14 22:43:34 —-HD—- C:\Program Files\InstallShield Installation Information
2008-10-14 21:56:09 —-D—- C:\Program Files\Avanquest update
2008-10-14 21:55:55 —-D—- C:\Documents and Settings\GILBERT\Application Data\InstallShield
2008-10-13 12:52:51 —-D—- C:\WINDOWS\system32\CatRoot2
2008-10-13 12:33:17 —-A—- C:\WINDOWS\X73_DS.ini
2008-10-12 07:07:45 —-D—- C:\Program Files
2008-10-12 07:03:44 —-AH—- C:\boot.ini
2008-10-12 07:03:44 —-A—- C:\WINDOWS\win.ini
2008-10-12 07:03:44 —-A—- C:\WINDOWS\system.ini
2008-10-11 16:44:08 —-D—- C:\Program Files\Mozilla Firefox
2008-10-07 14:19:40 —-A—- C:\WINDOWS\system32\MRT.exe
2008-10-07 07:02:54 —-D—- C:\Documents and Settings\GILBERT\Application Data\Mozilla
2008-10-05 13:40:31 —-D—- C:\Documents and Settings\GILBERT\Application Data\SolidDocuments
2008-09-23 22:39:01 —-D—- C:\Documents and Settings\GILBERT\Application Data\DivX
2008-09-22 15:10:10 —-D—- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-09-20 23:24:18 —-D—- C:\WINDOWS\SYSTEM32
2008-09-20 23:21:48 —-D—- C:\WINDOWS\system32\LogFiles
2008-09-20 23:15:37 —-D—- C:\Program Files\Zune
2008-09-20 23:09:44 —-RSD—- C:\WINDOWS\assembly
2008-09-20 23:06:54 —-D—- C:\WINDOWS\Microsoft.NET
2008-09-20 23:03:18 —-D—- C:\WINDOWS\system32\ReinstallBackups
2008-09-19 17:30:03 —-A—- C:\balance.txt
2008-09-16 18:56:52 —-A—- C:\WINDOWS\ModemLog_Motorola USB Modem #2.txt
2008-09-16 18:40:52 —-D—- C:\Documents and Settings\GILBERT\Application Data\Google
2008-09-16 06:27:16 —-D—- C:\Documents and Settings\GILBERT\Application Data\Macromedia
2008-09-16 06:27:09 —-SD—- C:\Documents and Settings\GILBERT\Application Data\Microsoft
2008-09-15 22:15:04 —-D—- C:\My Downloads
2008-09-15 22:14:52 —-D—- C:\MyWorks
2008-09-15 21:44:11 —-SHD—- C:\Recycled
2008-09-15 21:44:02 —-D—- C:\Documents and Settings\GILBERT\Application Data\Walgreens
2008-09-15 21:44:00 —-D—- C:\Documents and Settings\GILBERT\Application Data\Musicmatch
2008-09-15 21:43:55 —-D—- C:\Documents and Settings\GILBERT\Application Data\Cyberlink
2008-09-15 21:43:54 —-D—- C:\Documents and Settings\GILBERT\Application Data\Ahead
2008-09-15 21:43:52 —-D—- C:\Documents and Settings\GILBERT\Application Data\Adobe
2008-09-15 21:43:45 —-D—- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-15 21:43:45 —-D—- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-15 21:43:45 —-D—- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-15 21:43:44 —-D—- C:\Documents and Settings\All Users\Application Data\Ahead
2008-09-15 21:02:18 —-D—- C:\WINDOWS\system32\config
2008-09-15 20:12:51 —-SD—- C:\WINDOWS\Downloaded Program Files
2008-09-15 20:11:34 —-A—- C:\WINDOWS\MSIOSD.INI
2008-09-15 20:11:34 —-A—- C:\WINDOWS\MMKEYBD.INI
2008-09-15 20:09:00 —-D—- C:\WINDOWS\system32\WAH dir
2008-09-15 20:08:24 —-SD—- C:\WINDOWS\TASKS
2008-09-15 20:07:27 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-15 20:06:21 —-AD—- C:\Program Files\Common Files
2008-09-15 19:57:52 —-D—- C:\Program Files\Common Files\Microsoft Shared
2008-09-15 19:57:02 —-RSD—- C:\WINDOWS\FONTS
2008-09-15 19:55:16 —-D—- C:\Program Files\Google
2008-09-15 19:46:39 —-A—- C:\WINDOWS\Transcnd.ini
2008-09-15 19:28:16 —-D—- C:\WINDOWS\Corel
2008-09-15 18:43:20 —-D—- C:\WINDOWS\NewSoft
2008-09-15 18:35:48 —-A—- C:\WINDOWS\pi2000.ini
2008-09-15 18:35:48 —-A—- C:\WINDOWS\photoprn.ini
2008-09-15 18:00:25 —-A—- C:\WINDOWS\WinInit.INI
2008-09-15 17:51:03 —-D—- C:\Program Files\Common Files\Autodesk Shared
2008-09-12 18:32:14 —-A—- C:\WINDOWS\system32\ZuneUsbTransport.dll
2008-09-12 18:32:08 —-A—- C:\WINDOWS\system32\ZuneMTPZ.dll
2008-09-10 06:50:51 —-D—- C:\WINDOWS\WinSxS
2008-09-08 13:50:52 —-D—- C:\WINDOWS\Minidump
2008-09-05 06:05:44 —-A—- C:\WINDOWS\NeroDigital.ini
2008-08-30 18:43:25 —-D—- C:\WINDOWS\Downloaded Installations
2008-08-21 21:10:59 —-D—- C:\WINDOWS\HELP
2008-08-20 00:02:30 —-D—- C:\Program Files\Microsoft Silverlight
2008-08-15 16:56:46 —-D—- C:\Program Files\Microsoft Picture It! PhotoPub
2008-08-14 20:15:05 —-D—- C:\WINDOWS\system32\wbem
2008-08-14 20:15:04 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2008-08-13 00:24:46 —-D—- C:\Program Files\Internet Explorer
2008-08-13 00:17:26 —-RD—- C:\Program Files\Messenger
2008-08-13 00:04:26 —-D—- C:\WINDOWS\ie7updates
2008-07-28 10:37:24 —-A—- C:\WINDOWS\ARPR.INI
2008-07-24 19:24:57 —-HD—- C:\WINDOWS\ShellNew
2008-07-24 19:24:24 —-D—- C:\Program Files\Common Files\SYSTEM
2008-07-24 19:04:22 —-D—- C:\Program Files\Microsoft Works
2008-07-24 19:03:26 —-D—- C:\Program Files\MSBuild
2008-07-24 19:03:01 —-D—- C:\Program Files\Microsoft Office
2008-07-24 18:57:43 —-D—- C:\WINDOWS\MEDIA
2008-07-21 19:57:32 —-D—- C:\WINDOWS\system32\Setup
2008-07-21 19:57:32 —-D—- C:\WINDOWS\AppPatch
2008-07-21 18:25:08 —-D—- C:\WINDOWS\security
2008-07-21 18:11:00 —-D—- C:\WINDOWS\ServicePackFiles
2008-07-21 18:10:54 —-D—- C:\WINDOWS\network diagnostic
2008-07-21 18:10:54 —-D—- C:\WINDOWS\ime
2008-07-21 18:10:34 —-D—- C:\WINDOWS\system32\usmt
2008-07-21 18:10:34 —-D—- C:\WINDOWS\system32\en-US
2008-07-21 18:10:20 —-D—- C:\WINDOWS\system32\bits
2008-07-21 18:10:20 —-D—- C:\WINDOWS\PeerNet
2008-07-21 18:10:19 —-RD—- C:\Program Files\Movie Maker
2008-07-21 18:05:27 —-D—- C:\WINDOWS\system32\Restore
2008-07-21 18:05:26 —-D—- C:\WINDOWS\system32\npp
2008-07-21 18:05:25 —-D—- C:\WINDOWS\MSAGENT
2008-07-21 18:05:23 —-D—- C:\WINDOWS\srchasst
2008-07-21 18:05:22 —-RD—- C:\Program Files\NetMeeting
2008-07-21 18:05:19 —-D—- C:\WINDOWS\system32\Com
2008-07-21 18:05:15 —-RD—- C:\Program Files\Windows Media Player
2008-07-21 18:05:15 —-D—- C:\Program Files\Windows NT
2008-07-21 18:05:14 —-RD—- C:\Program Files\Outlook Express
2008-07-21 18:04:45 —-D—- C:\WINDOWS\system32\oobe
2008-07-21 18:04:43 —-D—- C:\WINDOWS\SYSTEM
2008-07-21 17:58:47 —-HDC—- C:\WINDOWS\$NtServicePackUninstall$
2008-07-21 17:51:42 —-D—- C:\WINDOWS\ehome
2008-07-20 22:16:15 —-D—- C:\Program Files\Java
2008-07-20 14:50:57 —-D—- C:\WINDOWS\Internet Logs
2008-07-20 01:35:08 —-D—- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-18 22:10:48 —-A—- C:\WINDOWS\system32\cdm.dll
2008-07-18 22:10:42 —-A—- C:\WINDOWS\system32\wuauclt.exe
2008-07-18 22:10:40 —-A—- C:\WINDOWS\system32\wups2.dll
2008-07-18 22:10:24 —-A—- C:\WINDOWS\system32\wucltui.dll.mui
2008-07-18 22:10:20 —-A—- C:\WINDOWS\system32\wups.dll
2008-07-18 22:09:46 —-A—- C:\WINDOWS\system32\wucltui.dll
2008-07-18 22:09:44 —-A—- C:\WINDOWS\system32\wuweb.dll
2008-07-18 22:09:44 —-A—- C:\WINDOWS\system32\wuapi.dll
2008-07-18 22:09:42 —-A—- C:\WINDOWS\system32\wuaueng.dll
2008-07-18 22:09:42 —-A—- C:\WINDOWS\system32\wuapi.dll.mui
2008-07-18 22:08:34 —-A—- C:\WINDOWS\system32\wuaueng.dll.mui
2008-07-18 22:07:34 —-A—- C:\WINDOWS\system32\mucltui.dll
2008-07-18 22:07:32 —-A—- C:\WINDOWS\system32\muweb.dll
2008-07-18 22:07:32 —-A—- C:\WINDOWS\system32\mucltui.dll.mui

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avfwot;avfwot; C:\WINDOWS\system32\DRIVERS\avfwot.sys [2008-09-08 71592]
R1 avgio;avgio; \??\C:\Program Files\Avira\Avira Premium Security Suite\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-09-08 75072]
R1 BUFADPT;BUFADPT; \??\C:\WINDOWS\system32\BUFADPT.SYS []
R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2006-03-23 29440]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2006-03-23 33536]
R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-23 12032]
R2 Aspi32;Aspi32; C:\WINDOWS\System32\drivers\aspi32.sys [2002-07-17 16877]
R2 CX23880;Video Advantage PCI; C:\WINDOWS\system32\drivers\cx88vid.sys [2004-05-17 185216]
R2 CX88XBAR;Video Advantage PCI Crossbar; C:\WINDOWS\system32\drivers\CX88XBAR.sys [2004-05-17 9216]
R2 DLPORTIO;DLPORTIO; \??\C:\WINDOWS\DLPORTIO.sys []
R2 LXARScan;Lexmark X73 MFP Scanner; C:\WINDOWS\System32\Drivers\Lxarscan.sys [2001-06-28 18024]
R2 MBAMDrvService;MBAMDrvService; \??\C:\WINDOWS\system32\drivers\mbam.sys []
R2 zumbus;Zune Bus Enumerator Driver; C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-09-12 40832]
R3 avfwim;AvFw Packet Filter Miniport; C:\WINDOWS\system32\DRIVERS\avfwim.sys [2008-09-08 71464]
R3 avgntflt;avgntflt; \??\C:\Program Files\Avira\Avira Premium Security Suite\avgntflt.sys []
R3 Msikbd2k;DellTouch; C:\WINDOWS\System32\DRIVERS\msikbd2k.sys [2000-10-03 6942]
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2003-10-06 1550043]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-12-05 10368]
R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver; C:\WINDOWS\system32\DRIVERS\SMC1211.SYS [2001-07-11 23153]
R3 tbcspud;Santa Cruz Driver; C:\WINDOWS\system32\drivers\tbcspud.sys [2003-06-23 149632]
R3 tbcwdm;Santa Cruz WDM Driver; C:\WINDOWS\system32\drivers\tbcwdm.sys [2003-06-23 554304]
R3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VX3000;VX-3000; C:\WINDOWS\system32\DRIVERS\VX3000.sys [2007-04-10 1966696]
R3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2006-03-23 102016]
S1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver; \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys []
S1 AvgAsCln;AVG Anti-Spyware Clean Driver; C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys []
S1 OMCI;OMCI; \??\C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS []
S2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys []
S2 MKEMUSB;Panasonic Digital Palmcorder; C:\WINDOWS\System32\Drivers\Mkemusb.sys [2001-08-08 14308]
S3 61883;61883 Unit Device; C:\WINDOWS\System32\DRIVERS\61883.sys [2008-04-13 48128]
S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 Avc;AVC Device; C:\WINDOWS\System32\DRIVERS\avc.sys [2008-04-13 38912]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder; C:\WINDOWS\System32\Drivers\Mkeusbi.sys [2001-12-18 41729]
S3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys []
S3 giveio;giveio; \??\C:\WINDOWS\system32\giveio.sys []
S3 HCF_MSFT;HCF_MSFT; C:\WINDOWS\System32\DRIVERS\HCF_MSFT.sys [2001-08-17 907456]
S3 motccgp;Motorola USB Composite Device Driver; C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 18176]
S3 motccgpfl;MotCcgpFlService; C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 7680]
S3 motmodem;Motorola USB CDC ACM Driver; C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-06-18 23680]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\System32\DRIVERS\msdv.sys [2008-04-13 51200]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 ndiscm;Motorola SURFboard USB Cable Modem Windows Driver; C:\WINDOWS\system32\DRIVERS\NetMotCM.sys [2004-02-09 15360]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NIC1394;1394 Net Driver; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 NUVision;NUVision Video Service; C:\WINDOWS\System32\DRIVERS\nuvision.sys [2002-01-26 135424]
S3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4.sys [2001-08-17 731648]
S3 Pcouffin;Low level access layer for CD devices; C:\WINDOWS\System32\Drivers\Pcouffin.sys []
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-23 5888]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\System32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 TVICHW32;TVICHW32; \??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS []
S3 USB_RNDIS;Thomson ST Remote NDIS Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2008-04-13 12800]
S3 USBPVR;PVR STB.; C:\WINDOWS\system32\DRIVERS\usbpvr.sys [2005-01-14 18560]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;Motorola USB Modem Driver; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-13 26112]
S3 usbsermpt;Motorola USB Modem Driver for MPT; C:\WINDOWS\system32\DRIVERS\usbsermpt.sys [2007-01-04 22768]
S3 vtdg46xx;vtdg46xx; \??\C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys []
S3 Web2CamService;SiPix iQuest DualCam; C:\WINDOWS\System32\Drivers\Web2.sys []
S3 Winachcf;Winachcf; C:\WINDOWS\System32\DRIVERS\winachcf.sys [2001-08-13 737973]
S3 WinUSB;WinUSB; C:\WINDOWS\system32\DRIVERS\WinUSB.sys [2006-11-02 39368]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 sr;System Restore Filter Driver; C:\WINDOWS\System32\DRIVERS\sr.sys [2008-04-13 73472]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirFirewallService;Avira Premium Security Suite Firewall; C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-08 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard; C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-08 164097]
R2 AntiVirScheduler;Avira Premium Security Suite Scheduler; C:\Program Files\Avira\Avira Premium Security Suite\sched.exe [2008-09-08 68865]
R2 AntiVirService;Avira Premium Security Suite Guard; C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe [2008-09-08 149761]
R2 antivirwebservice;Avira Premium Security Suite WebGuard; C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-09-08 258305]
R2 AVEService;Avira Premium Security Suite MailGuard helper service; C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-08 41217]
R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2006-03-23 880128]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2001-10-12 311296]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 Nhksrv;Netropa NHK Server; C:\WINDOWS\Nhksrv.exe [2001-08-06 28672]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\System32\nvsvc32.exe [2003-10-06 81920]
R2 ScReadSpool;SolidPDFConverterReadSpool; C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe [2006-08-03 184320]
R2 WMDM PMSP Service;WMDM PMSP Service; C:\WINDOWS\system32\MsPMSPSv.exe [2001-05-01 53248]
R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R2 ZuneBusEnum;Zune Bus Enumerator; C:\WINDOWS\system32\ZuneBusEnum.exe [2008-09-12 61856]
R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S2 Diskeeper;Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2005-11-23 765952]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S2 InCDsrvR;InCD Helper (read only); C:\Program Files\Ahead\InCD\InCDsrv.exe [2006-03-23 880128]
S2 MBAMService;MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-26 138168]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 ZuneNetworkSvc;Zune Network Sharing Service; C:\Program Files\Zune\ZuneNss.exe [2008-09-12 5119392]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service; C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-09-12 245664]
S4 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard; C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe []
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

—————–EOF—————–

info.txt

info.txt logfile of random's system information tool 1.04 2008-10-15 06:30:17

======Uninstall list======

–>"C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /UNINSTALL /PROMPT
–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {926CC8AE-8414-43DF-8EB4-CF26D9C3C663}
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)–>msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
7-Zip 4.57–>"C:\Program Files\7-Zip\Uninstall.exe"
Adaptec UDF Reader–>C:\WINDOWS\System32\UDFRUNIN.EXE
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)–>MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Photoshop 6.0–>C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 6.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 6.0\Uninst.dll"
Adobe Reader 8.1.2–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe Shockwave Player–>C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~2\UNWISE.EXE C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~2\Install.log
Adobe® Photoshop® Album Starter Edition 3.0–>MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
AnySplit_Freeware–>MsiExec.exe /I{B5E27AA1-619E-4B7D-8458-F719FEE61681}
AutoCAD 2000 Migration Assistance–>C:\WINDOWS\uninst.exe -f"C:\Program Files\ACAD2000\migration\DeIsL1.isu"
AutoCAD 2000–>C:\WINDOWS\uninst.exe -fC:\PROGRA~1\ACAD2000\DeIsL1.isu -c"C:\PROGRA~1\ACAD2000\unacad.dll
Avanquest update–>C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe -runfromtemp -l0x0009 -removeonly
Avira Premium Security Suite–>C:\Program Files\Avira\Avira Premium Security Suite\SETUP.EXE /REMOVE
BackgroundCMD Shell Extension–>"C:\Program Files\BackgroundCMD\uninstall.exe"
Backup Dell-Installed Programs–>MsiExec.exe /X{2A2766A4-6AE4-11D4-AC8E-52544C1966EE}
Browser Mouse 2.03–>C:\Program Files\Browser Mouse\2.03\uninst00.exe
Canon PowerShot A40 WIA Driver–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\PowerShot A40 WIA\Uninst.isu" -c"C:\Program Files\Canon\PowerShot A40 WIA\UNSTD113.dll"
Canon Utilities PhotoStitch 3.1–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\PhotoStitch\Uninst.isu"
Canon Utilities RAW Image Converter–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\RAW Image Converter\Uninst.isu"
Canon Utilities RemoteCapture 2.2–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\RemoteCapture\Uninst.isu"
Canon Utilities ZoomBrowser EX–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\ZoomBrowser EX\Uninst.isu" -c"C:\Program Files\Canon\ZoomBrowser EX\Program\uninstallutilities.dll"
CARD LINK (for USB) 1.20–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8F1471E0-1707-11D6-8125-00105A533D72}\Setup.exe" -l0x9
CloneCD–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Elaborate Bytes\CloneCD\Uninst.isu" -c"C:\Program Files\Elaborate Bytes\CloneCD\InstallHelp.dll"
Color@Home–>C:\WINDOWS\iun6002.exe "C:\Program Files\Glidden\Color@Home\irunin.ini"
Concord Telephony Translation–>RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\CTITELEP.INF, DefaultUninstall.ntx86
Conexant HCF V90 56K Data Fax PCI Modem–>C:\Program Files\UIU\UIU__MODEM_PCI_VEN_14F1&DEV;_1033&SUBSYS;_020D13E0\SETUP.EXE -U -CMODEM -BPCI -IVEN_14F1&DEV;_1033&SUBSYS;_020D13E0
Conexant Video Capture Driver–>C:\WINDOWS\DrvSetup.exe /u
CTIAPI32 (remove only)–>"C:\Program Files\Common Files\Concord\CTIAPI32uninst.exe"
CtiLogC (remove only)–>"C:\Program Files\Common Files\Concord\CtiLogCuninst.exe"
Data Access Objects (DAO) 3.5–>C:\Program Files\Common Files\Microsoft Shared\DAO\Remove.EXE C:\WINDOWS\UNINST.EXE -fC:\PROGRA~1\COMMON~1\MICROS~1\DAO\DeIsL1.isu
Dell Driver Reset Tool–>MsiExec.exe /I{5905F42D-3F5F-4916-ADA6-94A3646AEE76}
Dell ResourceCD–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
Dell Solution Center–>MsiExec.exe /X{11F1920A-56A2-4642-B6E0-3B31A12C9288}
DellTouch–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{706D5382-7381-4680-9DD0-161832578252}\setup.exe"
Diskeeper Professional Premier Edition–>MsiExec.exe /X{20E5F823-61A4-4BCE-9DF4-5DB43F302B69}
DivX Codec–>C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter–>C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player–>C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player–>C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Dr Watson for Microsoft Windows OneCare Live v1.0.0971.38–>MsiExec.exe /I{C544F99D-39EF-4E6D-95BE-4E41C1D8C4CB}
Dream Aquarium–>"C:\Program Files\Dream Aquarium\UnInstall.exe"
DVD Copy Plus–>MsiExec.exe /X{2679A53A-99D9-413F-B12B-056D019328B6}
FLV Player 2.0, build 24–>C:\Program Files\FLV Player\uninst.exe
FoneSync–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\FoneSync\Uninst.isu" -c"C:\Program Files\FoneSync\UninstSupport.dll"
GiPo@MoveOnBoot 1.9.5–>MsiExec.exe /I{9F185C48-595B-401A-A1D6-AAB324890DC4}
Google Toolbar for Internet Explorer–>regsvr32 /u /s "c:\program files\google\googletoolbar4.dll"
HighMAT Extension to Microsoft Windows XP CD Writing Wizard–>MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
HijackThis 2.0.2–>"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.0 (KB932471)–>C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {ECD292A0-0347-4244-8C24-5DBCE990FB40} /package {BAF78226-3200-4DB4-BE33-4D922A799840}
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format SDK (KB902344)–>"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB932716-v2)–>"C:\WINDOWS\$NtUninstallKB932716-v2$\spuninst\spuninst.exe"
hp deskjet 930c series (Remove only)–>C:\Program Files\hp deskjet 930c series\hpfiui.exe -c -vdivid=HPF -vpnum=95 -vinstport=USB003 -vproduct=930c -huninstall
hp deskjet 930c series–>rundll32 hpzcon04.dll,VendorJettison hp deskjet 930c series
InCD Reader–>C:\WINDOWS\unmrw.exe /UNINSTALL
InCD–>C:\WINDOWS\NuNInst.exe /UNINSTALL
Intel Ultra ATA Storage Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\ENGINE\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9984DF60-1C5B-11D3-ACA1-908A4FC10801}\setup.exe" -INTELUNINST
IsoBuster 1.9.1–>"C:\Program Files\Smart Projects\IsoBuster\Uninst\unins000.exe"
J2SE Runtime Environment 5.0 Update 10–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 6–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
J2SE Runtime Environment 5.0 Update 9–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java™ 6 Update 2–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java™ 6 Update 5–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java™ SE Runtime Environment 6 Update 1–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Lexmark X73–>C:\Program Files\LexmarkX73\RemoveX73.exe
MAGIX Ringtone Maker 2 e-version (US)–>C:\MAGIX\Ringtone_Maker_2_silver\instslct.exe
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1–>MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft Base Smart Card Cryptographic Service Provider Package–>"C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Data Access Components KB870669–>C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5–>"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7–>"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe"
Microsoft LifeCam–>MsiExec.exe /X{63AFACBC-4795-4A1B-8037-5085DC03FC54}
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007–>MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007–>"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007–>MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007–>MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007–>MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007–>MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007–>MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007–>MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007–>MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007–>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007–>MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007–>MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007–>MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007–>MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007–>MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007–>MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007–>MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Picture It! Photo 2002–>MsiExec.exe /I{C769A271-7E1C-48F9-B331-474600DD4C06}
Microsoft Picture It! Publishing 2001–>MsiExec.exe /I{15D9EB74-998E-4A04-B468-51C2E7B32182}
Microsoft Silverlight–>MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Student con Encarta Premium 2008–>MsiExec.exe /I{08141881-FCA5-44A7-B863-D66037A16AAF}
Microsoft User-Mode Driver Framework Feature Pack 1.7–>"C:\WINDOWS\$NtUninstallWudf01007$\spuninst\spuninst.exe"
Microsoft WinUsb 1.0–>"C:\WINDOWS\$NtUninstallwinusb0100$\spuninst\spuninst.exe"
Microsoft Works 2001 Setup Launcher–>C:\Program Files\Microsoft Works Suite 2001\Setup\Launcher.exe D:\
Microsoft Works 6.0–>MsiExec.exe /I{F8D0829C-9C6F-11D3-8080-00C04FA329AA}
Microsoft Works Suite Add-in for Microsoft Word–>MsiExec.exe /I{5F629FE8-5B4C-4863-937A-AFC2961F7DD3}
Modem Test–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DF09080-A034-11D4-B229-002078017FBF}\setup.exe" -uninst
Motorola Driver Installation 3.4.0–>MsiExec.exe /I{81B3BEF9-5D97-4096-86E9-5B48A5BC32D0}
Motorola Phone Tools–>C:\Program Files\InstallShield Installation Information\{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}\setup.exe -runfromtemp -l0x0009 -removeonly
Mozilla Firefox (3.0.3)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB925672)–>MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63}
MSXML 4.0 SP2 (KB927978)–>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 Parser and SDK–>MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 6 Enterprise Edition–>C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Nero Digital–>C:\WINDOWS\UNNeroVision.exe /UNINSTALL
Nero Media Player–>C:\WINDOWS\UNNMP.exe /UNINSTALL
Nero Mega Plugin Pack–>MsiExec.exe /I{EF901A4B-A25A-4962-83C6-C6691D062ED9}
NeroMIX–>C:\WINDOWS\UNNMIX.exe /UNINSTALL
NeroVision Express Content–>C:\WINDOWS\UNNVEContent.exe /UNINSTALL
NVIDIA Display Driver–>C:\WINDOWS\System32\nvudisp.exe Uninstall C:\WINDOWS\System32\nvdisp.nvu,NVIDIA Display Driver
NVIDIA Windows 2000/XP Display Drivers–>rundll32.exe C:\WINDOWS\System32\nvinstnt.dll,NvUninstallNT4 nv4_disp.inf
OpenOffice.org Installer 1.0–>MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
Orbit Downloader–>"C:\Program Files\Orbitdownloader\unins000.exe"
Palmcorder USB Device Driver 2.00–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F68794FD-9BBA-44FB-976C-4FCE2B447476}\Setup.exe"
QuickTime–>C:\WINDOWS\unvise32qt.exe C:\WINDOWS\System32\QuickTime\Uninstall.log
RealPlayer–>C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Ringtone Media Studio–>C:\Program Files\InstallShield Installation Information\{FDD8E223-270B-4BD7-BD67-6E4A60E0BE86}\setup.exe -runfromtemp -l0x0009 -removeonly
SeaTools for Windows–>MsiExec.exe /I{98613C99-1399-416C-A07C-1EE1C585D872}
Security Update for 2007 Microsoft Office System (KB951944)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB955936)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1D94099C-2BBA-440E-BD5E-093BBDF8F028}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Microsoft Office Excel 2007 (KB955470)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6E8637D8-10D6-4568-AA06-E2706F31685E}
Security Update for Microsoft Office OneNote 2007 (KB950130)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office PowerPoint 2007 (KB951338)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {558B709B-821B-4FC5-90FC-9A8890641E77}
Security Update for Microsoft Office Publisher 2007 (KB950114)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB954326)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
Security Update for Microsoft Office Word 2007 (KB950113)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Windows Internet Explorer 7 (KB928090)–>"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB929969)–>"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB931768)–>"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB933566)–>"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB937143)–>"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)–>"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Shipping Assistant 3.4–>MsiExec.exe /X{15C77FC3-8137-4A5E-8F81-F559045DD6B0}
Shockwave–>C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~1\UNWISE.EXE C:\WINDOWS\SYSTEM32\MACROMED\SHOCKW~1\INSTALL.LOG
SolidConverterPDF–>MsiExec.exe /I{9BC76CCE-A9EC-4A3A-9B51-D823805E1D1F}
Turtle Beach Santa Cruz–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{CD5A6B33-586E-42BA-A962-7D60C2766EBF} /l1033
UltraISO Premium V8.62–>"C:\Program Files\UltraISO\unins000.exe"
Update for Microsoft Office Outlook 2007 (KB952142)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb956080)–>msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {96CC215F-3F22-4E1E-A101-F0041934A456}
VeohTV BETA–>C:\Program Files\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
Video Server Package–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EC9880C-92C3-4BC1-90B7-CD12EE66392A}\Setup.exe"
Video Server Wrapper Codec (remove only)–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall.NT 132 C:\WINDOWS\INF\aviwrap.inf
Video Vault–>MsiExec.exe /X{993A18C1-0C61-47B6-9B42-075E699F4E11}
VideoAdvantage–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F619B62-0F6D-4747-B778-D7E965994041}\Setup.exe" -l0x9 -removeonly
VideoReDo/Plus Version 2-2-1-445–>"C:\Program Files\VideoReDoPlus\unins000.exe"
Windows Defender Signatures–>MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}
Windows Genuine Advantage v1.3.0254.0–>MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Imaging Component–>"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer–>MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
Windows Live Messenger–>MsiExec.exe /X{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
Windows Live Sign-in Assistant–>MsiExec.exe /I{0ED47137-C071-46CC-A243-E5E33271E10E}
Windows Media Connect–>"C:\WINDOWS\$NtUninstallWMCSetup$\spuninst\spuninst.exe"
Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122–>"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation–>MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver–>C:\Program Files\WinRAR\uninstall.exe
Word Magic Professional Suite Premier 4.46–>MsiExec.exe /I{4DBF540D-BE0D-4009-8BF2-9796FA3300BF}
Yahoo! Install Manager–>C:\WINDOWS\system32\regsvr32 /u C:\WINDOWS\cache\YINSTH~1.DLL
Yahoo! Toolbar for Internet Explorer–>C:\PROGRA~1\YAHOO!\COMMON\unyt.exe
Zune Language Pack (ES)–>MsiExec.exe /X{EE4ACABF-531E-419A-9225-B8E0FA4955AF}
Zune Language Pack (FR)–>MsiExec.exe /X{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}
Zune–>C:\Program Files\Zune\ZuneSetup.exe /x
Zune–>MsiExec.exe /X{FF70513F-E3A7-402F-84FB-B7810A064BE2}

======Hosts File======

127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com

======Security center information======

AV: Avira Premium Security Suite
FW: Avira Firewall

======Environment variables======

"CDROM"=FOO23
"ComSpec"=%SystemRoot%\system32\cmd.exe
"NUMBER_OF_PROCESSORS"=1
"OS"=Windows_NT
"Path"=C:\pvsw\bin;%SYSTEMROOT%\system32;%SYSTEMROOT%;%SYSTEMROOT%\system32\WBEM;C:\PROGRA~1\COMMON~1\AUTODE~1;C:\Program Files\Diskeeper Corporation\Diskeeper\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 1 Stepping 2, GenuineIntel
"PROCESSOR_LEVEL"=15
"PROCESSOR_REVISION"=0102
"PROMPT"=$p$g
"TEMP"=C:\WINDOWS\TEMP
"TMP"=C:\WINDOWS\TEMP
"winbootdir"=C:\WINDOWS
"windir"=C:\WINDOWS
"FP_NO_HOST_CHECK"=NO

—————–EOF—————–
Post #4
Hi,

Question, where did you get your DivX software from?

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Post #5
Hi Indigenus:

I don't now rigth now where I got the divx software.

Log.txt

ComboFix 08-10-15.01 - GILBERT 2008-10-15 17:09:28.1 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\{00000~1
C:\WINDOWS\start.exe
C:\WINDOWS\SYSTEM32\btfpykuh.ini
C:\WINDOWS\system32\components
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\SYSTEM32\hQsvvGgh.ini
C:\WINDOWS\SYSTEM32\hQsvvGgh.ini2
C:\WINDOWS\system32\windows.scr
C:\WINDOWS\Web\default.htt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NPF


((((((((((((((((((((((((( Files Created from 2008-09-15 to 2008-10-15 )))))))))))))))))))))))))))))))
.

2100-02-23 14:35 . 2001-02-22 09:54 768 –a—— C:\WINDOWS\x73_lut.dat
2100-02-23 14:35 . 2001-02-22 09:54 768 –a—— C:\Program Files\x73_lut.dat
2100-02-08 16:03 . 2001-05-11 11:39 53,248 –a—— C:\Program Files\ACMonitor_X73.exe
2100-02-08 15:53 . 2008-09-19 17:30 1,437 –a—— C:\WINDOWS\GtX73.ini
2008-10-15 06:28 . 2008-10-15 06:30 d——– C:\rsit
2008-10-15 00:28 . 2008-09-15 07:12 1,846,400 ——— C:\WINDOWS\SYSTEM32\dllcache\win32k.sys
2008-10-15 00:28 . 2008-09-08 05:41 333,824 ——— C:\WINDOWS\SYSTEM32\dllcache\srv.sys
2008-10-15 00:27 . 2008-08-14 05:11 2,189,184 ——— C:\WINDOWS\SYSTEM32\dllcache\ntoskrnl.exe
2008-10-15 00:27 . 2008-08-14 05:09 2,145,280 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrnlmp.exe
2008-10-15 00:27 . 2008-08-14 04:33 2,066,048 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrnlpa.exe
2008-10-15 00:27 . 2008-08-14 04:33 2,023,936 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrpamp.exe
2008-10-14 22:49 . 2008-10-15 06:42 1,393 –a—— C:\WINDOWS\imsins.BAK
2008-10-13 10:02 . 2008-10-13 10:02 d——– C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-10-12 07:07 . 2008-10-12 07:07 d——– C:\Program Files\Trend Micro
2008-09-23 11:31 . 2008-09-23 11:32 d——– C:\Documents and Settings\GILBERTO JOSE\Application Data\Orbit
2008-09-20 23:24 . 2008-09-20 23:24 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\Msft_User_ZuneDriver_01_07_00.Wdf
2008-09-20 23:24 . 2008-09-20 23:24 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\Msft_Kernel_WinUSB_01007.Wdf
2008-09-20 23:21 . 2008-09-20 23:21 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\MsftWdf_user_01_07_00.Wdf
2008-09-20 22:55 . 2008-05-02 08:25 465,920 ——— C:\WINDOWS\SYSTEM32\imapi2fs.dll
2008-09-20 22:55 . 2008-05-02 08:25 465,920 ——— C:\WINDOWS\SYSTEM32\dllcache\imapi2fs.dll
2008-09-20 22:55 . 2008-05-02 08:25 317,952 ——— C:\WINDOWS\SYSTEM32\imapi2.dll
2008-09-20 22:55 . 2008-05-02 08:25 317,952 ——— C:\WINDOWS\SYSTEM32\dllcache\imapi2.dll
2008-09-20 22:55 . 2008-05-02 05:49 62,976 ——— C:\WINDOWS\SYSTEM32\dllcache\cdrom.sys
2008-09-15 13:40 . 1999-01-10 12:00 3,584 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\DLPortIO.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-15 22:32 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Orbit
2008-10-15 11:46 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-10-15 03:49 ——— d—–w C:\Program Files\Motorola Phone Tools
2008-10-15 03:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-15 02:56 ——— d—–w C:\Program Files\Avanquest update
2008-10-15 02:55 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\InstallShield
2008-10-12 00:43 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\SolidDocuments
2008-10-05 18:40 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\SolidDocuments
2008-10-03 17:41 6,066,176 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2008-09-24 03:39 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\DivX
2008-09-21 04:15 ——— d—–w C:\Program Files\Zune
2008-09-16 02:44 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Walgreens
2008-09-16 02:44 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Musicmatch
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Cyberlink
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Ahead
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ahead
2008-09-16 01:15 ——— d—–w C:\Program Files\Orbitdownloader
2008-09-16 01:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-16 00:55 ——— d—–w C:\Program Files\Google
2008-09-15 22:51 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-09-15 12:12 1,846,400 —-a-w C:\WINDOWS\SYSTEM32\win32k.sys
2008-09-15 12:06 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 23:48 245,664 —-a-w C:\WINDOWS\SYSTEM32\ZuneWlanCfgSvc.exe
2008-09-12 23:46 61,856 —-a-w C:\WINDOWS\SYSTEM32\ZuneBusEnum.exe
2008-09-12 23:32 73,216 —-a-w C:\WINDOWS\SYSTEM32\ZuneUsbTransport.dll
2008-09-12 23:32 57,344 —-a-w C:\WINDOWS\SYSTEM32\ZuneRegUtil.dll
2008-09-12 23:32 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-09-12 23:32 310,272 —-a-w C:\WINDOWS\SYSTEM32\ZuneNetProxy.dll
2008-09-12 23:32 18,944 —-a-w C:\WINDOWS\SYSTEM32\ZuneTcp2Udp.dll
2008-09-12 23:32 145,920 —-a-w C:\WINDOWS\SYSTEM32\ZuneMTPZ.dll
2008-09-12 23:32 12,800 —-a-w C:\WINDOWS\SYSTEM32\ZunePTDNS.dll
2008-09-11 01:09 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2008-09-11 01:09 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2008-09-10 05:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 05:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 00:42 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Avira
2008-09-08 20:58 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Thinstall
2008-09-08 18:31 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Thinstall
2008-09-08 13:16 71,592 —-a-w C:\WINDOWS\system32\drivers\avfwot.sys
2008-09-08 13:16 71,464 —-a-w C:\WINDOWS\system32\drivers\avfwim.sys
2008-09-08 12:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-08 12:46 ——— d—–w C:\Program Files\Avira
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-27 21:19 581,192 —-a-w C:\WINDOWS\SYSTEM32\WinUSBCoInstaller.dll
2008-08-27 21:19 1,302,600 —-a-w C:\WINDOWS\SYSTEM32\WUDFUpdate_01007.dll
2008-08-27 08:24 3,593,216 —-a-w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2008-08-20 05:02 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-15 22:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-15 21:56 ——— d—–w C:\Program Files\Microsoft Picture It! PhotoPub
2008-08-14 10:11 2,189,184 —-a-w C:\WINDOWS\SYSTEM32\ntoskrnl.exe
2008-08-14 10:04 138,496 ——w C:\WINDOWS\SYSTEM32\dllcache\afd.sys
2008-08-14 09:33 2,066,048 —-a-w C:\WINDOWS\SYSTEM32\ntkrnlpa.exe
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\SYSTEM32\dllcache\cdm.dll
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\SYSTEM32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\SYSTEM32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\SYSTEM32\wups.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuaueng.dll
2008-07-19 03:07 270,880 —-a-w C:\WINDOWS\SYSTEM32\mucltui.dll
2008-07-19 03:07 210,976 —-a-w C:\WINDOWS\SYSTEM32\muweb.dll
2008-02-04 20:34 0 —-a-w C:\Documents and Settings\GILBERT\ddadder.exe
2007-01-06 18:04 92,064 —-a-w C:\Documents and Settings\GILBERT\mqdmmdm.sys
2007-01-06 18:04 9,232 —-a-w C:\Documents and Settings\GILBERT\mqdmmdfl.sys
2007-01-06 18:04 79,328 —-a-w C:\Documents and Settings\GILBERT\mqdmserd.sys
2007-01-06 18:04 66,656 —-a-w C:\Documents and Settings\GILBERT\mqdmbus.sys
2007-01-06 18:04 6,208 —-a-w C:\Documents and Settings\GILBERT\mqdmcmnt.sys
2007-01-06 18:04 5,936 —-a-w C:\Documents and Settings\GILBERT\mqdmwhnt.sys
2007-01-06 18:04 4,048 —-a-w C:\Documents and Settings\GILBERT\mqdmcr.sys
2007-01-06 18:04 25,600 —-a-w C:\Documents and Settings\GILBERT\usbsermptxp.sys
2007-01-06 18:04 22,768 —-a-w C:\Documents and Settings\GILBERT\usbsermpt.sys
2006-09-03 23:08 284 —-a-w C:\Documents and Settings\GILBERTO JOSE\Application Data\config.dat
2004-03-11 18:27 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
2002-03-26 15:58 271 –sha-w C:\Program Files\desktop.ini
2002-03-26 15:58 23,357 —ha-w C:\Program Files\folder.htt
2001-07-26 21:58 47 —-a-w C:\Program Files\ACMonitor_X73.ini
2001-07-05 17:46 8,116 —-a-w C:\Program Files\OSLO3071b2.USB
2001-05-08 21:36 114,688 —-a-w C:\Program Files\lxarscan.dll
2001-04-23 19:22 1,437 —-a-w C:\Program Files\gtx73.ini
2006-07-12 00:42 8 –sh–w C:\WINDOWS\DRM\pdrm.dat
.
—-a-w		   294,912 2001-05-10 19:54:26  C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 68856]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark X73 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe" [2001-10-08 53248]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 5058560]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 36864]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Lexmark X73 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe" [2001-07-11 53248]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2007-04-10 709992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-01 185896]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 1398272]
"avgnt"="C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" [2008-09-08 266497]
"TraySantaCruz"="C:\WINDOWS\system32\tbctray.exe" [2003-06-23 290816]
"nwiz"="nwiz.exe" [2003-10-06 C:\WINDOWS\SYSTEM32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-07-26 1707208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VDOM"= vdowave.drv
"VIDC.NTN1"= NUVision.ax
"msacm.WRPR"= aviwrap.dll
"vidc.WRPR"= aviwrap.dll
"VIDC.DVSD"= pdvcodec.dll
"VIDC.JPEG"= JpegCode.dll
"VIDC.MJPG"= JpegCode.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"helpsvc"=2 (0x2)
"AVG Anti-Spyware Guard"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\System32\\fxsclnt.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINDOWS\system32\DRIVERS\IABFilt.sys [2005-07-01 25344]
R1 avfwot;avfwot;C:\WINDOWS\system32\DRIVERS\avfwot.sys [2008-09-08 71592]
R1 BUFADPT;BUFADPT;C:\WINDOWS\system32\BUFADPT.SYS [2004-01-09 9600]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-08 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard;C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-08 164097]
R2 antivirwebservice;Avira Premium Security Suite WebGuard;C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-09-08 258305]
R2 AVEService;Avira Premium Security Suite MailGuard helper service;C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-08 41217]
R2 CX88XBAR;Video Advantage PCI Crossbar;C:\WINDOWS\system32\drivers\CX88XBAR.sys [2004-05-17 9216]
R2 DLPORTIO;DLPORTIO;C:\WINDOWS\DLPORTIO.sys [1999-01-10 3584]
R2 MBAMDrvService;MBAMDrvService;C:\WINDOWS\system32\drivers\mbam.sys [2008-09-10 17200]
R2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 28672]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-09-12 40832]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-09-12 61856]
R3 avfwim;AvFw Packet Filter Miniport;C:\WINDOWS\system32\DRIVERS\avfwim.sys [2008-09-08 71464]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 6942]
R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver;C:\WINDOWS\system32\DRIVERS\SMC1211.SYS [2001-07-11 23153]
R3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys [2003-06-23 149632]
R3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys [2003-06-23 554304]
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkemusb.sys [2001-08-08 14308]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkeusbi.sys [2001-12-18 41729]
S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 18176]
S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 7680]
S3 NUVision;NUVision Video Service;C:\WINDOWS\system32\DRIVERS\nuvision.sys [2002-01-26 135424]
S3 USBPVR;PVR STB.;C:\WINDOWS\system32\DRIVERS\usbpvr.sys [2005-01-14 18560]
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys [2003-06-13 19232]
S3 Web2CamService;SiPix iQuest DualCam;C:\WINDOWS\system32\Drivers\Web2.sys [ ]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-09-12 245664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{286eaa18-05c3-11dc-ad66-0010b59b656f}]
\Shell\AutoRun\command - G:\JDSecure\Windows\JDSecure31.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32855622-5371-11dc-adbf-0010b59b656f}]
\Shell\AutoRun\command - D:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2007-10-22 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []

2008-05-26 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX3000_exe.job
- C:\WINDOWS\vVX3000.exe [2007-04-10 14:46]

2008-10-15 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE []
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\GILBERT\Application Data\Mozilla\Firefox\Profiles\x80mq012.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF -: plugin - C:\Program Files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-15 17:28:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\ahead\InCD\InCDsrv.exe
C:\WINDOWS\SYSTEM32\LEXBCES.EXE
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\WINDOWS\SYSTEM32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-10-15 17:41:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-15 22:41:13

Pre-Run: 12,442,555,392 bytes free
Post-Run: 13,493,599,232 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout = 30
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Home Edition" /fastdetect

307 — E O F — 2008-10-15 11:47:22



ComboFix.txt


ComboFix 08-10-15.01 - GILBERT 2008-10-15 17:09:28.1 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\{00000~1
C:\WINDOWS\start.exe
C:\WINDOWS\SYSTEM32\btfpykuh.ini
C:\WINDOWS\system32\components
C:\WINDOWS\system32\dao350.dll
C:\WINDOWS\SYSTEM32\hQsvvGgh.ini
C:\WINDOWS\SYSTEM32\hQsvvGgh.ini2
C:\WINDOWS\system32\windows.scr
C:\WINDOWS\Web\default.htt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_NPF


((((((((((((((((((((((((( Files Created from 2008-09-15 to 2008-10-15 )))))))))))))))))))))))))))))))
.

2100-02-23 14:35 . 2001-02-22 09:54 768 –a—— C:\WINDOWS\x73_lut.dat
2100-02-23 14:35 . 2001-02-22 09:54 768 –a—— C:\Program Files\x73_lut.dat
2100-02-08 16:03 . 2001-05-11 11:39 53,248 –a—— C:\Program Files\ACMonitor_X73.exe
2100-02-08 15:53 . 2008-09-19 17:30 1,437 –a—— C:\WINDOWS\GtX73.ini
2008-10-15 06:28 . 2008-10-15 06:30 d——– C:\rsit
2008-10-15 00:28 . 2008-09-15 07:12 1,846,400 ——— C:\WINDOWS\SYSTEM32\dllcache\win32k.sys
2008-10-15 00:28 . 2008-09-08 05:41 333,824 ——— C:\WINDOWS\SYSTEM32\dllcache\srv.sys
2008-10-15 00:27 . 2008-08-14 05:11 2,189,184 ——— C:\WINDOWS\SYSTEM32\dllcache\ntoskrnl.exe
2008-10-15 00:27 . 2008-08-14 05:09 2,145,280 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrnlmp.exe
2008-10-15 00:27 . 2008-08-14 04:33 2,066,048 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrnlpa.exe
2008-10-15 00:27 . 2008-08-14 04:33 2,023,936 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrpamp.exe
2008-10-14 22:49 . 2008-10-15 06:42 1,393 –a—— C:\WINDOWS\imsins.BAK
2008-10-13 10:02 . 2008-10-13 10:02 d——– C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-10-12 07:07 . 2008-10-12 07:07 d——– C:\Program Files\Trend Micro
2008-09-23 11:31 . 2008-09-23 11:32 d——– C:\Documents and Settings\GILBERTO JOSE\Application Data\Orbit
2008-09-20 23:24 . 2008-09-20 23:24 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\Msft_User_ZuneDriver_01_07_00.Wdf
2008-09-20 23:24 . 2008-09-20 23:24 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\Msft_Kernel_WinUSB_01007.Wdf
2008-09-20 23:21 . 2008-09-20 23:21 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\MsftWdf_user_01_07_00.Wdf
2008-09-20 22:55 . 2008-05-02 08:25 465,920 ——— C:\WINDOWS\SYSTEM32\imapi2fs.dll
2008-09-20 22:55 . 2008-05-02 08:25 465,920 ——— C:\WINDOWS\SYSTEM32\dllcache\imapi2fs.dll
2008-09-20 22:55 . 2008-05-02 08:25 317,952 ——— C:\WINDOWS\SYSTEM32\imapi2.dll
2008-09-20 22:55 . 2008-05-02 08:25 317,952 ——— C:\WINDOWS\SYSTEM32\dllcache\imapi2.dll
2008-09-20 22:55 . 2008-05-02 05:49 62,976 ——— C:\WINDOWS\SYSTEM32\dllcache\cdrom.sys
2008-09-15 13:40 . 1999-01-10 12:00 3,584 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\DLPortIO.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-15 22:32 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Orbit
2008-10-15 11:46 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-10-15 03:49 ——— d—–w C:\Program Files\Motorola Phone Tools
2008-10-15 03:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-15 02:56 ——— d—–w C:\Program Files\Avanquest update
2008-10-15 02:55 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\InstallShield
2008-10-12 00:43 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\SolidDocuments
2008-10-05 18:40 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\SolidDocuments
2008-10-03 17:41 6,066,176 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2008-09-24 03:39 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\DivX
2008-09-21 04:15 ——— d—–w C:\Program Files\Zune
2008-09-16 02:44 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Walgreens
2008-09-16 02:44 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Musicmatch
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Cyberlink
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Ahead
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ahead
2008-09-16 01:15 ——— d—–w C:\Program Files\Orbitdownloader
2008-09-16 01:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-16 00:55 ——— d—–w C:\Program Files\Google
2008-09-15 22:51 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-09-15 12:12 1,846,400 —-a-w C:\WINDOWS\SYSTEM32\win32k.sys
2008-09-15 12:06 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 23:48 245,664 —-a-w C:\WINDOWS\SYSTEM32\ZuneWlanCfgSvc.exe
2008-09-12 23:46 61,856 —-a-w C:\WINDOWS\SYSTEM32\ZuneBusEnum.exe
2008-09-12 23:32 73,216 —-a-w C:\WINDOWS\SYSTEM32\ZuneUsbTransport.dll
2008-09-12 23:32 57,344 —-a-w C:\WINDOWS\SYSTEM32\ZuneRegUtil.dll
2008-09-12 23:32 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-09-12 23:32 310,272 —-a-w C:\WINDOWS\SYSTEM32\ZuneNetProxy.dll
2008-09-12 23:32 18,944 —-a-w C:\WINDOWS\SYSTEM32\ZuneTcp2Udp.dll
2008-09-12 23:32 145,920 —-a-w C:\WINDOWS\SYSTEM32\ZuneMTPZ.dll
2008-09-12 23:32 12,800 —-a-w C:\WINDOWS\SYSTEM32\ZunePTDNS.dll
2008-09-11 01:09 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2008-09-11 01:09 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2008-09-10 05:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 05:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 00:42 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Avira
2008-09-08 20:58 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Thinstall
2008-09-08 18:31 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Thinstall
2008-09-08 13:16 71,592 —-a-w C:\WINDOWS\system32\drivers\avfwot.sys
2008-09-08 13:16 71,464 —-a-w C:\WINDOWS\system32\drivers\avfwim.sys
2008-09-08 12:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-08 12:46 ——— d—–w C:\Program Files\Avira
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-27 21:19 581,192 —-a-w C:\WINDOWS\SYSTEM32\WinUSBCoInstaller.dll
2008-08-27 21:19 1,302,600 —-a-w C:\WINDOWS\SYSTEM32\WUDFUpdate_01007.dll
2008-08-27 08:24 3,593,216 —-a-w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2008-08-20 05:02 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-15 22:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-08-15 21:56 ——— d—–w C:\Program Files\Microsoft Picture It! PhotoPub
2008-08-14 10:11 2,189,184 —-a-w C:\WINDOWS\SYSTEM32\ntoskrnl.exe
2008-08-14 10:04 138,496 ——w C:\WINDOWS\SYSTEM32\dllcache\afd.sys
2008-08-14 09:33 2,066,048 —-a-w C:\WINDOWS\SYSTEM32\ntkrnlpa.exe
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\SYSTEM32\dllcache\cdm.dll
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\SYSTEM32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\SYSTEM32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\SYSTEM32\wups.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuaueng.dll
2008-07-19 03:07 270,880 —-a-w C:\WINDOWS\SYSTEM32\mucltui.dll
2008-07-19 03:07 210,976 —-a-w C:\WINDOWS\SYSTEM32\muweb.dll
2008-02-04 20:34 0 —-a-w C:\Documents and Settings\GILBERT\ddadder.exe
2007-01-06 18:04 92,064 —-a-w C:\Documents and Settings\GILBERT\mqdmmdm.sys
2007-01-06 18:04 9,232 —-a-w C:\Documents and Settings\GILBERT\mqdmmdfl.sys
2007-01-06 18:04 79,328 —-a-w C:\Documents and Settings\GILBERT\mqdmserd.sys
2007-01-06 18:04 66,656 —-a-w C:\Documents and Settings\GILBERT\mqdmbus.sys
2007-01-06 18:04 6,208 —-a-w C:\Documents and Settings\GILBERT\mqdmcmnt.sys
2007-01-06 18:04 5,936 —-a-w C:\Documents and Settings\GILBERT\mqdmwhnt.sys
2007-01-06 18:04 4,048 —-a-w C:\Documents and Settings\GILBERT\mqdmcr.sys
2007-01-06 18:04 25,600 —-a-w C:\Documents and Settings\GILBERT\usbsermptxp.sys
2007-01-06 18:04 22,768 —-a-w C:\Documents and Settings\GILBERT\usbsermpt.sys
2006-09-03 23:08 284 —-a-w C:\Documents and Settings\GILBERTO JOSE\Application Data\config.dat
2004-03-11 18:27 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
2002-03-26 15:58 271 –sha-w C:\Program Files\desktop.ini
2002-03-26 15:58 23,357 —ha-w C:\Program Files\folder.htt
2001-07-26 21:58 47 —-a-w C:\Program Files\ACMonitor_X73.ini
2001-07-05 17:46 8,116 —-a-w C:\Program Files\OSLO3071b2.USB
2001-05-08 21:36 114,688 —-a-w C:\Program Files\lxarscan.dll
2001-04-23 19:22 1,437 —-a-w C:\Program Files\gtx73.ini
2006-07-12 00:42 8 –sh–w C:\WINDOWS\DRM\pdrm.dat
.
—-a-w		   294,912 2001-05-10 19:54:26  C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 68856]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark X73 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe" [2001-10-08 53248]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 5058560]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 36864]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Lexmark X73 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe" [2001-07-11 53248]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2007-04-10 709992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-01 185896]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 1398272]
"avgnt"="C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" [2008-09-08 266497]
"TraySantaCruz"="C:\WINDOWS\system32\tbctray.exe" [2003-06-23 290816]
"nwiz"="nwiz.exe" [2003-10-06 C:\WINDOWS\SYSTEM32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-07-26 1707208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VDOM"= vdowave.drv
"VIDC.NTN1"= NUVision.ax
"msacm.WRPR"= aviwrap.dll
"vidc.WRPR"= aviwrap.dll
"VIDC.DVSD"= pdvcodec.dll
"VIDC.JPEG"= JpegCode.dll
"VIDC.MJPG"= JpegCode.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"helpsvc"=2 (0x2)
"AVG Anti-Spyware Guard"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\System32\\fxsclnt.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINDOWS\system32\DRIVERS\IABFilt.sys [2005-07-01 25344]
R1 avfwot;avfwot;C:\WINDOWS\system32\DRIVERS\avfwot.sys [2008-09-08 71592]
R1 BUFADPT;BUFADPT;C:\WINDOWS\system32\BUFADPT.SYS [2004-01-09 9600]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-08 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard;C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-08 164097]
R2 antivirwebservice;Avira Premium Security Suite WebGuard;C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-09-08 258305]
R2 AVEService;Avira Premium Security Suite MailGuard helper service;C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-08 41217]
R2 CX88XBAR;Video Advantage PCI Crossbar;C:\WINDOWS\system32\drivers\CX88XBAR.sys [2004-05-17 9216]
R2 DLPORTIO;DLPORTIO;C:\WINDOWS\DLPORTIO.sys [1999-01-10 3584]
R2 MBAMDrvService;MBAMDrvService;C:\WINDOWS\system32\drivers\mbam.sys [2008-09-10 17200]
R2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 28672]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-09-12 40832]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-09-12 61856]
R3 avfwim;AvFw Packet Filter Miniport;C:\WINDOWS\system32\DRIVERS\avfwim.sys [2008-09-08 71464]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 6942]
R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver;C:\WINDOWS\system32\DRIVERS\SMC1211.SYS [2001-07-11 23153]
R3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys [2003-06-23 149632]
R3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys [2003-06-23 554304]
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkemusb.sys [2001-08-08 14308]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkeusbi.sys [2001-12-18 41729]
S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 18176]
S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 7680]
S3 NUVision;NUVision Video Service;C:\WINDOWS\system32\DRIVERS\nuvision.sys [2002-01-26 135424]
S3 USBPVR;PVR STB.;C:\WINDOWS\system32\DRIVERS\usbpvr.sys [2005-01-14 18560]
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys [2003-06-13 19232]
S3 Web2CamService;SiPix iQuest DualCam;C:\WINDOWS\system32\Drivers\Web2.sys [ ]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-09-12 245664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{286eaa18-05c3-11dc-ad66-0010b59b656f}]
\Shell\AutoRun\command - G:\JDSecure\Windows\JDSecure31.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32855622-5371-11dc-adbf-0010b59b656f}]
\Shell\AutoRun\command - D:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2007-10-22 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []

2008-05-26 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX3000_exe.job
- C:\WINDOWS\vVX3000.exe [2007-04-10 14:46]

2008-10-15 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE []
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\GILBERT\Application Data\Mozilla\Firefox\Profiles\x80mq012.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF -: plugin - C:\Program Files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-15 17:28:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\ahead\InCD\InCDsrv.exe
C:\WINDOWS\SYSTEM32\LEXBCES.EXE
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\WINDOWS\SYSTEM32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-10-15 17:41:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-15 22:41:13

Pre-Run: 12,442,555,392 bytes free
Post-Run: 13,493,599,232 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout = 30
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Home Edition" /fastdetect

307 — E O F — 2008-10-15 11:47:22


Thanks for your help
Post #7
HI:

New HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:46:15 PM, on 10/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\tbctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Outlook Express\MSIMN.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\GILBERT\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124055239609
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security1.norton.com/SSC/SharedCont…c/bin/cabsa.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Avira Premium Security Suite MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

–
End of file - 14183 bytes
Post #8
How's it running at this point?

1. Open Notepad

2. Now copy/paste the entire content of the codebox below into the Notepad window:

DirLook::
C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #9
Hi Indigenus:

It's seen to be working ok right now, I disable the helpserv. services because its sometimes freeze the computer, its good o wrong to do this. The Code you gave for combofix is for what. How I get rid the norton, Spybot, Superantispyware.ooVoo, idm514 traces because I don't have this programs anymore. Why there .dll files of the IDM in the divx folder. What is C:\WINDOWS\imsins.BAK.

Thanks for your help.

New HJT and combo fix logs

.ComboFix 08-10-15.08 - GILBERT 2008-10-16 15:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.126 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\GILBERT\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-09-16 to 2008-10-16 )))))))))))))))))))))))))))))))
.

2100-02-23 14:35 . 2001-02-22 09:54 768 –a—— C:\WINDOWS\x73_lut.dat
2100-02-23 14:35 . 2001-02-22 09:54 768 –a—— C:\Program Files\x73_lut.dat
2100-02-08 16:03 . 2001-05-11 11:39 53,248 –a—— C:\Program Files\ACMonitor_X73.exe
2100-02-08 15:53 . 2008-09-19 17:30 1,437 –a—— C:\WINDOWS\GtX73.ini
2008-10-15 06:28 . 2008-10-15 06:30 d——– C:\rsit
2008-10-15 00:28 . 2008-09-15 07:12 1,846,400 ——— C:\WINDOWS\SYSTEM32\dllcache\win32k.sys
2008-10-15 00:28 . 2008-09-08 05:41 333,824 ——— C:\WINDOWS\SYSTEM32\dllcache\srv.sys
2008-10-15 00:27 . 2008-08-14 05:11 2,189,184 ——— C:\WINDOWS\SYSTEM32\dllcache\ntoskrnl.exe
2008-10-15 00:27 . 2008-08-14 05:09 2,145,280 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrnlmp.exe
2008-10-15 00:27 . 2008-08-14 04:33 2,066,048 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrnlpa.exe
2008-10-15 00:27 . 2008-08-14 04:33 2,023,936 ——— C:\WINDOWS\SYSTEM32\dllcache\ntkrpamp.exe
2008-10-14 22:49 . 2008-10-15 06:42 1,393 –a—— C:\WINDOWS\imsins.BAK
2008-10-13 10:02 . 2008-10-13 10:02 d——– C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-10-12 07:07 . 2008-10-12 07:07 d——– C:\Program Files\Trend Micro
2008-09-23 11:31 . 2008-09-23 11:32 d——– C:\Documents and Settings\GILBERTO JOSE\Application Data\Orbit
2008-09-20 23:24 . 2008-09-20 23:24 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\Msft_User_ZuneDriver_01_07_00.Wdf
2008-09-20 23:24 . 2008-09-20 23:24 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\Msft_Kernel_WinUSB_01007.Wdf
2008-09-20 23:21 . 2008-09-20 23:21 0 –ah—– C:\WINDOWS\SYSTEM32\DRIVERS\MsftWdf_user_01_07_00.Wdf
2008-09-20 22:55 . 2008-05-02 08:25 465,920 ——— C:\WINDOWS\SYSTEM32\imapi2fs.dll
2008-09-20 22:55 . 2008-05-02 08:25 465,920 ——— C:\WINDOWS\SYSTEM32\dllcache\imapi2fs.dll
2008-09-20 22:55 . 2008-05-02 08:25 317,952 ——— C:\WINDOWS\SYSTEM32\imapi2.dll
2008-09-20 22:55 . 2008-05-02 08:25 317,952 ——— C:\WINDOWS\SYSTEM32\dllcache\imapi2.dll
2008-09-20 22:55 . 2008-05-02 05:49 62,976 ——— C:\WINDOWS\SYSTEM32\dllcache\cdrom.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-15 23:42 ——— d—–w C:\WINDOWS\system32\config\systemprofile\Application Data\SolidDocuments
2008-10-15 22:32 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Orbit
2008-10-15 11:46 ——— d—–w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-10-15 03:49 ——— d—–w C:\Program Files\Motorola Phone Tools
2008-10-15 03:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-15 02:56 ——— d—–w C:\Program Files\Avanquest update
2008-10-15 02:55 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\InstallShield
2008-10-05 18:40 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\SolidDocuments
2008-10-03 17:41 6,066,176 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2008-09-24 03:39 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\DivX
2008-09-21 04:15 ——— d—–w C:\Program Files\Zune
2008-09-16 02:44 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Walgreens
2008-09-16 02:44 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Musicmatch
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Cyberlink
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Ahead
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-16 02:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Ahead
2008-09-16 01:15 ——— d—–w C:\Program Files\Orbitdownloader
2008-09-16 01:07 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-09-16 00:55 ——— d—–w C:\Program Files\Google
2008-09-15 22:51 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-09-15 12:12 1,846,400 —-a-w C:\WINDOWS\SYSTEM32\win32k.sys
2008-09-15 12:06 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 23:48 245,664 —-a-w C:\WINDOWS\SYSTEM32\ZuneWlanCfgSvc.exe
2008-09-12 23:46 61,856 —-a-w C:\WINDOWS\SYSTEM32\ZuneBusEnum.exe
2008-09-12 23:32 73,216 —-a-w C:\WINDOWS\SYSTEM32\ZuneUsbTransport.dll
2008-09-12 23:32 57,344 —-a-w C:\WINDOWS\SYSTEM32\ZuneRegUtil.dll
2008-09-12 23:32 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-09-12 23:32 310,272 —-a-w C:\WINDOWS\SYSTEM32\ZuneNetProxy.dll
2008-09-12 23:32 18,944 —-a-w C:\WINDOWS\SYSTEM32\ZuneTcp2Udp.dll
2008-09-12 23:32 145,920 —-a-w C:\WINDOWS\SYSTEM32\ZuneMTPZ.dll
2008-09-12 23:32 12,800 —-a-w C:\WINDOWS\SYSTEM32\ZunePTDNS.dll
2008-09-11 01:09 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2008-09-11 01:09 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2008-09-10 05:04 38,528 —-a-w C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-10 05:03 17,200 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 00:42 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Avira
2008-09-08 20:58 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Thinstall
2008-09-08 18:31 ——— d—–w C:\Documents and Settings\GILBERT\Application Data\Thinstall
2008-09-08 13:16 71,592 —-a-w C:\WINDOWS\system32\drivers\avfwot.sys
2008-09-08 13:16 71,464 —-a-w C:\WINDOWS\system32\drivers\avfwim.sys
2008-09-08 12:47 ——— d—–w C:\Documents and Settings\All Users\Application Data\Avira
2008-09-08 12:46 ——— d—–w C:\Program Files\Avira
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-08-27 21:19 581,192 —-a-w C:\WINDOWS\SYSTEM32\WinUSBCoInstaller.dll
2008-08-27 21:19 1,302,600 —-a-w C:\WINDOWS\SYSTEM32\WUDFUpdate_01007.dll
2008-08-27 08:24 3,593,216 —-a-w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 —-a-w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2008-08-20 05:02 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-08-14 10:11 2,189,184 —-a-w C:\WINDOWS\SYSTEM32\ntoskrnl.exe
2008-08-14 10:04 138,496 ——w C:\WINDOWS\SYSTEM32\dllcache\afd.sys
2008-08-14 09:33 2,066,048 —-a-w C:\WINDOWS\SYSTEM32\ntkrnlpa.exe
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\SYSTEM32\dllcache\cdm.dll
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\SYSTEM32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\SYSTEM32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\SYSTEM32\wups.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\SYSTEM32\wuapi.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\SYSTEM32\wucltui.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\SYSTEM32\wuweb.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wuaueng.dll
2008-07-19 03:07 270,880 —-a-w C:\WINDOWS\SYSTEM32\mucltui.dll
2008-07-19 03:07 210,976 —-a-w C:\WINDOWS\SYSTEM32\muweb.dll
2008-02-04 20:34 0 —-a-w C:\Documents and Settings\GILBERT\ddadder.exe
2007-01-06 18:04 92,064 —-a-w C:\Documents and Settings\GILBERT\mqdmmdm.sys
2007-01-06 18:04 9,232 —-a-w C:\Documents and Settings\GILBERT\mqdmmdfl.sys
2007-01-06 18:04 79,328 —-a-w C:\Documents and Settings\GILBERT\mqdmserd.sys
2007-01-06 18:04 66,656 —-a-w C:\Documents and Settings\GILBERT\mqdmbus.sys
2007-01-06 18:04 6,208 —-a-w C:\Documents and Settings\GILBERT\mqdmcmnt.sys
2007-01-06 18:04 5,936 —-a-w C:\Documents and Settings\GILBERT\mqdmwhnt.sys
2007-01-06 18:04 4,048 —-a-w C:\Documents and Settings\GILBERT\mqdmcr.sys
2007-01-06 18:04 25,600 —-a-w C:\Documents and Settings\GILBERT\usbsermptxp.sys
2007-01-06 18:04 22,768 —-a-w C:\Documents and Settings\GILBERT\usbsermpt.sys
2006-09-03 23:08 284 —-a-w C:\Documents and Settings\GILBERTO JOSE\Application Data\config.dat
2004-03-11 18:27 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
2002-03-26 15:58 271 –sha-w C:\Program Files\desktop.ini
2002-03-26 15:58 23,357 —ha-w C:\Program Files\folder.htt
2001-07-26 21:58 47 —-a-w C:\Program Files\ACMonitor_X73.ini
2001-07-05 17:46 8,116 —-a-w C:\Program Files\OSLO3071b2.USB
2001-05-08 21:36 114,688 —-a-w C:\Program Files\lxarscan.dll
2001-04-23 19:22 1,437 —-a-w C:\Program Files\gtx73.ini
2006-07-12 00:42 8 –sh–w C:\WINDOWS\DRM\pdrm.dat
.
—-a-w		   294,912 2001-05-10 19:54:26  C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .exe


(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba —-

2008-07-08 18:18 5632 –ahs—- C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\Thumbs.db
2004-12-26 17:08 38912 –ahs—- C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \Thumbs.db
2004-12-26 17:07 5932 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .sld
2004-12-26 17:04 964 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\slideshow.sld
2004-12-26 17:00 964 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba.sld
2004-05-30 11:58 818468 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1754_img.JPG
2004-05-30 11:57 845431 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1753_img.JPG
2004-05-30 11:56 1067684 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1752_img.JPG
2004-05-30 07:43 868300 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1744_img.JPG
2004-05-30 07:42 845179 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1742_img.JPG
2004-05-25 10:09 699797 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1736_img.JPG
2004-05-25 10:09 660262 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1735_img.JPG
2004-05-25 10:08 744905 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1733_img.JPG
2004-05-25 10:08 744905 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\117-1733_img.JPG
2004-05-25 10:07 761976 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1731_img.JPG
2004-05-25 10:07 761976 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\117-1731_img.JPG
2004-05-25 10:07 713002 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1732_img.JPG
2001-05-10 14:54 294912 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-18 68856]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-28 3660848]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark X73 Button Monitor"="C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe" [2001-10-08 53248]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 5058560]
"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe" [2001-10-12 36864]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2005-11-22 221184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Lexmark X73 Button Manager"="C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe" [2001-07-11 53248]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2007-04-10 709992]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-01 185896]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-09-12 160160]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-03-23 1398272]
"avgnt"="C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" [2008-09-08 266497]
"TraySantaCruz"="C:\WINDOWS\system32\tbctray.exe" [2003-06-23 290816]
"nwiz"="nwiz.exe" [2003-10-06 C:\WINDOWS\SYSTEM32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe [2008-07-26 1707208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VDOM"= vdowave.drv
"VIDC.NTN1"= NUVision.ax
"msacm.WRPR"= aviwrap.dll
"vidc.WRPR"= aviwrap.dll
"VIDC.DVSD"= pdvcodec.dll
"VIDC.JPEG"= JpegCode.dll
"VIDC.MJPG"= JpegCode.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"helpsvc"=2 (0x2)
"AVG Anti-Spyware Guard"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\System32\\fxsclnt.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"C:\\Program Files\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
"37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
"37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
"37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675

R0 IABFilt;Iomega Snapshot Volume Filter;C:\WINDOWS\system32\DRIVERS\IABFilt.sys [2005-07-01 25344]
R1 avfwot;avfwot;C:\WINDOWS\system32\DRIVERS\avfwot.sys [2008-09-08 71592]
R1 BUFADPT;BUFADPT;C:\WINDOWS\system32\BUFADPT.SYS [2004-01-09 9600]
R2 AntiVirFirewallService;Avira Premium Security Suite Firewall;C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe [2008-09-08 344321]
R2 AntiVirMailService;Avira Premium Security Suite MailGuard;C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe [2008-09-08 164097]
R2 antivirwebservice;Avira Premium Security Suite WebGuard;C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE [2008-09-08 258305]
R2 AVEService;Avira Premium Security Suite MailGuard helper service;C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe [2008-09-08 41217]
R2 CX88XBAR;Video Advantage PCI Crossbar;C:\WINDOWS\system32\drivers\CX88XBAR.sys [2004-05-17 9216]
R2 DLPORTIO;DLPORTIO;C:\WINDOWS\DLPORTIO.sys [1999-01-10 3584]
R2 MBAMDrvService;MBAMDrvService;C:\WINDOWS\system32\drivers\mbam.sys [2008-09-10 17200]
R2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-09-10 110256]
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
R2 Nhksrv;Netropa NHK Server;C:\WINDOWS\Nhksrv.exe [2001-08-06 28672]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-09-12 40832]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-09-12 61856]
R3 avfwim;AvFw Packet Filter Miniport;C:\WINDOWS\system32\DRIVERS\avfwim.sys [2008-09-08 71464]
R3 Msikbd2k;DellTouch;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2000-10-03 6942]
R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver;C:\WINDOWS\system32\DRIVERS\SMC1211.SYS [2001-07-11 23153]
R3 tbcspud;Santa Cruz Driver;C:\WINDOWS\system32\drivers\tbcspud.sys [2003-06-23 149632]
R3 tbcwdm;Santa Cruz WDM Driver;C:\WINDOWS\system32\drivers\tbcwdm.sys [2003-06-23 554304]
S2 MKEMUSB;Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkemusb.sys [2001-08-08 14308]
S3 DCamUSBMke;USB Video Camera for Panasonic Digital Palmcorder;C:\WINDOWS\system32\Drivers\Mkeusbi.sys [2001-12-18 41729]
S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-11-02 18176]
S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 7680]
S3 NUVision;NUVision Video Service;C:\WINDOWS\system32\DRIVERS\nuvision.sys [2002-01-26 135424]
S3 USBPVR;PVR STB.;C:\WINDOWS\system32\DRIVERS\usbpvr.sys [2005-01-14 18560]
S3 vtdg46xx;vtdg46xx;C:\PROGRA~1\TURTLE~1\SANTAC~1\CONTRO~1\vtdg46xx.sys [2003-06-13 19232]
S3 Web2CamService;SiPix iQuest DualCam;C:\WINDOWS\system32\Drivers\Web2.sys [ ]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-09-12 245664]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{286eaa18-05c3-11dc-ad66-0010b59b656f}]
\Shell\AutoRun\command - G:\JDSecure\Windows\JDSecure31.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32855622-5371-11dc-adbf-0010b59b656f}]
\Shell\AutoRun\command - D:\setupSNK.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2007-10-22 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []

2008-05-26 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX3000_exe.job
- C:\WINDOWS\vVX3000.exe [2007-04-10 14:46]

2008-10-16 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE []
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-16 15:11:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-10-16 15:18:58
ComboFix-quarantined-files.txt 2008-10-16 20:18:46
ComboFix2.txt 2008-10-15 22:41:24

Pre-Run: 13,394,912,768 bytes free
Post-Run: 13,407,597,568 bytes free

285 — E O F — 2008-10-15 11:47:22


HJT log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:23:28 PM, on 10/16/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\tbctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\Avira Premium Security Suite\avgnt.exe" /min
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download; by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab; video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Search; - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: Do&wnload; selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load; all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\DivX\Movies\IDM514_crack_by_phq\IEExt.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\GILBERT\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {2019DC25-D1C0-11D6-97B3-0008A124F542} (StreamPlug Class) - http://www.streamplug.com/StreamPlug/beta/SP.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124055239609
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security1.norton.com/SSC/SharedCont…c/bin/cabsa.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira Premium Security Suite Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avfwsvc.exe
O23 - Service: Avira Premium Security Suite MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avmailc.exe
O23 - Service: Avira Premium Security Suite Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\sched.exe
O23 - Service: Avira Premium Security Suite Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avguard.exe
O23 - Service: Avira Premium Security Suite WebGuard (antivirwebservice) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\AVWEBGRD.EXE
O23 - Service: Avira Premium Security Suite MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\Avira\Avira Premium Security Suite\avesvc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe

–
End of file - 13902 bytes
Post #10

It's seen to be working ok right now, I disable the helpserv. services because its sometimes freeze the computer, its good o wrong to do this.

Glad it's running better. I don't know what you mean by "helpserv. services". Please explain.

The Code you gave for combofix is for what.

It is to look and see what is in the "prueba" folder. The prueba.exe file is infected and I wanted to know what else is in the folder. Do you know what the files are?

008-07-08 18:18 5632 –ahs—- C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\Thumbs.db
2004-12-26 17:08 38912 –ahs—- C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \Thumbs.db
2004-12-26 17:07 5932 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .sld
2004-12-26 17:04 964 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\slideshow.sld
2004-12-26 17:00 964 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba.sld
2004-05-30 11:58 818468 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1754_img.JPG
2004-05-30 11:57 845431 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1753_img.JPG
2004-05-30 11:56 1067684 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1752_img.JPG
2004-05-30 07:43 868300 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1744_img.JPG
2004-05-30 07:42 845179 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1742_img.JPG
2004-05-25 10:09 699797 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1736_img.JPG
2004-05-25 10:09 660262 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1735_img.JPG
2004-05-25 10:08 744905 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1733_img.JPG
2004-05-25 10:08 744905 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\117-1733_img.JPG
2004-05-25 10:07 761976 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1731_img.JPG
2004-05-25 10:07 761976 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\117-1731_img.JPG
2004-05-25 10:07 713002 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \117-1732_img.JPG
2001-05-10 14:54 294912 –a—— C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .exe

How I get rid the norton, Spybot, Superantispyware.ooVoo, idm514 traces because I don't have this programs anymore

They can be manually removed. Using HijackThis and manual file/folder deletion. I can also add them to the combofix script to delete, once you let me know what the prueba stuff is.

What is C:\WINDOWS\imsins.BAK

Not sure, likely bad, we can upload to Jotti to have it scanned.

Go to http://virusscan.jotti.org, click on Browse, and upload the file for analysis.

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html
Post #11
Hi Indigenus: There are photos .The C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .exe file is show as PhotoRelay slide show ArcSoft Inc. file(288kb). The C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \prueba .sld(6kb), C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\slideshow.sld(1kb) and C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba.sld(1Kb) show as a AutoCad slide file. I delete Auto Cad recently and I don't now how Auto Cad put they in there. The C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\Thumbs.db(6kb) and C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba\prueba \Thumbs.db(38kb) shows as a data base file.The others files that starts with 117- xxxx are photos. I create this file to test('prueba' is test in spanish") this photos as a slide show with this photo relay program. I'm already delete this program recently. Thanks for your help
Post #13
Yes, can I backup only the photos or I have to delete them too. About the helpsvc.services I said it wrong is that I disable the helpsvc.exe(Microsoft Help and Support) in Services through msconfig.
Post #14 last edited
Indigenus: Yes, we can delete safely the whole file because I have a backup of the photos in other file.Why Avira and Malawarebytes doesn't detect anything wrong with this file its a virus, malware, spyware or something else. Why Avira quarantine combofix (contains code of th Eicar-Test-Signature-virus) Thanks for help
Post #15
1. Open Notepad

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Folder::
C:\Documents and Settings\GILBERT\My Documents\Linnette\prueba


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.


Why Avira and Malawarebytes doesn't detect anything wrong with this file its a virus, malware, spyware or something else.

Not every security tool pick up every piece of malware. That is why submitting to Jotti has over 30 scanners check it at once.


Why Avira quarantine combofix (contains code of th Eicar-Test-Signature-virus)

That is a false positive. It is common for the AV's to pick up many of the tools we use as malware just by the nature of what they do.


Let's also get another scan.

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Also post a new HJT log and let me know how it's running.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI