Spyware / Malware / Virus Removal

[Resolved] Computer goes to blue screen,...spyware? Or hardware p

20 min read

Looking for the outcome? Ask AI

Sonja27 Topic Starter

Post #1November 5, 2008, 3:53 AM UTC

My computer keeps getting the "blue screen of death" and forces me to reboot. I don't know what it is, it says something about a memory dump. It does this quite often and I'm not sure if it's a hardware problem or virus/malware. If someone could help me out with this, I would be grateful.

This time I did a hijackthis log as soon as my computer came up after that blue screen error.

Logfile of HijackThis v1.99.1
Scan saved at 7:49:56 PM, on 11/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Sonja\Desktop\Misc\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/ph…t_publisher.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://remotecontrol.trendmicro.com/sdccom…oad/tgctlcm.cab
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - https://remotecontrol.trendmicro.com/sdccom…wnload/ssrc.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1184997770015
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://trendmicro.webex.com/client/T25L/webex/ieatgpc.cab
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)

jpshortstuff

Post #2November 5, 2008, 10:29 AM UTC

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Your HJT log looks ok, but we'll have a more detailed look now. I may well be sending you over to our Tech Experts if you look clean though, as I'm only here to deal with any Malware issues you may have.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Let's get some system information.

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Thanks.

Sonja27

Post #3November 5, 2008, 7:28 PM UTC

I'm doing the last item on your list right now. Here are the 2 new logs you requested:

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-11-05 11:25:55
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 232 GB (76%) free of 305 GB
Total RAM: 2047 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:26:44 AM, on 11/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sonja\Desktop\RSIT.exe
C:\Program Files\trend micro\Sonja.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/ph…t_publisher.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://remotecontrol.trendmicro.com/sdccom…oad/tgctlcm.cab
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - https://remotecontrol.trendmicro.com/sdccom…wnload/ssrc.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1184997770015
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://trendmicro.webex.com/client/T25L/webex/ieatgpc.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

–
End of file - 8447 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskUser.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{38D40275-2A1D-4D05-8443-6AF1E7736B0E}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 853672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{724d43a9-0d85-11d4-9908-00400523e39a}]
C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2007-09-03 5571640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-25 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{724d43a0-0d85-11d4-9908-00400523e39a} - &RoboForm - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2007-09-03 5571640]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll [2008-02-28 86016]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-08-11 7630848]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe [2007-10-09 61440]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe [2008-11-03 368640]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2006-02-28 15360]
"RoboForm"=C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2007-09-03 160832]
"Google Update"=C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-02 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe [2001-07-05 200704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoAds]
C:\Program Files\NoAds\NoAds.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2006-08-11 7630848]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2006-08-11 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PE2CKFNT SE]
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe [1998-07-03 25088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
C:\Program Files\Picasa2\PicasaMediaDetector.exe [2007-09-27 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2007-09-03 160832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2006-06-13 16239616]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDAutoLiveupdate]
C:\Program Files\SpywareDetector\LiveUpdateSD.exe -AUTO []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-25 132496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW20]
C:\WINDOWS\system32\sw20.exe [2006-09-07 208896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SW24]
C:\WINDOWS\system32\sw24.exe [2006-09-07 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [1999-11-04 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Photo Express Calendar Checker SE.lnk]
C:\PROGRA~1\ULEADS~1\ULEADP~1\CalCheck.exe [1998-07-08 55296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sonja^Start Menu^Programs^Startup^Trillian.lnk]
C:\PROGRA~1\Trillian\trillian.exe [2008-10-01 1873280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Sonja^Start Menu^Programs^Startup^Webshots.lnk]
C:\PROGRA~1\Webshots\Launcher.exe [2004-09-16 45056]

C:\Documents and Settings\Sonja\Start Menu\Programs\Startup
Trillian.lnk - C:\Program Files\Trillian\trillian.exe
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=
scecli
scecli

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Trillian\trillian.exe"="C:\Program Files\Trillian\trillian.exe:*:Enabled:Trillian"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\system\viewer\FlipVideoforPC.exe
shell\Flip Video for PC\command - F:\system\viewer\FlipVideoforPC.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{744ae73e-6a6b-11dd-8ecc-0018f3173830}]
shell\AutoRun\command - F:\system\viewer\FlipVideoforPC.exe
shell\Flip Video for PC\command - F:\system\viewer\FlipVideoforPC.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7d7dab60-b36c-11dc-8d5c-0018f3173830}]
shell\AutoRun\command - F:\system\viewer\FlipVideoforPC.exe
shell\Flip Video for PC\command - F:\system\viewer\FlipVideoforPC.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ffc57ab-c5ea-11dc-8d80-0018f3173830}]
shell\AutoRun\command - F:\Installer.exe

======List of files/folders created in the last 1 months======

2008-11-05 11:25:55 —-D—- C:\rsit
2008-11-05 11:25:55 —-D—- C:\Program Files\trend micro
2008-10-28 06:58:32 —-HDC—- C:\WINDOWS\$NtUninstallKB958644$
2008-10-22 14:10:49 —-D—- C:\Program Files\iPod
2008-10-22 14:10:48 —-D—- C:\Program Files\iTunes
2008-10-22 14:10:48 —-D—- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-22 14:10:14 —-D—- C:\Program Files\Bonjour
2008-10-22 14:08:52 —-D—- C:\Program Files\Apple Software Update
2008-10-22 14:08:44 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-10-22 14:08:19 —-D—- C:\Program Files\Common Files\Apple
2008-10-22 14:08:18 —-D—- C:\Documents and Settings\All Users\Application Data\Apple
2008-10-22 10:25:13 —-D—- C:\Program Files\Photodex
2008-10-22 10:24:12 —-D—- C:\Documents and Settings\Sonja\Application Data\Photodex
2008-10-21 06:42:34 —-D—- C:\WINDOWS\Prefetch
2008-10-20 19:57:28 —-A—- C:\WINDOWS\system32\SET112A.tmp
2008-10-20 19:57:25 —-A—- C:\WINDOWS\system32\SET10FB.tmp
2008-10-20 19:57:21 —-A—- C:\WINDOWS\system32\SET10C9.tmp
2008-10-20 19:57:20 —-A—- C:\WINDOWS\system32\SET10C4.tmp
2008-10-20 19:57:20 —-A—- C:\WINDOWS\system32\SET10C1.tmp
2008-10-20 19:53:33 —-A—- C:\WINDOWS\SET4FE.tmp
2008-10-20 19:53:30 —-A—- C:\WINDOWS\system32\SET4DB.tmp
2008-10-20 19:53:29 —-A—- C:\WINDOWS\system32\SET4D4.tmp
2008-10-20 19:53:29 —-A—- C:\WINDOWS\system32\SET4CF.tmp
2008-10-20 19:53:29 —-A—- C:\WINDOWS\system32\SET4CB.tmp
2008-10-20 19:53:28 —-A—- C:\WINDOWS\system32\SET4C9.tmp
2008-10-20 19:53:28 —-A—- C:\WINDOWS\system32\SET4C6.tmp
2008-10-20 19:53:27 —-A—- C:\WINDOWS\system32\SET4BD.tmp
2008-10-20 19:53:27 —-A—- C:\WINDOWS\system32\SET4BB.tmp
2008-10-20 19:53:27 —-A—- C:\WINDOWS\system32\SET4B8.tmp
2008-10-20 19:53:26 —-A—- C:\WINDOWS\system32\SET4B7.tmp
2008-10-20 19:53:26 —-A—- C:\WINDOWS\system32\SET4B4.tmp
2008-10-20 19:53:26 —-A—- C:\WINDOWS\system32\SET4B3.tmp
2008-10-20 19:53:26 —-A—- C:\WINDOWS\system32\SET4B2.tmp
2008-10-20 19:53:25 —-A—- C:\WINDOWS\system32\SET4AF.tmp
2008-10-20 19:53:25 —-A—- C:\WINDOWS\system32\SET4AE.tmp
2008-10-20 19:53:25 —-A—- C:\WINDOWS\system32\SET4AD.tmp
2008-10-20 19:53:24 —-A—- C:\WINDOWS\system32\SET4A7.tmp
2008-10-20 19:53:23 —-A—- C:\WINDOWS\system32\SET4A5.tmp
2008-10-20 19:53:23 —-A—- C:\WINDOWS\system32\SET4A2.tmp
2008-10-20 19:53:22 —-A—- C:\WINDOWS\system32\SET49F.tmp
2008-10-20 19:53:21 —-A—- C:\WINDOWS\system32\SET498.tmp
2008-10-20 19:53:21 —-A—- C:\WINDOWS\system32\SET491.tmp
2008-10-20 19:53:20 —-A—- C:\WINDOWS\system32\SET488.tmp
2008-10-20 19:53:20 —-A—- C:\WINDOWS\system32\SET486.tmp
2008-10-20 19:53:19 —-A—- C:\WINDOWS\system32\SET480.tmp
2008-10-20 19:53:18 —-A—- C:\WINDOWS\system32\SET47D.tmp
2008-10-20 19:53:18 —-A—- C:\WINDOWS\system32\SET47A.tmp
2008-10-20 19:53:17 —-A—- C:\WINDOWS\system32\SET478.tmp
2008-10-20 19:53:17 —-A—- C:\WINDOWS\system32\SET477.tmp
2008-10-20 19:53:17 —-A—- C:\WINDOWS\system32\SET471.tmp
2008-10-20 19:53:16 —-A—- C:\WINDOWS\system32\SET46E.tmp
2008-10-20 19:53:16 —-A—- C:\WINDOWS\system32\SET46D.tmp
2008-10-20 19:53:16 —-A—- C:\WINDOWS\system32\SET46C.tmp
2008-10-20 19:53:15 —-A—- C:\WINDOWS\system32\SET46A.tmp
2008-10-20 19:53:15 —-A—- C:\WINDOWS\system32\SET469.tmp
2008-10-20 19:53:15 —-A—- C:\WINDOWS\system32\SET468.tmp
2008-10-20 19:53:14 —-A—- C:\WINDOWS\system32\SET45F.tmp
2008-10-20 19:53:12 —-A—- C:\WINDOWS\system32\SET44E.tmp
2008-10-20 19:53:09 —-A—- C:\WINDOWS\system32\SET429.tmp
2008-10-20 19:53:08 —-A—- C:\WINDOWS\system32\SET428.tmp
2008-10-20 19:53:07 —-A—- C:\WINDOWS\system32\SET413.tmp
2008-10-20 19:53:06 —-A—- C:\WINDOWS\system32\SET40C.tmp
2008-10-20 19:53:05 —-A—- C:\WINDOWS\system32\SET406.tmp
2008-10-20 19:53:04 —-A—- C:\WINDOWS\system32\SET3FF.tmp
2008-10-20 19:53:03 —-A—- C:\WINDOWS\system32\SET3F7.tmp
2008-10-20 19:53:03 —-A—- C:\WINDOWS\system32\SET3F6.tmp
2008-10-20 19:53:02 —-A—- C:\WINDOWS\system32\SET3F4.tmp
2008-10-20 19:53:02 —-A—- C:\WINDOWS\system32\SET3F2.tmp
2008-10-20 19:53:00 —-A—- C:\WINDOWS\system32\SET3DB.tmp
2008-10-20 19:53:00 —-A—- C:\WINDOWS\system32\SET3D7.tmp
2008-10-20 19:52:59 —-A—- C:\WINDOWS\system32\SET3CE.tmp
2008-10-20 19:52:59 —-A—- C:\WINDOWS\system32\SET3C7.tmp
2008-10-20 19:52:58 —-A—- C:\WINDOWS\system32\SET3C5.tmp
2008-10-20 19:52:58 —-A—- C:\WINDOWS\system32\SET3BB.tmp
2008-10-20 19:52:56 —-A—- C:\WINDOWS\system32\SET3A5.tmp
2008-10-20 19:52:55 —-A—- C:\WINDOWS\system32\SET39F.tmp
2008-10-20 19:52:55 —-A—- C:\WINDOWS\system32\SET394.tmp
2008-10-20 19:52:54 —-A—- C:\WINDOWS\system32\SET391.tmp
2008-10-20 19:52:54 —-A—- C:\WINDOWS\system32\SET38B.tmp
2008-10-20 19:52:53 —-A—- C:\WINDOWS\system32\SET384.tmp
2008-10-20 19:52:51 —-A—- C:\WINDOWS\system32\SET35F.tmp
2008-10-20 19:52:51 —-A—- C:\WINDOWS\system32\SET35D.tmp
2008-10-20 19:52:50 —-A—- C:\WINDOWS\system32\SET357.tmp
2008-10-20 19:52:50 —-A—- C:\WINDOWS\system32\SET355.tmp
2008-10-20 19:52:49 —-A—- C:\WINDOWS\system32\SET34B.tmp
2008-10-20 19:52:48 —-A—- C:\WINDOWS\system32\SET340.tmp
2008-10-20 19:52:47 —-A—- C:\WINDOWS\system32\SET33C.tmp
2008-10-20 19:52:47 —-A—- C:\WINDOWS\system32\SET338.tmp
2008-10-20 19:52:47 —-A—- C:\WINDOWS\system32\SET333.tmp
2008-10-20 19:52:45 —-A—- C:\WINDOWS\system32\SET327.tmp
2008-10-20 19:52:44 —-A—- C:\WINDOWS\system32\SET31C.tmp
2008-10-20 19:52:44 —-A—- C:\WINDOWS\system32\SET31B.tmp
2008-10-20 19:52:43 —-A—- C:\WINDOWS\system32\SET319.tmp
2008-10-20 19:52:43 —-A—- C:\WINDOWS\system32\SET313.tmp
2008-10-20 19:52:43 —-A—- C:\WINDOWS\system32\SET311.tmp
2008-10-20 19:52:42 —-A—- C:\WINDOWS\system32\SET30C.tmp
2008-10-20 19:52:42 —-A—- C:\WINDOWS\system32\SET30B.tmp
2008-10-20 19:52:42 —-A—- C:\WINDOWS\system32\SET30A.tmp
2008-10-20 19:52:42 —-A—- C:\WINDOWS\system32\SET306.tmp
2008-10-20 19:52:41 —-A—- C:\WINDOWS\system32\SET304.tmp
2008-10-20 19:52:40 —-A—- C:\WINDOWS\system32\SET2F2.tmp
2008-10-20 19:52:39 —-A—- C:\WINDOWS\system32\SET2EE.tmp
2008-10-20 19:52:39 —-A—- C:\WINDOWS\system32\SET2EC.tmp
2008-10-20 19:52:39 —-A—- C:\WINDOWS\system32\SET2EA.tmp
2008-10-20 19:52:38 —-A—- C:\WINDOWS\system32\SET2E9.tmp
2008-10-20 19:52:38 —-A—- C:\WINDOWS\system32\SET2E8.tmp
2008-10-20 19:52:38 —-A—- C:\WINDOWS\system32\SET2E7.tmp
2008-10-20 19:52:38 —-A—- C:\WINDOWS\system32\SET2E5.tmp
2008-10-20 19:52:37 —-A—- C:\WINDOWS\system32\SET2D9.tmp
2008-10-20 19:52:37 —-A—- C:\WINDOWS\system32\SET2D7.tmp
2008-10-20 19:52:37 —-A—- C:\WINDOWS\system32\SET2D3.tmp
2008-10-20 19:52:36 —-A—- C:\WINDOWS\system32\SET2D2.tmp
2008-10-20 19:52:36 —-A—- C:\WINDOWS\system32\SET2CC.tmp
2008-10-20 19:52:35 —-A—- C:\WINDOWS\system32\SET2CA.tmp
2008-10-20 19:52:35 —-A—- C:\WINDOWS\system32\SET2C6.tmp
2008-10-20 19:52:34 —-A—- C:\WINDOWS\system32\SET2C5.tmp
2008-10-20 19:52:34 —-A—- C:\WINDOWS\system32\SET2C1.tmp
2008-10-20 19:52:33 —-A—- C:\WINDOWS\system32\SET2BD.tmp
2008-10-20 19:52:33 —-A—- C:\WINDOWS\system32\SET2B7.tmp
2008-10-20 19:52:32 —-A—- C:\WINDOWS\system32\SET2B3.tmp
2008-10-20 19:52:32 —-A—- C:\WINDOWS\system32\SET2AB.tmp
2008-10-20 19:52:31 —-A—- C:\WINDOWS\system32\SET2AA.tmp
2008-10-20 19:52:31 —-A—- C:\WINDOWS\system32\SET2A2.tmp
2008-10-20 19:52:31 —-A—- C:\WINDOWS\system32\SET29C.tmp
2008-10-20 19:52:30 —-A—- C:\WINDOWS\system32\SET29A.tmp
2008-10-20 19:52:30 —-A—- C:\WINDOWS\system32\SET297.tmp
2008-10-20 19:52:30 —-A—- C:\WINDOWS\system32\SET296.tmp
2008-10-20 19:52:29 —-A—- C:\WINDOWS\system32\SET292.tmp
2008-10-20 19:52:28 —-A—- C:\WINDOWS\system32\SET28C.tmp
2008-10-20 19:52:28 —-A—- C:\WINDOWS\system32\SET28A.tmp
2008-10-20 19:52:28 —-A—- C:\WINDOWS\system32\SET289.tmp
2008-10-20 19:52:28 —-A—- C:\WINDOWS\system32\SET288.tmp
2008-10-20 19:52:27 —-A—- C:\WINDOWS\system32\SET27A.tmp
2008-10-20 19:52:27 —-A—- C:\WINDOWS\system32\SET276.tmp
2008-10-20 19:52:26 —-A—- C:\WINDOWS\system32\SET275.tmp
2008-10-20 19:52:26 —-A—- C:\WINDOWS\system32\SET270.tmp
2008-10-20 19:52:25 —-A—- C:\WINDOWS\system32\SET26D.tmp
2008-10-20 19:52:25 —-A—- C:\WINDOWS\system32\SET26A.tmp
2008-10-20 19:52:24 —-A—- C:\WINDOWS\system32\SET267.tmp
2008-10-20 19:52:24 —-A—- C:\WINDOWS\system32\SET266.tmp
2008-10-20 19:52:24 —-A—- C:\WINDOWS\system32\SET264.tmp
2008-10-20 19:52:24 —-A—- C:\WINDOWS\system32\SET263.tmp
2008-10-20 19:52:24 —-A—- C:\WINDOWS\system32\SET262.tmp
2008-10-20 19:52:23 —-A—- C:\WINDOWS\system32\SET25E.tmp
2008-10-20 19:52:23 —-A—- C:\WINDOWS\system32\SET25C.tmp
2008-10-20 19:52:23 —-A—- C:\WINDOWS\system32\SET259.tmp
2008-10-20 19:52:23 —-A—- C:\WINDOWS\system32\SET258.tmp
2008-10-20 19:52:23 —-A—- C:\WINDOWS\system32\SET257.tmp
2008-10-20 19:52:22 —-A—- C:\WINDOWS\system32\SET254.tmp
2008-10-20 19:52:22 —-A—- C:\WINDOWS\system32\SET253.tmp
2008-10-20 19:52:21 —-A—- C:\WINDOWS\system32\SET24C.tmp
2008-10-20 19:52:21 —-A—- C:\WINDOWS\system32\SET24B.tmp
2008-10-20 19:52:21 —-A—- C:\WINDOWS\system32\SET24A.tmp
2008-10-20 19:52:20 —-A—- C:\WINDOWS\system32\SET248.tmp
2008-10-20 19:52:19 —-A—- C:\WINDOWS\system32\SET239.tmp
2008-10-20 19:52:18 —-A—- C:\WINDOWS\system32\SET236.tmp
2008-10-20 19:52:18 —-A—- C:\WINDOWS\system32\SET234.tmp
2008-10-20 19:52:17 —-A—- C:\WINDOWS\system32\SET231.tmp
2008-10-20 19:52:17 —-A—- C:\WINDOWS\system32\SET230.tmp
2008-10-20 19:52:17 —-A—- C:\WINDOWS\system32\SET22E.tmp
2008-10-20 19:52:16 —-A—- C:\WINDOWS\system32\SET22A.tmp
2008-10-20 19:52:15 —-A—- C:\WINDOWS\system32\SET226.tmp
2008-10-20 19:52:15 —-A—- C:\WINDOWS\system32\SET223.tmp
2008-10-20 19:52:15 —-A—- C:\WINDOWS\system32\SET222.tmp
2008-10-20 19:52:15 —-A—- C:\WINDOWS\system32\SET221.tmp
2008-10-20 19:52:14 —-A—- C:\WINDOWS\system32\SET21F.tmp
2008-10-20 19:52:14 —-A—- C:\WINDOWS\system32\SET21D.tmp
2008-10-20 19:52:13 —-A—- C:\WINDOWS\system32\SET211.tmp
2008-10-20 19:52:12 —-A—- C:\WINDOWS\system32\SET20B.tmp
2008-10-20 19:52:12 —-A—- C:\WINDOWS\system32\SET209.tmp
2008-10-20 19:52:11 —-A—- C:\WINDOWS\system32\SET208.tmp
2008-10-20 19:52:11 —-A—- C:\WINDOWS\system32\SET207.tmp
2008-10-20 19:52:11 —-A—- C:\WINDOWS\system32\SET206.tmp
2008-10-20 19:52:10 —-A—- C:\WINDOWS\system32\SET200.tmp
2008-10-20 19:52:09 —-A—- C:\WINDOWS\system32\SET1F8.tmp
2008-10-20 19:52:09 —-A—- C:\WINDOWS\system32\SET1F7.tmp
2008-10-20 19:52:09 —-A—- C:\WINDOWS\system32\SET1F6.tmp
2008-10-20 19:52:08 —-A—- C:\WINDOWS\system32\SET1F0.tmp
2008-10-20 19:52:07 —-A—- C:\WINDOWS\system32\SET1EF.tmp
2008-10-20 19:52:07 —-A—- C:\WINDOWS\system32\SET1EB.tmp
2008-10-20 19:52:06 —-A—- C:\WINDOWS\system32\SET1E6.tmp
2008-10-20 19:52:06 —-A—- C:\WINDOWS\system32\SET1E5.tmp
2008-10-20 19:52:06 —-A—- C:\WINDOWS\system32\SET1E3.tmp
2008-10-20 19:52:05 —-A—- C:\WINDOWS\system32\SET1E2.tmp
2008-10-20 19:52:04 —-A—- C:\WINDOWS\system32\SET1E1.tmp
2008-10-20 19:52:04 —-A—- C:\WINDOWS\system32\SET1E0.tmp
2008-10-20 19:52:04 —-A—- C:\WINDOWS\system32\SET1DE.tmp
2008-10-20 19:52:03 —-A—- C:\WINDOWS\system32\SET1DC.tmp
2008-10-20 19:52:03 —-A—- C:\WINDOWS\system32\SET1D7.tmp
2008-10-20 19:52:01 —-A—- C:\WINDOWS\system32\SET1C7.tmp
2008-10-20 19:52:01 —-A—- C:\WINDOWS\system32\SET1C6.tmp
2008-10-20 19:52:01 —-A—- C:\WINDOWS\system32\SET1C5.tmp
2008-10-20 19:52:00 —-A—- C:\WINDOWS\system32\SET1C4.tmp
2008-10-20 19:52:00 —-A—- C:\WINDOWS\system32\SET1C3.tmp
2008-10-20 19:52:00 —-A—- C:\WINDOWS\system32\SET1C2.tmp
2008-10-20 19:52:00 —-A—- C:\WINDOWS\system32\SET1C0.tmp
2008-10-20 19:51:59 —-A—- C:\WINDOWS\system32\SET1BD.tmp
2008-10-20 19:51:59 —-A—- C:\WINDOWS\system32\SET1BC.tmp
2008-10-20 19:51:57 —-A—- C:\WINDOWS\system32\SET1AF.tmp
2008-10-20 19:51:57 —-A—- C:\WINDOWS\system32\SET1AC.tmp
2008-10-20 19:51:56 —-A—- C:\WINDOWS\system32\SET1AB.tmp
2008-10-20 19:51:55 —-A—- C:\WINDOWS\system32\SET1A4.tmp
2008-10-20 19:51:55 —-A—- C:\WINDOWS\system32\SET1A3.tmp
2008-10-20 19:51:55 —-A—- C:\WINDOWS\system32\SET1A0.tmp
2008-10-20 19:51:54 —-A—- C:\WINDOWS\system32\SET19D.tmp
2008-10-20 19:51:54 —-A—- C:\WINDOWS\system32\SET19C.tmp
2008-10-20 19:51:53 —-A—- C:\WINDOWS\system32\SET197.tmp
2008-10-20 19:51:53 —-A—- C:\WINDOWS\system32\SET191.tmp
2008-10-20 19:51:53 —-A—- C:\WINDOWS\system32\SET190.tmp
2008-10-20 19:51:52 —-A—- C:\WINDOWS\system32\SET18F.tmp
2008-10-20 19:51:52 —-A—- C:\WINDOWS\system32\SET18E.tmp
2008-10-20 19:51:52 —-A—- C:\WINDOWS\system32\SET18D.tmp
2008-10-20 19:51:51 —-A—- C:\WINDOWS\system32\SET188.tmp
2008-10-20 19:51:51 —-A—- C:\WINDOWS\system32\SET186.tmp
2008-10-20 19:51:51 —-A—- C:\WINDOWS\system32\SET185.tmp
2008-10-20 19:51:50 —-A—- C:\WINDOWS\system32\SET182.tmp
2008-10-20 19:51:49 —-A—- C:\WINDOWS\system32\SET17B.tmp
2008-10-20 19:51:49 —-A—- C:\WINDOWS\system32\SET17A.tmp
2008-10-20 19:51:49 —-A—- C:\WINDOWS\system32\SET178.tmp
2008-10-20 19:51:48 —-A—- C:\WINDOWS\system32\SET175.tmp
2008-10-20 19:51:48 —-A—- C:\WINDOWS\system32\SET174.tmp
2008-10-20 19:51:48 —-A—- C:\WINDOWS\system32\SET173.tmp
2008-10-20 19:51:47 —-A—- C:\WINDOWS\system32\SET16C.tmp
2008-10-20 19:51:46 —-A—- C:\WINDOWS\system32\SET169.tmp
2008-10-20 19:51:46 —-A—- C:\WINDOWS\system32\SET168.tmp
2008-10-20 19:51:46 —-A—- C:\WINDOWS\system32\SET167.tmp
2008-10-20 19:51:46 —-A—- C:\WINDOWS\system32\SET165.tmp
2008-10-20 19:51:45 —-A—- C:\WINDOWS\system32\SET164.tmp
2008-10-20 19:51:45 —-A—- C:\WINDOWS\system32\SET163.tmp
2008-10-20 19:51:45 —-A—- C:\WINDOWS\system32\SET162.tmp
2008-10-20 19:51:45 —-A—- C:\WINDOWS\system32\SET161.tmp
2008-10-20 19:51:44 —-A—- C:\WINDOWS\system32\SET15F.tmp
2008-10-20 19:51:44 —-A—- C:\WINDOWS\system32\SET15E.tmp
2008-10-20 19:51:44 —-A—- C:\WINDOWS\system32\SET15D.tmp
2008-10-20 19:51:42 —-A—- C:\WINDOWS\system32\SET152.tmp
2008-10-20 19:51:42 —-A—- C:\WINDOWS\system32\SET14F.tmp
2008-10-20 19:51:42 —-A—- C:\WINDOWS\system32\SET14E.tmp
2008-10-20 19:51:41 —-A—- C:\WINDOWS\system32\SET147.tmp
2008-10-20 19:51:41 —-A—- C:\WINDOWS\system32\SET145.tmp
2008-10-20 19:51:40 —-A—- C:\WINDOWS\system32\SET143.tmp
2008-10-20 19:51:40 —-A—- C:\WINDOWS\system32\SET141.tmp
2008-10-20 19:51:40 —-A—- C:\WINDOWS\system32\SET140.tmp
2008-10-20 19:50:17 —-A—- C:\WINDOWS\002925_.tmp
2008-10-20 19:48:38 —-A—- C:\WINDOWS\system32\xpsp2res.dll
2008-10-20 19:48:36 —-A—- C:\WINDOWS\system32\qmgr.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\locator.exe
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\localspl.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\lmhsvc.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\kernel32.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\imagehlp.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\ftp.exe
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\format.com
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\dhcpcsvc.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\csrsrv.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\comdlg32.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\comctl32.dll
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\cmd.exe
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\cacls.exe
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\autoconv.exe
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\autochk.exe
2008-10-20 19:48:07 —-A—- C:\WINDOWS\system32\advapi32.dll
2008-10-20 19:48:06 —-N—- C:\WINDOWS\system32\oleaut32.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\wkssvc.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\win32spl.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\userinit.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\untfs.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\ulib.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\tcpmonui.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\syssetup.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\srvsvc.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\smss.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\setupapi.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\sessmgr.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\services.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\schannel.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\scardsvr.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\savedump.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\samsrv.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\samlib.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\rshx32.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\rastapi.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\rasman.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\rasdlg.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\rasauto.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\rasapi32.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\printui.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\perfctrs.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\olecnv32.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\nwprovau.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\ntvdm.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\ntprint.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\ntlsapi.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\ntdll.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\nslookup.exe
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\msv1_0.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\msgsvc.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\mgmtapi.dll
2008-10-20 19:48:06 —-A—- C:\WINDOWS\system32\lsasrv.dll
2008-10-20 19:48:03 —-A—- C:\WINDOWS\system32\ntoskrnl.exe
2008-10-20 19:48:03 —-A—- C:\WINDOWS\system32\ntkrnlpa.exe
2008-10-20 19:48:03 —-A—- C:\WINDOWS\system32\hal.dll
2008-10-16 05:32:35 —-HDC—- C:\WINDOWS\$NtUninstallKB956803$
2008-10-16 05:32:26 —-HDC—- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 05:32:15 —-HDC—- C:\WINDOWS\$NtUninstallKB957095$
2008-10-16 05:31:27 —-HDC—- C:\WINDOWS\$NtUninstallKB954211$
2008-10-16 05:30:49 —-HDC—- C:\WINDOWS\$NtUninstallKB956841$
2008-10-11 13:51:33 —-D—- C:\Program Files\Microsoft Silverlight

======List of files/folders modified in the last 1 months======

2008-11-05 11:25:55 —-RD—- C:\Program Files
2008-11-05 11:23:54 —-D—- C:\WINDOWS\Temp
2008-11-05 11:21:07 —-D—- C:\Downloads
2008-11-05 11:04:41 —-D—- C:\WINDOWS\system32
2008-11-05 10:03:41 —-D—- C:\Program Files\Mozilla Firefox
2008-11-05 09:55:11 —-D—- C:\WINDOWS
2008-11-05 09:03:56 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-11-04 22:57:35 —-A—- C:\WINDOWS\bdagent.INI
2008-11-04 19:24:31 —-AC—- C:\WINDOWS\ACROREAD.INI
2008-11-04 19:22:40 —-A—- C:\WINDOWS\vuepro32.ini
2008-11-04 16:41:35 —-D—- C:\WINDOWS\system32\drivers
2008-11-04 12:41:32 —-D—- C:\Documents and Settings\Sonja\Application Data\Corel
2008-11-02 07:05:08 —-AC—- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-01 12:27:01 —-D—- C:\WINDOWS\system32\CatRoot2
2008-10-31 11:54:40 —-SHD—- C:\WINDOWS\Installer
2008-10-28 06:58:40 —-HD—- C:\WINDOWS\inf
2008-10-28 06:58:35 —-RSHDC—- C:\WINDOWS\system32\dllcache
2008-10-28 06:58:00 —-HD—- C:\WINDOWS\$hf_mig$
2008-10-27 10:50:29 —-D—- C:\Documents and Settings\Sonja\Application Data\Webshots
2008-10-25 08:40:16 —-D—- C:\WINDOWS\Minidump
2008-10-22 14:09:53 —-D—- C:\Program Files\QuickTime
2008-10-22 14:08:19 —-D—- C:\Program Files\Common Files
2008-10-22 11:12:19 —-SD—- C:\WINDOWS\Tasks
2008-10-21 06:42:13 —-D—- C:\WINDOWS\system32\wbem
2008-10-21 06:42:13 —-D—- C:\WINDOWS\system32\Setup
2008-10-21 06:42:13 —-D—- C:\WINDOWS\AppPatch
2008-10-21 06:42:09 —-RSD—- C:\WINDOWS\Fonts
2008-10-20 21:15:12 —-D—- C:\WINDOWS\security
2008-10-20 21:13:17 —-A—- C:\WINDOWS\imsins.BAK
2008-10-20 21:11:57 —-D—- C:\WINDOWS\system32\CatRoot
2008-10-20 21:08:49 —-D—- C:\WINDOWS\WinSxS
2008-10-20 21:08:40 —-D—- C:\Program Files\Windows Media Player
2008-10-20 21:08:34 —-D—- C:\WINDOWS\system32\usmt
2008-10-20 21:08:30 —-D—- C:\WINDOWS\system32\Restore
2008-10-20 21:08:29 —-D—- C:\WINDOWS\system32\oobe
2008-10-20 21:08:28 —-D—- C:\WINDOWS\system32\npp
2008-10-20 21:07:28 —-D—- C:\WINDOWS\system32\Com
2008-10-20 21:05:46 —-D—- C:\WINDOWS\system
2008-10-20 21:05:46 —-D—- C:\WINDOWS\srchasst
2008-10-20 21:05:45 —-D—- C:\WINDOWS\PeerNet
2008-10-20 21:05:44 —-D—- C:\WINDOWS\network diagnostic
2008-10-20 21:05:43 —-D—- C:\WINDOWS\msagent
2008-10-20 21:05:35 —-D—- C:\WINDOWS\ime
2008-10-20 21:05:35 —-D—- C:\WINDOWS\Help
2008-10-20 21:05:30 —-D—- C:\Program Files\Windows NT
2008-10-20 21:05:28 —-D—- C:\Program Files\Outlook Express
2008-10-20 21:05:27 —-D—- C:\Program Files\NetMeeting
2008-10-20 21:05:24 —-D—- C:\Program Files\Movie Maker
2008-10-20 21:05:16 —-D—- C:\Program Files\Common Files\System
2008-10-20 21:04:52 —-D—- C:\WINDOWS\system32\scripting
2008-10-20 21:04:52 —-D—- C:\WINDOWS\system32\en-US
2008-10-20 21:04:52 —-D—- C:\WINDOWS\system32\en
2008-10-20 21:02:12 —-D—- C:\WINDOWS\l2schemas
2008-10-20 21:02:11 —-D—- C:\Program Files\Messenger
2008-10-20 19:59:25 —-D—- C:\WINDOWS\system32\CatRoot_bak
2008-10-20 19:57:16 —-D—- C:\WINDOWS\system32\bits
2008-10-20 19:50:11 —-D—- C:\WINDOWS\system32\ReinstallBackups
2008-10-20 19:45:45 —-D—- C:\WINDOWS\EHome
2008-10-16 05:59:16 —-D—- C:\Program Files\Internet Explorer
2008-10-16 05:31:46 —-D—- C:\WINDOWS\ie7updates
2008-10-15 08:57:55 —-A—- C:\WINDOWS\system32\netapi32.dll
2008-10-08 10:22:23 —-AC—- C:\WINDOWS\ULEAD32.INI
2008-10-07 11:19:40 —-A—- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ATMhelpr;ATMhelpr; C:\WINDOWS\system32\drivers\ATMhelpr.sys [1997-06-17 4064]
R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys []
R1 EPPSCSIx;EPPSCSIx; C:\WINDOWS\System32\drivers\EPPSCSI.SYS [1999-03-17 47148]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2006-02-28 36096]
R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-01-07 196368]
R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys []
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-13 4299264]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-12 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-08-11 3958496]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2005-09-19 241280]
S1 DTC328X;DTC328X; C:\WINDOWS\System32\drivers\DTC328X.SYS [1998-06-30 48648]
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 MSICPL;MSICPL; \??\D:\install4\MSICPL.sys []
S3 NTACCESS;NTACCESS; \??\D:\NTACCESS.sys []
S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\D:\NTGLM7X.sys []
S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys []
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe [2008-07-02 1155072]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-08-11 155715]
R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2006-11-02 174656]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe [2008-09-15 1261568]
R2 XCOMM;BitDefender Communicator; C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe [2007-11-27 86016]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
R3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2006-02-28 14336]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\M [2007-12-08 183]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\M [2007-12-08 183]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\M [2007-12-08 183]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-03 136120]
S3 idsvc;Windows CardSpace; C:\WINDOWS\M [2007-12-08 183]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\M [2007-12-08 183]

—————–EOF—————–

info.txt logfile of random's system information tool 1.04 2008-11-05 11:26:46

======Uninstall list======

–>C:\WINDOWS\UNINST.EXE -f"C:\Program Files\PhotoDeluxe HE 3.1\DeIsL1.isu" -c"C:\Program Files\PhotoDeluxe HE 3.1\Uninst.dll"
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3ivx MPEG-4 5.0.3 (remove only)–>"C:\Program Files\3ivx\3ivx MPEG-4 5.0.3\uninstaller.exe"
Ad-aware 6 Personal–>C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)–>MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Acrobat Reader 3.01–>C:\WINDOWS\uninst.exe -fC:\Acrobat3\Reader\DeIsL1.isu
Adobe Flash Player 9 ActiveX–>C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Flash Player Plugin–>C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop 6.0–>C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 6.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 6.0\Uninst.dll"
Adobe Reader 8.1.2–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Adobe SVG Viewer–>C:\WINDOWS\IsUninst.exe -f"C:\WINDOWS\System32\Adobe\SVG Viewer\Uninst.isu"
Adobe Type Manager 4.0–>C:\WINDOWS\uninst.exe -f"C:\Program Files\Adobe Type Manager\DeIsL1.isu" -c"C:\Program Files\Adobe Type Manager\UNINST.DLL"
Apple Mobile Device Support–>MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
BitDefender Antivirus 2008–>MsiExec.exe /I{4A56DAB1-2680-4B8A-AD84-77EECFB94D7B}
Bonjour–>MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
Canon Camera Support Core Library–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{A1D0D14A-B776-4907-BC00-5149F2298086} /l1033
Canon EOS 5D WIA Driver–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{BB3AB664-D92B-4CB5-8B3E-D841841F4E68} /l1033
Canon EOS Kiss_N REBEL_XT 350D WIA Driver–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{33CF7CDF-9805-4500-9CC7-D19D52AD63C4} /l1033
Canon PhotoRecord–>MsiExec.exe /X{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}
Canon RAW Codec–>"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\RAWCodec120\CRCUnInstall.ini"
Canon Utilities Digital Photo Professional 3.4–>"C:\Program Files\Common Files\Canon\UIW\1.3.0.0\Uninst.exe" "C:\Program Files\Canon\Digital Photo Professional\DPP\Uninst.ini"
Canon Utilities EOS Capture 1.5–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{589D17BB-C997-48C0-BCD2-CC8DC3375FE8}
Canon Utilities EOS Utility–>"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini"
Canon Utilities PhotoStitch 3.1–>C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}
CCleaner (remove only)–>"C:\Program Files\CCleaner\uninst.exe"
Corel Paint Shop Pro Photo XI–>MsiExec.exe /X{E1C7EF5E-3A7B-4ED4-A48B-F70F1B36EAB4}
DesignPro 5.4 Limited Edition–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{71F6DF7D-B639-4FAD-BA93-E6DF267AA44D}
DivX Web Player–>C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Encrypted FTP–>C:\PROGRA~1\EFTP\UNWISE.EXE C:\PROGRA~1\EFTP\INSTALL.LOG
FastStone Image Viewer 3.6–>C:\Program Files\FastStone Image Viewer\uninst.exe
Garmin City Navigator North America NT 2009 Update–>MsiExec.exe /X{9DA735C0-3C3E-4CB3-BC26-BE95E768115F}
Garmin WebUpdater–>MsiExec.exe /X{366FFC89-C800-4366-B903-B9C4314109A5}
Hershey's CD Sampler–>C:\Program Files\Common Files\Knowledge Adventure\Uninstall\HersheyUn.exe
High Definition Audio Driver Package - KB888111–>"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2–>"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows XP (KB896344)–>"C:\WINDOWS\$NtUninstallKB896344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB914440)–>"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)–>"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB935448)–>"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
hp deskjet 825c series (Remove only)–>C:\Program Files\hp deskjet 825c series\hpfiui.exe -c -vdivid=HPF -vpnum=95 -vinstport=USB001 -vproduct=825c -huninstall
iTunes–>MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
Java™ 6 Update 2–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java™ 6 Update 3–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Kaspersky Online Scanner–>C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
King's Quest III–>C:\Program Files\IA\King's Quest III\Uninstall KQ3.exe
Marvell Miniport Driver–>MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0–>c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft .NET Framework 3.0–>MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003}
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office XP Professional with FrontPage–>MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight–>MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mozilla Firefox (2.0.0.17)–>C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB927978)–>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 6.0 Parser (KB933579)–>MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
muvee Plugin 1.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{82CA0A0C-A3EC-4167-B694-909205B2EDEC}\setup.exe" -l0x9
Neat Image v5.9 Home+–>"C:\Program Files\Neat Image\unins000.exe"
neroxml–>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers–>C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Pdf995–>c:\pdf995\setup.exe uninstall
PdfEdit995–>c:\pdf995\res\utilities\thinsetup.exe - uninstall
Photodex Presenter–>C:\Program Files\Photodex Presenter\uninst.exe
Picasa 2–>"C:\Program Files\Picasa2\Uninstall.exe"
ProShow Gold–>C:\Program Files\Photodex\ProShowGold\uninst.exe
QuickTime–>MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
ReaJPEG 3.9–>"C:\Program Files\ReaSoft\ReaJPEG\unins000.exe"
Realtek High Definition Audio Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x9 -removeonly
Security Update for Windows Internet Explorer 7 (KB931768)–>"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB933566)–>"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB937143)–>"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)–>"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)–>"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)–>"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows Media Player 9 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 9 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)–>"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)–>"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)–>"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)–>"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)–>"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)–>"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)–>"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)–>"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)–>"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)–>"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)–>"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB904706)–>"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)–>"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)–>"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)–>"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)–>"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)–>"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)–>"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)–>"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)–>"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917344)–>"C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917422)–>"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Security Update for Windows XP (KB917953)–>"C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)–>"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918439)–>"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)–>"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)–>"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)–>"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)–>"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)–>"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB921503)–>"C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)–>"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)–>"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)–>"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923689)–>"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923694)–>"C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)–>C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB923980)–>"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924191)–>"C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)–>"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924496)–>"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)–>"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)–>"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)–>"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)–>"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)–>"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)–>"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)–>"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)–>"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)–>"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)–>"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)–>"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931768)–>"C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)–>"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)–>"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)–>"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)–>"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)–>"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)–>"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)–>"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)–>"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)–>"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)–>"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941693)–>"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)–>"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)–>"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)–>"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)–>"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB945553)–>"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)–>"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948590)–>"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948881)–>"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)–>"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)–>"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)–>"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)–>"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)–>"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)–>"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)–>"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Signature995–>c:\pdf995\res\utilities\Signature995\thinsetup.exe - uninstall
Spelling Dictionaries Support For Adobe Reader 8–>MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Spybot - Search & Destroy 1.4–>"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Total Video Converter 3.11–>"C:\Program Files\Total Video Converter\unins000.exe"
Trillian–>C:\Program Files\Trillian\trillian.exe /uninstall
Turbo Lister 2–>C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{69640730-B830-4C24-BB5C-222DA1260548}
Ulead Photo Express 2.0 SE–>C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\Uninst.isu" -c"C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\IS32Inst.dll"
Update for Windows XP (KB894391)–>"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)–>"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB904942)–>"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)–>"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)–>"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)–>"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)–>"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)–>"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)–>"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB925720)–>"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)–>"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)–>"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB931836)–>"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update for Windows XP (KB932823-v3)–>"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Update for Windows XP (KB933360)–>"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)–>"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)–>"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)–>"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
VuePrint–>c:\windows\vuepro32.exe /Remove
WebEx–>C:\WINDOWS\DOWNLO~1\atcliun.exe
Webshots Desktop–>C:\PROGRA~1\Webshots\UNWISE.EXE C:\PROGRA~1\Webshots\INSTALL.LOG
Windows Communication Foundation–>MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component–>"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)–>"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 7–>"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format Runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Presentation Foundation–>MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation–>MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows XP Hotfix - KB873339–>C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835–>C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836–>C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB885884–>C:\WINDOWS\$NtUninstallKB885884$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185–>C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302–>C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859–>"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Hotfix - KB891781–>C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe

======Security center information======

AV: Bitdefender Antivirus

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 6 Stepping 5, GenuineIntel
"PROCESSOR_REVISION"=0605
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip

—————–EOF—————–

Sonja27

Post #4November 5, 2008, 11:01 PM UTC

I scanned with Kaspersky Online and the window automatically closes either in the middle of the scan or at the end. That is odd. I don't even get a chance to save the log or anything. At first, I tried opening it with Firefox, but it told me my system doesn't meet the requirements to run the program (I have the latest version of Firefox). So then I used Internet Explorer to run the scan and that's when it just closes. Any ideas there?

jpshortstuff

Post #5November 6, 2008, 6:53 AM UTC

That's a bit strange, but no matter, we will take another route.

Please download OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Files
C:\WINDOWS\system32\SET112A.tmp
C:\WINDOWS\system32\SET10FB.tmp
C:\WINDOWS\system32\SET10C9.tmp
C:\WINDOWS\system32\SET10C4.tmp
C:\WINDOWS\system32\SET10C1.tmp
C:\WINDOWS\SET4FE.tmp
C:\WINDOWS\system32\SET4DB.tmp
C:\WINDOWS\system32\SET4D4.tmp
C:\WINDOWS\system32\SET4CF.tmp
C:\WINDOWS\system32\SET4CB.tmp
C:\WINDOWS\system32\SET4C9.tmp
C:\WINDOWS\system32\SET4C6.tmp
C:\WINDOWS\system32\SET4BD.tmp
C:\WINDOWS\system32\SET4BB.tmp
C:\WINDOWS\system32\SET4B8.tmp
C:\WINDOWS\system32\SET4B7.tmp
C:\WINDOWS\system32\SET4B4.tmp
C:\WINDOWS\system32\SET4B3.tmp
C:\WINDOWS\system32\SET4B2.tmp
C:\WINDOWS\system32\SET4AF.tmp
C:\WINDOWS\system32\SET4AE.tmp
C:\WINDOWS\system32\SET4AD.tmp
C:\WINDOWS\system32\SET4A7.tmp
C:\WINDOWS\system32\SET4A5.tmp
C:\WINDOWS\system32\SET4A2.tmp
C:\WINDOWS\system32\SET49F.tmp
C:\WINDOWS\system32\SET498.tmp
C:\WINDOWS\system32\SET491.tmp
C:\WINDOWS\system32\SET488.tmp
C:\WINDOWS\system32\SET486.tmp
C:\WINDOWS\system32\SET480.tmp
C:\WINDOWS\system32\SET47D.tmp
C:\WINDOWS\system32\SET47A.tmp
C:\WINDOWS\system32\SET478.tmp
C:\WINDOWS\system32\SET477.tmp
C:\WINDOWS\system32\SET471.tmp
C:\WINDOWS\system32\SET46E.tmp
C:\WINDOWS\system32\SET46D.tmp
C:\WINDOWS\system32\SET46C.tmp
C:\WINDOWS\system32\SET46A.tmp
C:\WINDOWS\system32\SET469.tmp
C:\WINDOWS\system32\SET468.tmp
C:\WINDOWS\system32\SET45F.tmp
C:\WINDOWS\system32\SET44E.tmp
C:\WINDOWS\system32\SET429.tmp
C:\WINDOWS\system32\SET428.tmp
C:\WINDOWS\system32\SET413.tmp
C:\WINDOWS\system32\SET40C.tmp
C:\WINDOWS\system32\SET406.tmp
C:\WINDOWS\system32\SET3FF.tmp
C:\WINDOWS\system32\SET3F7.tmp
C:\WINDOWS\system32\SET3F6.tmp
C:\WINDOWS\system32\SET3F4.tmp
C:\WINDOWS\system32\SET3F2.tmp
C:\WINDOWS\system32\SET3DB.tmp
C:\WINDOWS\system32\SET3D7.tmp
C:\WINDOWS\system32\SET3CE.tmp
C:\WINDOWS\system32\SET3C7.tmp
C:\WINDOWS\system32\SET3C5.tmp
C:\WINDOWS\system32\SET3BB.tmp
C:\WINDOWS\system32\SET3A5.tmp
C:\WINDOWS\system32\SET39F.tmp
C:\WINDOWS\system32\SET394.tmp
C:\WINDOWS\system32\SET391.tmp
C:\WINDOWS\system32\SET38B.tmp
C:\WINDOWS\system32\SET384.tmp
C:\WINDOWS\system32\SET35F.tmp
C:\WINDOWS\system32\SET35D.tmp
C:\WINDOWS\system32\SET357.tmp
C:\WINDOWS\system32\SET355.tmp
C:\WINDOWS\system32\SET34B.tmp
C:\WINDOWS\system32\SET340.tmp
C:\WINDOWS\system32\SET33C.tmp
C:\WINDOWS\system32\SET338.tmp
C:\WINDOWS\system32\SET333.tmp
C:\WINDOWS\system32\SET327.tmp
C:\WINDOWS\system32\SET31C.tmp
C:\WINDOWS\system32\SET31B.tmp
C:\WINDOWS\system32\SET319.tmp
C:\WINDOWS\system32\SET313.tmp
C:\WINDOWS\system32\SET311.tmp
C:\WINDOWS\system32\SET30C.tmp
C:\WINDOWS\system32\SET30B.tmp
C:\WINDOWS\system32\SET30A.tmp
C:\WINDOWS\system32\SET306.tmp
C:\WINDOWS\system32\SET304.tmp
C:\WINDOWS\system32\SET2F2.tmp
C:\WINDOWS\system32\SET2EE.tmp
C:\WINDOWS\system32\SET2EC.tmp
C:\WINDOWS\system32\SET2EA.tmp
C:\WINDOWS\system32\SET2E9.tmp
C:\WINDOWS\system32\SET2E8.tmp
C:\WINDOWS\system32\SET2E7.tmp
C:\WINDOWS\system32\SET2E5.tmp
C:\WINDOWS\system32\SET2D9.tmp
C:\WINDOWS\system32\SET2D7.tmp
C:\WINDOWS\system32\SET2D3.tmp
C:\WINDOWS\system32\SET2D2.tmp
C:\WINDOWS\system32\SET2CC.tmp
C:\WINDOWS\system32\SET2CA.tmp
C:\WINDOWS\system32\SET2C6.tmp
C:\WINDOWS\system32\SET2C5.tmp
C:\WINDOWS\system32\SET2C1.tmp
C:\WINDOWS\system32\SET2BD.tmp
C:\WINDOWS\system32\SET2B7.tmp
C:\WINDOWS\system32\SET2B3.tmp
C:\WINDOWS\system32\SET2AB.tmp
C:\WINDOWS\system32\SET2AA.tmp
C:\WINDOWS\system32\SET2A2.tmp
C:\WINDOWS\system32\SET29C.tmp
C:\WINDOWS\system32\SET29A.tmp
C:\WINDOWS\system32\SET297.tmp
C:\WINDOWS\system32\SET296.tmp
C:\WINDOWS\system32\SET292.tmp
C:\WINDOWS\system32\SET28C.tmp
C:\WINDOWS\system32\SET28A.tmp
C:\WINDOWS\system32\SET289.tmp
C:\WINDOWS\system32\SET288.tmp
C:\WINDOWS\system32\SET27A.tmp
C:\WINDOWS\system32\SET276.tmp
C:\WINDOWS\system32\SET275.tmp
C:\WINDOWS\system32\SET270.tmp
C:\WINDOWS\system32\SET26D.tmp
C:\WINDOWS\system32\SET26A.tmp
C:\WINDOWS\system32\SET267.tmp
C:\WINDOWS\system32\SET266.tmp
C:\WINDOWS\system32\SET264.tmp
C:\WINDOWS\system32\SET263.tmp
C:\WINDOWS\system32\SET262.tmp
C:\WINDOWS\system32\SET25E.tmp
C:\WINDOWS\system32\SET25C.tmp
C:\WINDOWS\system32\SET259.tmp
C:\WINDOWS\system32\SET258.tmp
C:\WINDOWS\system32\SET257.tmp
C:\WINDOWS\system32\SET254.tmp
C:\WINDOWS\system32\SET253.tmp
C:\WINDOWS\system32\SET24C.tmp
C:\WINDOWS\system32\SET24B.tmp
C:\WINDOWS\system32\SET24A.tmp
C:\WINDOWS\system32\SET248.tmp
C:\WINDOWS\system32\SET239.tmp
C:\WINDOWS\system32\SET236.tmp
C:\WINDOWS\system32\SET234.tmp
C:\WINDOWS\system32\SET231.tmp
C:\WINDOWS\system32\SET230.tmp
C:\WINDOWS\system32\SET22E.tmp
C:\WINDOWS\system32\SET22A.tmp
C:\WINDOWS\system32\SET226.tmp
C:\WINDOWS\system32\SET223.tmp
C:\WINDOWS\system32\SET222.tmp
C:\WINDOWS\system32\SET221.tmp
C:\WINDOWS\system32\SET21F.tmp
C:\WINDOWS\system32\SET21D.tmp
C:\WINDOWS\system32\SET211.tmp
C:\WINDOWS\system32\SET20B.tmp
C:\WINDOWS\system32\SET209.tmp
C:\WINDOWS\system32\SET208.tmp
C:\WINDOWS\system32\SET207.tmp
C:\WINDOWS\system32\SET206.tmp
C:\WINDOWS\system32\SET200.tmp
C:\WINDOWS\system32\SET1F8.tmp
C:\WINDOWS\system32\SET1F7.tmp
C:\WINDOWS\system32\SET1F6.tmp
C:\WINDOWS\system32\SET1F0.tmp
C:\WINDOWS\system32\SET1EF.tmp
C:\WINDOWS\system32\SET1EB.tmp
C:\WINDOWS\system32\SET1E6.tmp
C:\WINDOWS\system32\SET1E5.tmp
C:\WINDOWS\system32\SET1E3.tmp
C:\WINDOWS\system32\SET1E2.tmp
C:\WINDOWS\system32\SET1E1.tmp
C:\WINDOWS\system32\SET1E0.tmp
C:\WINDOWS\system32\SET1DE.tmp
C:\WINDOWS\system32\SET1DC.tmp
C:\WINDOWS\system32\SET1D7.tmp
C:\WINDOWS\system32\SET1C7.tmp
C:\WINDOWS\system32\SET1C6.tmp
C:\WINDOWS\system32\SET1C5.tmp
C:\WINDOWS\system32\SET1C4.tmp
C:\WINDOWS\system32\SET1C3.tmp
C:\WINDOWS\system32\SET1C2.tmp
C:\WINDOWS\system32\SET1C0.tmp
C:\WINDOWS\system32\SET1BD.tmp
C:\WINDOWS\system32\SET1BC.tmp
C:\WINDOWS\system32\SET1AF.tmp
C:\WINDOWS\system32\SET1AC.tmp
C:\WINDOWS\system32\SET1AB.tmp
C:\WINDOWS\system32\SET1A4.tmp
C:\WINDOWS\system32\SET1A3.tmp
C:\WINDOWS\system32\SET1A0.tmp
C:\WINDOWS\system32\SET19D.tmp
C:\WINDOWS\system32\SET19C.tmp
C:\WINDOWS\system32\SET197.tmp
C:\WINDOWS\system32\SET191.tmp
C:\WINDOWS\system32\SET190.tmp
C:\WINDOWS\system32\SET18F.tmp
C:\WINDOWS\system32\SET18E.tmp
C:\WINDOWS\system32\SET18D.tmp
C:\WINDOWS\system32\SET188.tmp
C:\WINDOWS\system32\SET186.tmp
C:\WINDOWS\system32\SET185.tmp
C:\WINDOWS\system32\SET182.tmp
C:\WINDOWS\system32\SET17B.tmp
C:\WINDOWS\system32\SET17A.tmp
C:\WINDOWS\system32\SET178.tmp
C:\WINDOWS\system32\SET175.tmp
C:\WINDOWS\system32\SET174.tmp
C:\WINDOWS\system32\SET173.tmp
C:\WINDOWS\system32\SET16C.tmp
C:\WINDOWS\system32\SET169.tmp
C:\WINDOWS\system32\SET168.tmp
C:\WINDOWS\system32\SET167.tmp
C:\WINDOWS\system32\SET165.tmp
C:\WINDOWS\system32\SET164.tmp
C:\WINDOWS\system32\SET163.tmp
C:\WINDOWS\system32\SET162.tmp
C:\WINDOWS\system32\SET161.tmp
C:\WINDOWS\system32\SET15F.tmp
C:\WINDOWS\system32\SET15E.tmp
C:\WINDOWS\system32\SET15D.tmp
C:\WINDOWS\system32\SET152.tmp
C:\WINDOWS\system32\SET14F.tmp
C:\WINDOWS\system32\SET14E.tmp
C:\WINDOWS\system32\SET147.tmp
C:\WINDOWS\system32\SET145.tmp
C:\WINDOWS\system32\SET143.tmp
C:\WINDOWS\system32\SET141.tmp
C:\WINDOWS\system32\SET140.tmp
C:\WINDOWS\002925_.tmp

:Reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoAds]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

:Commands
[emptytemp]
[reboot]
Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Please run this online scan:

Panda Activescan

Once you are on the Panda site, click the Scan your PC button
A new window will open…click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on Local Disks to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the Panda scan report, along with a new HijackThis Log.

Also, please give a detailed description of how your computer is running and behaving at the moment, listing any remaining problems.

Thanks.

Sonja27

Post #6November 6, 2008, 7:23 PM UTC

Here's the OTMoveit log. ========== FILES ========== C:\WINDOWS\system32\SET112A.tmp moved successfully. C:\WINDOWS\system32\SET10FB.tmp moved successfully. C:\WINDOWS\system32\SET10C9.tmp moved successfully. C:\WINDOWS\system32\SET10C4.tmp moved successfully. C:\WINDOWS\system32\SET10C1.tmp moved successfully. C:\WINDOWS\SET4FE.tmp moved successfully. C:\WINDOWS\system32\SET4DB.tmp moved successfully. C:\WINDOWS\system32\SET4D4.tmp moved successfully. C:\WINDOWS\system32\SET4CF.tmp moved successfully. C:\WINDOWS\system32\SET4CB.tmp moved successfully. C:\WINDOWS\system32\SET4C9.tmp moved successfully. C:\WINDOWS\system32\SET4C6.tmp moved successfully. C:\WINDOWS\system32\SET4BD.tmp moved successfully. C:\WINDOWS\system32\SET4BB.tmp moved successfully. C:\WINDOWS\system32\SET4B8.tmp moved successfully. C:\WINDOWS\system32\SET4B7.tmp moved successfully. C:\WINDOWS\system32\SET4B4.tmp moved successfully. C:\WINDOWS\system32\SET4B3.tmp moved successfully. C:\WINDOWS\system32\SET4B2.tmp moved successfully. C:\WINDOWS\system32\SET4AF.tmp moved successfully. C:\WINDOWS\system32\SET4AE.tmp moved successfully. C:\WINDOWS\system32\SET4AD.tmp moved successfully. C:\WINDOWS\system32\SET4A7.tmp moved successfully. C:\WINDOWS\system32\SET4A5.tmp moved successfully. C:\WINDOWS\system32\SET4A2.tmp moved successfully. C:\WINDOWS\system32\SET49F.tmp moved successfully. C:\WINDOWS\system32\SET498.tmp moved successfully. C:\WINDOWS\system32\SET491.tmp moved successfully. C:\WINDOWS\system32\SET488.tmp moved successfully. C:\WINDOWS\system32\SET486.tmp moved successfully. C:\WINDOWS\system32\SET480.tmp moved successfully. C:\WINDOWS\system32\SET47D.tmp moved successfully. C:\WINDOWS\system32\SET47A.tmp moved successfully. C:\WINDOWS\system32\SET478.tmp moved successfully. C:\WINDOWS\system32\SET477.tmp moved successfully. C:\WINDOWS\system32\SET471.tmp moved successfully. C:\WINDOWS\system32\SET46E.tmp moved successfully. C:\WINDOWS\system32\SET46D.tmp moved successfully. C:\WINDOWS\system32\SET46C.tmp moved successfully. C:\WINDOWS\system32\SET46A.tmp moved successfully. C:\WINDOWS\system32\SET469.tmp moved successfully. C:\WINDOWS\system32\SET468.tmp moved successfully. C:\WINDOWS\system32\SET45F.tmp moved successfully. C:\WINDOWS\system32\SET44E.tmp moved successfully. C:\WINDOWS\system32\SET429.tmp moved successfully. C:\WINDOWS\system32\SET428.tmp moved successfully. C:\WINDOWS\system32\SET413.tmp moved successfully. C:\WINDOWS\system32\SET40C.tmp moved successfully. C:\WINDOWS\system32\SET406.tmp moved successfully. C:\WINDOWS\system32\SET3FF.tmp moved successfully. C:\WINDOWS\system32\SET3F7.tmp moved successfully. C:\WINDOWS\system32\SET3F6.tmp moved successfully. C:\WINDOWS\system32\SET3F4.tmp moved successfully. C:\WINDOWS\system32\SET3F2.tmp moved successfully. C:\WINDOWS\system32\SET3DB.tmp moved successfully. C:\WINDOWS\system32\SET3D7.tmp moved successfully. C:\WINDOWS\system32\SET3CE.tmp moved successfully. C:\WINDOWS\system32\SET3C7.tmp moved successfully. C:\WINDOWS\system32\SET3C5.tmp moved successfully. C:\WINDOWS\system32\SET3BB.tmp moved successfully. C:\WINDOWS\system32\SET3A5.tmp moved successfully. C:\WINDOWS\system32\SET39F.tmp moved successfully. C:\WINDOWS\system32\SET394.tmp moved successfully. C:\WINDOWS\system32\SET391.tmp moved successfully. C:\WINDOWS\system32\SET38B.tmp moved successfully. C:\WINDOWS\system32\SET384.tmp moved successfully. C:\WINDOWS\system32\SET35F.tmp moved successfully. C:\WINDOWS\system32\SET35D.tmp moved successfully. C:\WINDOWS\system32\SET357.tmp moved successfully. C:\WINDOWS\system32\SET355.tmp moved successfully. C:\WINDOWS\system32\SET34B.tmp moved successfully. C:\WINDOWS\system32\SET340.tmp moved successfully. C:\WINDOWS\system32\SET33C.tmp moved successfully. C:\WINDOWS\system32\SET338.tmp moved successfully. C:\WINDOWS\system32\SET333.tmp moved successfully. C:\WINDOWS\system32\SET327.tmp moved successfully. C:\WINDOWS\system32\SET31C.tmp moved successfully. C:\WINDOWS\system32\SET31B.tmp moved successfully. C:\WINDOWS\system32\SET319.tmp moved successfully. C:\WINDOWS\system32\SET313.tmp moved successfully. C:\WINDOWS\system32\SET311.tmp moved successfully. C:\WINDOWS\system32\SET30C.tmp moved successfully. C:\WINDOWS\system32\SET30B.tmp moved successfully. C:\WINDOWS\system32\SET30A.tmp moved successfully. C:\WINDOWS\system32\SET306.tmp moved successfully. C:\WINDOWS\system32\SET304.tmp moved successfully. C:\WINDOWS\system32\SET2F2.tmp moved successfully. C:\WINDOWS\system32\SET2EE.tmp moved successfully. C:\WINDOWS\system32\SET2EC.tmp moved successfully. C:\WINDOWS\system32\SET2EA.tmp moved successfully. C:\WINDOWS\system32\SET2E9.tmp moved successfully. C:\WINDOWS\system32\SET2E8.tmp moved successfully. C:\WINDOWS\system32\SET2E7.tmp moved successfully. C:\WINDOWS\system32\SET2E5.tmp moved successfully. C:\WINDOWS\system32\SET2D9.tmp moved successfully. C:\WINDOWS\system32\SET2D7.tmp moved successfully. C:\WINDOWS\system32\SET2D3.tmp moved successfully. C:\WINDOWS\system32\SET2D2.tmp moved successfully. C:\WINDOWS\system32\SET2CC.tmp moved successfully. C:\WINDOWS\system32\SET2CA.tmp moved successfully. C:\WINDOWS\system32\SET2C6.tmp moved successfully. C:\WINDOWS\system32\SET2C5.tmp moved successfully. C:\WINDOWS\system32\SET2C1.tmp moved successfully. C:\WINDOWS\system32\SET2BD.tmp moved successfully. C:\WINDOWS\system32\SET2B7.tmp moved successfully. C:\WINDOWS\system32\SET2B3.tmp moved successfully. C:\WINDOWS\system32\SET2AB.tmp moved successfully. C:\WINDOWS\system32\SET2AA.tmp moved successfully. C:\WINDOWS\system32\SET2A2.tmp moved successfully. C:\WINDOWS\system32\SET29C.tmp moved successfully. C:\WINDOWS\system32\SET29A.tmp moved successfully. C:\WINDOWS\system32\SET297.tmp moved successfully. C:\WINDOWS\system32\SET296.tmp moved successfully. C:\WINDOWS\system32\SET292.tmp moved successfully. C:\WINDOWS\system32\SET28C.tmp moved successfully. C:\WINDOWS\system32\SET28A.tmp moved successfully. C:\WINDOWS\system32\SET289.tmp moved successfully. C:\WINDOWS\system32\SET288.tmp moved successfully. C:\WINDOWS\system32\SET27A.tmp moved successfully. C:\WINDOWS\system32\SET276.tmp moved successfully. C:\WINDOWS\system32\SET275.tmp moved successfully. C:\WINDOWS\system32\SET270.tmp moved successfully. C:\WINDOWS\system32\SET26D.tmp moved successfully. C:\WINDOWS\system32\SET26A.tmp moved successfully. C:\WINDOWS\system32\SET267.tmp moved successfully. C:\WINDOWS\system32\SET266.tmp moved successfully. C:\WINDOWS\system32\SET264.tmp moved successfully. C:\WINDOWS\system32\SET263.tmp moved successfully. C:\WINDOWS\system32\SET262.tmp moved successfully. C:\WINDOWS\system32\SET25E.tmp moved successfully. C:\WINDOWS\system32\SET25C.tmp moved successfully. C:\WINDOWS\system32\SET259.tmp moved successfully. C:\WINDOWS\system32\SET258.tmp moved successfully. C:\WINDOWS\system32\SET257.tmp moved successfully. C:\WINDOWS\system32\SET254.tmp moved successfully. C:\WINDOWS\system32\SET253.tmp moved successfully. C:\WINDOWS\system32\SET24C.tmp moved successfully. C:\WINDOWS\system32\SET24B.tmp moved successfully. C:\WINDOWS\system32\SET24A.tmp moved successfully. C:\WINDOWS\system32\SET248.tmp moved successfully. C:\WINDOWS\system32\SET239.tmp moved successfully. C:\WINDOWS\system32\SET236.tmp moved successfully. C:\WINDOWS\system32\SET234.tmp moved successfully. C:\WINDOWS\system32\SET231.tmp moved successfully. C:\WINDOWS\system32\SET230.tmp moved successfully. C:\WINDOWS\system32\SET22E.tmp moved successfully. C:\WINDOWS\system32\SET22A.tmp moved successfully. C:\WINDOWS\system32\SET226.tmp moved successfully. C:\WINDOWS\system32\SET223.tmp moved successfully. C:\WINDOWS\system32\SET222.tmp moved successfully. C:\WINDOWS\system32\SET221.tmp moved successfully. C:\WINDOWS\system32\SET21F.tmp moved successfully. C:\WINDOWS\system32\SET21D.tmp moved successfully. C:\WINDOWS\system32\SET211.tmp moved successfully. C:\WINDOWS\system32\SET20B.tmp moved successfully. C:\WINDOWS\system32\SET209.tmp moved successfully. C:\WINDOWS\system32\SET208.tmp moved successfully. C:\WINDOWS\system32\SET207.tmp moved successfully. C:\WINDOWS\system32\SET206.tmp moved successfully. C:\WINDOWS\system32\SET200.tmp moved successfully. C:\WINDOWS\system32\SET1F8.tmp moved successfully. C:\WINDOWS\system32\SET1F7.tmp moved successfully. C:\WINDOWS\system32\SET1F6.tmp moved successfully. C:\WINDOWS\system32\SET1F0.tmp moved successfully. C:\WINDOWS\system32\SET1EF.tmp moved successfully. C:\WINDOWS\system32\SET1EB.tmp moved successfully. C:\WINDOWS\system32\SET1E6.tmp moved successfully. C:\WINDOWS\system32\SET1E5.tmp moved successfully. C:\WINDOWS\system32\SET1E3.tmp moved successfully. C:\WINDOWS\system32\SET1E2.tmp moved successfully. C:\WINDOWS\system32\SET1E1.tmp moved successfully. C:\WINDOWS\system32\SET1E0.tmp moved successfully. C:\WINDOWS\system32\SET1DE.tmp moved successfully. C:\WINDOWS\system32\SET1DC.tmp moved successfully. C:\WINDOWS\system32\SET1D7.tmp moved successfully. C:\WINDOWS\system32\SET1C7.tmp moved successfully. C:\WINDOWS\system32\SET1C6.tmp moved successfully. C:\WINDOWS\system32\SET1C5.tmp moved successfully. C:\WINDOWS\system32\SET1C4.tmp moved successfully. C:\WINDOWS\system32\SET1C3.tmp moved successfully. C:\WINDOWS\system32\SET1C2.tmp moved successfully. C:\WINDOWS\system32\SET1C0.tmp moved successfully. C:\WINDOWS\system32\SET1BD.tmp moved successfully. C:\WINDOWS\system32\SET1BC.tmp moved successfully. C:\WINDOWS\system32\SET1AF.tmp moved successfully. C:\WINDOWS\system32\SET1AC.tmp moved successfully. C:\WINDOWS\system32\SET1AB.tmp moved successfully. C:\WINDOWS\system32\SET1A4.tmp moved successfully. C:\WINDOWS\system32\SET1A3.tmp moved successfully. C:\WINDOWS\system32\SET1A0.tmp moved successfully. C:\WINDOWS\system32\SET19D.tmp moved successfully. C:\WINDOWS\system32\SET19C.tmp moved successfully. C:\WINDOWS\system32\SET197.tmp moved successfully. C:\WINDOWS\system32\SET191.tmp moved successfully. C:\WINDOWS\system32\SET190.tmp moved successfully. C:\WINDOWS\system32\SET18F.tmp moved successfully. C:\WINDOWS\system32\SET18E.tmp moved successfully. C:\WINDOWS\system32\SET18D.tmp moved successfully. C:\WINDOWS\system32\SET188.tmp moved successfully. C:\WINDOWS\system32\SET186.tmp moved successfully. C:\WINDOWS\system32\SET185.tmp moved successfully. C:\WINDOWS\system32\SET182.tmp moved successfully. C:\WINDOWS\system32\SET17B.tmp moved successfully. C:\WINDOWS\system32\SET17A.tmp moved successfully. C:\WINDOWS\system32\SET178.tmp moved successfully. C:\WINDOWS\system32\SET175.tmp moved successfully. C:\WINDOWS\system32\SET174.tmp moved successfully. C:\WINDOWS\system32\SET173.tmp moved successfully. C:\WINDOWS\system32\SET16C.tmp moved successfully. C:\WINDOWS\system32\SET169.tmp moved successfully. C:\WINDOWS\system32\SET168.tmp moved successfully. C:\WINDOWS\system32\SET167.tmp moved successfully. C:\WINDOWS\system32\SET165.tmp moved successfully. C:\WINDOWS\system32\SET164.tmp moved successfully. C:\WINDOWS\system32\SET163.tmp moved successfully. C:\WINDOWS\system32\SET162.tmp moved successfully. C:\WINDOWS\system32\SET161.tmp moved successfully. C:\WINDOWS\system32\SET15F.tmp moved successfully. C:\WINDOWS\system32\SET15E.tmp moved successfully. C:\WINDOWS\system32\SET15D.tmp moved successfully. C:\WINDOWS\system32\SET152.tmp moved successfully. C:\WINDOWS\system32\SET14F.tmp moved successfully. C:\WINDOWS\system32\SET14E.tmp moved successfully. C:\WINDOWS\system32\SET147.tmp moved successfully. C:\WINDOWS\system32\SET145.tmp moved successfully. C:\WINDOWS\system32\SET143.tmp moved successfully. C:\WINDOWS\system32\SET141.tmp moved successfully. C:\WINDOWS\system32\SET140.tmp moved successfully. C:\WINDOWS\002925_.tmp moved successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NoAds\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz\\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck\\ deleted successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11062008_111750 Files moved on Reboot… File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Sonja\Local Settings\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\XUL.mfl moved successfully.

Sonja27

Post #7November 6, 2008, 11:03 PM UTC

Here's the ActiveScan.txt file ;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2008-11-06 15:01:34 PROTECTIONS: 1 MALWARE: 25 SUSPECTS: 1 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== Bit-Defender Internet Security 2008 11.0.17 No Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.trafficmp.com/] 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.trafficmp.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.casalemedia.com/] 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.doubleclick.net/] 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.doubleclick.net/] 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.atdmt.com/] 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.atdmt.com/] 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.247realmedia.com/] 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.247realmedia.com/] 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.247realmedia.com/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.fastclick.net/] 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.tribalfusion.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.mediaplex.com/] 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.mediaplex.com/] 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.com.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.statcounter.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[ad.yieldmanager.com/] 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.burstnet.com/] 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.burstnet.com/] 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.burstnet.com/] 00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[www.burstbeacon.com/] 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[server.iad.liveperson.net/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.advertising.com/] 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[statse.webtrendslive.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.ads.pointroll.com/] 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.overture.com/] 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.overture.com/] 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.overture.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.realmedia.com/] 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.questionmarket.com/] 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.questionmarket.com/] 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.questionmarket.com/] 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.questionmarket.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.zedo.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.adrevolver.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.go.com/] 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.target.com/] 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.target.com/] 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.target.com/] 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.target.com/] 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Sonja\Application Data\Mozilla\Firefox\Profiles\8xv156q6.default\cookies.txt[.atwola.com/] ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location uV ;=============================================================================== ================================================================================= =================== No C:\Documents and Settings\Sonja\My Documents\My eBooks\freetosell6.exe uV ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description uV ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= ===================

jpshortstuff

Post #8November 7, 2008, 7:24 AM UTC

Hi. Please post a new HijackThis log. Hows the computer running at the moment? Thanks.

Sonja27

Post #9November 7, 2008, 3:48 PM UTC

Logfile of HijackThis v1.99.1
Scan saved at 7:47:58 AM, on 11/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sonja\Desktop\Misc\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/ph…t_publisher.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://remotecontrol.trendmicro.com/sdccom…oad/tgctlcm.cab
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - https://remotecontrol.trendmicro.com/sdccom…wnload/ssrc.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1184997770015
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://trendmicro.webex.com/client/T25L/webex/ieatgpc.cab
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)

jpshortstuff

Post #10November 7, 2008, 4:05 PM UTC

Hi.

Fix this item in HijackThis:
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\

You need to upgrade to Windows XP Service Pack 3. Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install Windows XP - Service Pack 3.

You don't appear to be running any third party Firewall software.

Install a firewall! Without a firewall you are very susceptible to being hacked, and people could gain access to your computer. If you don't have a firewall I strongly recommend you download ONE of the following:
1) Comodo
2) Agnitum
3) Sunbelt/Kerio

Please reboot after these steps, and post a new HijackThis log.

How is your computer running at the moment?

Thanks.

Sonja27

Post #11November 8, 2008, 3:32 AM UTC

I did all of the above. Before I could do the last one (firewall), my computer went to the blue screen again. I don't know if having a firewall will prevent that, but it's on now.

Here's the new log.

Logfile of HijackThis v1.99.1
Scan saved at 7:30:12 PM, on 11/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sonja\Desktop\Misc\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/ph…t_publisher.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://remotecontrol.trendmicro.com/sdccom…oad/tgctlcm.cab
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - https://remotecontrol.trendmicro.com/sdccom…wnload/ssrc.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1184997770015
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://trendmicro.webex.com/client/T25L/webex/ieatgpc.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\cssdll32.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)

jpshortstuff

Post #12November 8, 2008, 7:14 AM UTC

Hi.

Open HijackThis, hit Do A System Scan Only. Place a checkmark next to this item:
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
Close all windows and browsers and hit "Fix Checked.

Are you having any more problems, other than the blue screens?

There aren't any more signs of Malware in your logs, so if the only problems you are having is blue screens then I will probably have to refer you to a Techie.

Thanks.

Sonja27

Post #13November 8, 2008, 4:29 PM UTC

My computer is much faster so I think the malware issue is resolved. The blue screen is my only problem now. I appreciate your help. Would a techie know about blue screens? I'd love to have some light shed on that.

Here's my new log.

Logfile of HijackThis v1.99.1
Scan saved at 8:26:55 AM, on 11/8/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Trillian\trillian.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Sonja\Desktop\Misc\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Sonja\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: Photobucket Publisher - http://pic.photobucket.com/plugins/csve/ph…t_publisher.CAB
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://remotecontrol.trendmicro.com/sdccom…oad/tgctlcm.cab
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - https://remotecontrol.trendmicro.com/sdccom…wnload/ssrc.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr…vex/TmHcmsX.CAB
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1184997770015
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_a…asyInstallX.CAB
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://trendmicro.webex.com/client/T25L/webex/ieatgpc.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\cssdll32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Sonja27

Post #14November 8, 2008, 10:59 PM UTC

Here is a link to what I got this morning when the blue screen came up, I took a picture of it.

[external image: Posted Image]

jpshortstuff

Post #15November 9, 2008, 9:35 AM UTC

Hi Sonja27

Log looks good

Our Tech Experts are extremely well versed in all technical (non-Malware) areas of computers, and they will undoubtedly be able to locate the source of your problem, if not solve it completely. I suggest you start a new thread in the Microsoft Windows forum here at WhatTheTech, where you will receive prompt, expert assistance. Include a detailed description of your problem (the image you posted to me will help as well) as well as a link to this topic so they can see what has already been done to your computer.

Clean up with OTMoveIt3

Double-click OTMoveIt3.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

You can now delete any other tools I had you download and use, unless you wish to keep them.

Set correct settings for files that should be hidden in Windows XP

Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
If unchecked please checkHide protected operating system files (Recommended)
If necessary check "Display content of system folders"
If necessary Uncheck Hide file extensions for known file types.
Click OK

Now that your system appears to be clean, theres just a few steps I'd like you to take to prevent any future infections.

System restore:
We will now clear your existing system restore points and establish a new clean restore point:
- Go to Start > All Programs > Accessories > System Tools > System Restore
- Select Create a restore point, and Ok it.
- Next, go to Start > Run and type in cleanmgr
- Select the More options tab
- Choose the option to clean up system restore and OK it.
  
  This will remove all restore points except the new one you just created.
Make sure you do this now, as your System Restore currently has infected files in it.
Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis.
Make sure you update your Anti-Virus software regularly, new viruses are being developed all the time.
Some more programs that it would be useful to have [OPTIONAL but RECOMMENDED]:

Download Spybot Search and Destroy 1.5 from here
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

SpywareBlaster is another real-time scanner that prevents most spyware from even being installed.
Freely available: Download SpywareBlaster

Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

Also, please read this great article by Tony Klein: So How Did I Get Infected In First Place

Glad we could be of assistance.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Stay Clean!

jpshortstuff

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Computer goes to blue screen,...spyware? Or hardware p

✨ Ask AI

Ask AI