This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] another trojan horse clicker.sxt

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I have having similar problems to other posts
Following is my hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 10:51:57 AM, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\WINDOWS\system32\J64GaLky.exe
C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\IntCodec\isaddon.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
O2 - BHO: (no name) - {577a1314-91d1-4fba-addd-1d1576ff90f1} - C:\WINDOWS\system32\tizelazi.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [P3000x_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [CPMb381c931] Rundll32.exe "c:\windows\system32\kugatugi.dll",a
O4 - HKLM\..\Run: [sopafupoda] Rundll32.exe "C:\WINDOWS\system32\zubewudi.dll",s
O4 - HKLM\..\Run: [BDWizReg] "C:\Program Files\BitDefender\BitDefender 2009\bdwizreg.exe" /complete
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\pomukuhe.dll,c:\windows\system32\kugatugi.dll,avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

I appreciate your help!
Hello

Disable resident protections (Antivirus…); you'll re-enable them after the scan

Download Lop S&D < here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
results:
——————–\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® D CPU 2.80GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
USER : Topsy Wright ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:69 Go (Free:41 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Mon 11/10/2008|11:39 )

——————–\\ Listing folders in APPLIC~1

[08/16/2005|04:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Identities
[11/09/2008|03:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft
[12/12/2005|10:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sun

[10/13/2008|09:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[11/10/2008|09:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
[10/22/2007|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[07/15/2008|10:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[07/09/2007|02:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[04/05/2007|09:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[11/09/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg8
[11/09/2008|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BitDefender
[11/30/2007|06:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Dell
[08/16/2005|08:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ DIGStream
[11/06/2008|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Eastman Kodak Company
[09/14/2006|10:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[11/09/2008|01:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google Updater
[12/12/2005|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek
[12/15/2005|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HotSync
[12/12/2005|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[02/03/2006|01:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[11/07/2008|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ kds_kodak
[11/06/2008|02:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[07/09/2008|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[11/04/2008|09:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[03/30/2007|03:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee
[12/15/2005|05:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee.com
[07/15/2008|10:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[09/24/2008|03:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSScanAppDataDir
[12/20/2005|11:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Napster
[08/12/2008|01:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Office Genuine Advantage
[12/12/2005|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[11/15/2007|10:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SupportSoft
[12/12/2005|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[04/04/2008|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WildTangent
[12/21/2005|04:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[10/13/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Winferno
[07/06/2007|11:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo!
[12/19/2007|10:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion

[08/16/2005|04:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[09/19/2008|09:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Macromedia
[12/12/2005|10:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[12/12/2005|10:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sun

[03/17/2008|08:06] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Adobe
[03/17/2008|08:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Google
[02/13/2007|09:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Help
[12/16/2005|01:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia
[11/09/2008|03:24] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[03/17/2008|08:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Yahoo!

[11/05/2008|04:05] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Adobe
[11/09/2008|05:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\ AVGTOOLBAR
[11/04/2008|02:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Google
[09/19/2008|12:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Macromedia
[11/09/2008|03:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
[11/04/2008|02:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Yahoo!

[10/13/2008|03:25] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Adobe
[11/29/2006|02:54] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ AdobeUM
[08/19/2008|01:02] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Apple Computer
[11/09/2008|03:31] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ AVGTOOLBAR
[11/09/2008|02:42] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ BitDefender
[12/19/2005|09:10] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Corel Photo Album
[03/17/2008|01:49] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Google
[04/10/2007|01:04] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Gtek
[12/15/2005|08:36] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Help
[12/15/2005|10:00] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ HotSync
[09/17/2008|12:08] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ ICAClient
[11/09/2006|04:28] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Identities
[07/09/2008|09:54] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Lavasoft
[12/15/2005|10:04] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Leadertech
[01/15/2008|11:43] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ LimeWire
[10/05/2008|12:09] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ LinkedIn
[02/12/2007|05:41] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Macromedia
[11/04/2008|09:24] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Malwarebytes
[11/03/2008|01:40] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Microsoft
[04/04/2008|12:10] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Mozilla
[10/29/2008|12:09] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Real
[03/07/2006|11:49] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Roxio
[11/05/2007|04:54] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Sonic
[12/12/2005|10:23] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Sun
[04/04/2008|12:11] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Talkback
[01/07/2008|04:00] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Uniblue
[03/10/2007|10:12] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Viewpoint
[04/04/2008|12:15] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ WildTangent
[10/14/2008|05:14] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ yahoo!

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/09/2008 02:30 PM][–a——] C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
[11/06/2008 01:05 PM][–a——] C:\WINDOWS\tasks\EasyShare Registration Task.job
[11/08/2008 11:00 PM][–a——] C:\WINDOWS\tasks\At74.job
[11/09/2008 08:00 PM][–a——] C:\WINDOWS\tasks\At71.job
[11/08/2008 10:00 PM][–a——] C:\WINDOWS\tasks\At73.job
[11/09/2008 09:00 PM][–a——] C:\WINDOWS\tasks\At72.job
[11/09/2008 07:00 PM][–a——] C:\WINDOWS\tasks\At70.job
[11/09/2008 06:00 PM][–a——] C:\WINDOWS\tasks\At69.job
[11/09/2008 05:00 PM][–a——] C:\WINDOWS\tasks\At68.job
[11/09/2008 02:00 PM][–a——] C:\WINDOWS\tasks\At65.job
[11/09/2008 04:00 PM][–a——] C:\WINDOWS\tasks\At67.job
[11/09/2008 03:00 PM][–a——] C:\WINDOWS\tasks\At66.job
[11/10/2008 10:00 AM][–a——] C:\WINDOWS\tasks\At61.job
[11/09/2008 01:00 PM][–a——] C:\WINDOWS\tasks\At64.job
[11/09/2008 12:00 PM][–a——] C:\WINDOWS\tasks\At63.job
[11/10/2008 11:00 AM][–a——] C:\WINDOWS\tasks\At62.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\At60.job
[11/09/2008 08:00 AM][–a——] C:\WINDOWS\tasks\At59.job
[11/09/2008 07:00 AM][–a——] C:\WINDOWS\tasks\At58.job
[11/09/2008 06:00 AM][–a——] C:\WINDOWS\tasks\At57.job
[11/09/2008 05:00 AM][–a——] C:\WINDOWS\tasks\At56.job
[11/09/2008 04:00 AM][–a——] C:\WINDOWS\tasks\At55.job
[11/09/2008 03:00 AM][–a——] C:\WINDOWS\tasks\At54.job
[11/09/2008 02:00 AM][–a——] C:\WINDOWS\tasks\At53.job
[11/09/2008 01:00 AM][–a——] C:\WINDOWS\tasks\At52.job
[11/09/2008 12:21 AM][–a——] C:\WINDOWS\tasks\At51.job
[11/08/2008 11:00 PM][–a——] C:\WINDOWS\tasks\At50.job
[11/08/2008 10:00 PM][–a——] C:\WINDOWS\tasks\At49.job
[11/09/2008 09:00 PM][–a——] C:\WINDOWS\tasks\At48.job
[11/09/2008 06:00 PM][–a——] C:\WINDOWS\tasks\At45.job
[11/09/2008 08:00 PM][–a——] C:\WINDOWS\tasks\At47.job
[11/09/2008 07:00 PM][–a——] C:\WINDOWS\tasks\At46.job
[11/09/2008 05:00 PM][–a——] C:\WINDOWS\tasks\At44.job
[11/09/2008 04:00 PM][–a——] C:\WINDOWS\tasks\At43.job
[11/09/2008 02:00 PM][–a——] C:\WINDOWS\tasks\At41.job
[11/09/2008 01:00 PM][–a——] C:\WINDOWS\tasks\At40.job
[11/09/2008 03:00 PM][–a——] C:\WINDOWS\tasks\At42.job
[11/10/2008 10:00 AM][–a——] C:\WINDOWS\tasks\At37.job
[11/09/2008 12:00 PM][–a——] C:\WINDOWS\tasks\At39.job
[11/10/2008 11:00 AM][–a——] C:\WINDOWS\tasks\At38.job
[11/09/2008 07:00 AM][–a——] C:\WINDOWS\tasks\At34.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\At36.job
[11/09/2008 08:00 AM][–a——] C:\WINDOWS\tasks\At35.job
[11/09/2008 04:00 AM][–a——] C:\WINDOWS\tasks\At31.job
[11/09/2008 06:00 AM][–a——] C:\WINDOWS\tasks\At33.job
[11/09/2008 05:00 AM][–a——] C:\WINDOWS\tasks\At32.job
[11/09/2008 03:00 AM][–a——] C:\WINDOWS\tasks\At30.job
[11/09/2008 01:00 AM][–a——] C:\WINDOWS\tasks\At28.job
[11/09/2008 02:00 AM][–a——] C:\WINDOWS\tasks\At29.job
[11/09/2008 12:18 AM][–a——] C:\WINDOWS\tasks\At27.job
[11/08/2008 10:00 PM][–a——] C:\WINDOWS\tasks\At25.job
[11/08/2008 11:00 PM][–a——] C:\WINDOWS\tasks\At26.job
[11/09/2008 07:00 PM][–a——] C:\WINDOWS\tasks\At22.job
[11/09/2008 08:00 PM][–a——] C:\WINDOWS\tasks\At23.job
[11/09/2008 09:00 PM][–a——] C:\WINDOWS\tasks\At24.job
[11/09/2008 05:00 PM][–a——] C:\WINDOWS\tasks\At20.job
[11/09/2008 06:00 PM][–a——] C:\WINDOWS\tasks\At21.job
[11/09/2008 02:00 PM][–a——] C:\WINDOWS\tasks\At17.job
[11/09/2008 04:00 PM][–a——] C:\WINDOWS\tasks\At19.job
[11/09/2008 03:00 PM][–a——] C:\WINDOWS\tasks\At18.job
[11/10/2008 11:00 AM][–a——] C:\WINDOWS\tasks\At14.job
[11/09/2008 01:00 PM][–a——] C:\WINDOWS\tasks\At16.job
[11/09/2008 12:00 PM][–a——] C:\WINDOWS\tasks\At15.job
[11/09/2008 08:00 AM][–a——] C:\WINDOWS\tasks\At11.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\At12.job
[11/10/2008 10:00 AM][–a——] C:\WINDOWS\tasks\At13.job
[11/09/2008 06:00 AM][–a——] C:\WINDOWS\tasks\At9.job
[11/09/2008 05:00 AM][–a——] C:\WINDOWS\tasks\At8.job
[11/09/2008 07:00 AM][–a——] C:\WINDOWS\tasks\At10.job
[11/09/2008 04:00 AM][–a——] C:\WINDOWS\tasks\At7.job
[11/09/2008 03:00 AM][–a——] C:\WINDOWS\tasks\At6.job
[11/09/2008 01:00 AM][–a——] C:\WINDOWS\tasks\At4.job
[11/09/2008 02:00 AM][–a——] C:\WINDOWS\tasks\At5.job
[11/09/2008 12:48 AM][–a——] C:\WINDOWS\tasks\At3.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\rpc.job
[11/08/2008 02:37 PM][–a——] C:\WINDOWS\tasks\At2.job
[11/06/2008 09:02 PM][–a——] C:\WINDOWS\tasks\At1.job
[11/10/2008 08:26 AM][–a——] C:\WINDOWS\tasks\RegCure Program Check.job
[10/30/2008 07:29 AM][–a——] C:\WINDOWS\tasks\RegCure.job
[10/30/2008 07:09 AM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/10/2008 08:26 AM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/10/2004 05:00 AM][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[10/13/2008|02:32] C:\Program Files\ 7-Zip
[08/28/2008|11:44] C:\Program Files\ Adobe
[08/19/2008|10:49] C:\Program Files\ Apple Software Update
[11/09/2008|03:26] C:\Program Files\ AVG
[11/06/2008|10:06] C:\Program Files\ BitDefender
[09/11/2008|07:30] C:\Program Files\ Bonjour
[11/06/2008|10:04] C:\Program Files\ Common Files
[08/16/2005|04:38] C:\Program Files\ ComPlus Applications
[12/12/2005|10:11] C:\Program Files\ CONEXANT
[12/12/2005|10:37] C:\Program Files\ Corel
[11/03/2008|01:43] C:\Program Files\ Coupons
[12/12/2005|10:28] C:\Program Files\ CyberLink
[12/15/2005|09:14] C:\Program Files\ Dell
[11/15/2007|10:29] C:\Program Files\ Dell Support Center
[04/10/2007|12:43] C:\Program Files\ DellSupport
[12/12/2005|10:28] C:\Program Files\ Digital Line Detect
[12/19/2006|11:29] C:\Program Files\ Digonex
[05/07/2008|09:28] C:\Program Files\ DIGStream
[12/12/2005|10:33] C:\Program Files\ EarthLink Setup
[08/16/2005|08:51] C:\Program Files\ EnglishOtto
[08/16/2005|08:54] C:\Program Files\ ESPNMotion
[11/24/2007|02:06] C:\Program Files\ GemMaster
[09/19/2008|09:56] C:\Program Files\ Google
[05/06/2008|04:03] C:\Program Files\ Grisoft
[11/10/2008|10:51] C:\Program Files\ Hijackthis
[11/09/2008|08:47] C:\Program Files\ InstallShield Installation Information
[12/12/2005|10:27] C:\Program Files\ Intel
[10/16/2008|02:03] C:\Program Files\ Internet Explorer
[12/12/2005|10:33] C:\Program Files\ Intuit
[10/13/2008|09:36] C:\Program Files\ iPod
[11/07/2008|06:55] C:\Program Files\ iTunes
[10/29/2008|11:36] C:\Program Files\ Java
[11/06/2008|02:23] C:\Program Files\ Kodak
[07/09/2008|09:54] C:\Program Files\ Lavasoft
[11/10/2008|10:40] C:\Program Files\ Malwarebytes' Anti-Malware
[09/19/2008|08:19] C:\Program Files\ Messenger
[12/12/2005|10:30] C:\Program Files\ Microsoft ActiveSync
[05/05/2006|08:18] C:\Program Files\ Microsoft AntiSpyware
[10/29/2008|01:54] C:\Program Files\ Microsoft CAPICOM 2.1.0.2
[08/16/2005|04:43] C:\Program Files\ microsoft frontpage
[12/12/2005|10:30] C:\Program Files\ Microsoft Office
[12/12/2005|10:32] C:\Program Files\ Microsoft Plus! Digital Media Edition
[12/12/2005|10:32] C:\Program Files\ Microsoft Plus! Photo Story 2 LE
[10/29/2008|12:54] C:\Program Files\ Microsoft Silverlight
[12/12/2005|10:30] C:\Program Files\ Microsoft Visual Studio
[12/12/2005|10:40] C:\Program Files\ Microsoft Works
[12/12/2005|10:29] C:\Program Files\ Microsoft.NET
[12/12/2005|10:28] C:\Program Files\ Modem Helper
[09/19/2008|08:14] C:\Program Files\ Movie Maker
[07/15/2008|01:30] C:\Program Files\ Mozilla Firefox
[12/22/2005|09:18] C:\Program Files\ MSN
[08/16/2005|04:37] C:\Program Files\ MSN Gaming Zone
[11/17/2006|03:01] C:\Program Files\ MSXML 4.0
[01/09/2008|10:46] C:\Program Files\ MUSICMATCH
[11/09/2008|08:47] C:\Program Files\ Napster
[09/19/2008|08:10] C:\Program Files\ NetMeeting
[12/12/2005|10:28] C:\Program Files\ NetWaiting
[12/12/2005|10:31] C:\Program Files\ NetZeroInstallers
[09/19/2008|12:26] C:\Program Files\ Norton PC Checkup
[08/16/2005|04:38] C:\Program Files\ Online Services
[09/19/2008|08:10] C:\Program Files\ Outlook Express
[12/16/2005|03:50] C:\Program Files\ palmOne
[07/15/2008|10:08] C:\Program Files\ PopCap Games
[09/11/2008|07:30] C:\Program Files\ QuickTime
[12/12/2005|10:33] C:\Program Files\ Real
[11/06/2007|03:50] C:\Program Files\ RegCure
[08/16/2005|08:58] C:\Program Files\ RGB
[11/05/2007|10:02] C:\Program Files\ Seagate Software
[12/12/2005|10:25] C:\Program Files\ Sigmatel
[11/05/2008|06:42] C:\Program Files\ SpyHeal
[10/29/2008|11:37] C:\Program Files\ Sun
[11/05/2007|10:02] C:\Program Files\ Teleflora
[02/03/2007|09:26] C:\Program Files\ TryMedia
[11/10/2008|09:54] C:\Program Files\ Uniblue
[08/16/2005|04:50] C:\Program Files\ Uninstall Information
[12/12/2005|10:33] C:\Program Files\ Viewpoint
[12/12/2005|10:35] C:\Program Files\ WebCyberCoach
[04/04/2008|12:17] C:\Program Files\ WildTangent
[11/04/2008|10:27] C:\Program Files\ Windows Media Connect 2
[03/06/2007|09:39] C:\Program Files\ Windows Media Player
[09/19/2008|08:10] C:\Program Files\ Windows NT
[08/16/2005|04:37] C:\Program Files\ Windows Plus
[08/16/2005|04:40] C:\Program Files\ WindowsUpdate
[08/16/2005|04:43] C:\Program Files\ xerox
[11/04/2008|10:38] C:\Program Files\ Yahoo!
[12/12/2005|10:32] C:\Program Files\ Your Company Name
[10/13/2008|02:31] C:\Program Files\ Zumie

——————–\\ Listing Folders in C:\Program Files\Common Files

[10/22/2007|01:27] C:\Program Files\Common Files\ Adobe
[08/28/2008|11:44] C:\Program Files\Common Files\ Adobe AIR
[12/11/2007|10:43] C:\Program Files\Common Files\ AnswerWorks 4.0
[07/15/2008|10:05] C:\Program Files\Common Files\ AOL
[09/11/2008|07:30] C:\Program Files\Common Files\ Apple
[11/09/2008|02:42] C:\Program Files\Common Files\ BitDefender
[12/12/2005|10:37] C:\Program Files\Common Files\ Corel
[12/12/2005|10:30] C:\Program Files\Common Files\ DESIGNER
[12/12/2005|10:35] C:\Program Files\Common Files\ InstallShield
[12/12/2005|10:34] C:\Program Files\Common Files\ Intuit
[12/12/2005|10:23] C:\Program Files\Common Files\ Java
[12/12/2005|10:30] C:\Program Files\Common Files\ L&H
[10/29/2008|01:55] C:\Program Files\Common Files\ Microsoft Shared
[08/16/2005|04:40] C:\Program Files\Common Files\ MSSoap
[10/09/2006|02:57] C:\Program Files\Common Files\ Napster Shared
[12/12/2005|10:33] C:\Program Files\Common Files\ Nullsoft
[08/16/2005|04:33] C:\Program Files\Common Files\ ODBC
[10/29/2008|12:09] C:\Program Files\Common Files\ Real
[11/04/2008|02:24] C:\Program Files\Common Files\ Scanner
[08/16/2005|04:40] C:\Program Files\Common Files\ Services
[08/16/2005|04:33] C:\Program Files\Common Files\ SpeechEngines
[11/15/2007|10:29] C:\Program Files\Common Files\ supportsoft
[11/08/2008|11:52] C:\Program Files\Common Files\ Symantec Shared
[09/19/2008|08:10] C:\Program Files\Common Files\ System
[07/09/2008|09:47] C:\Program Files\Common Files\ Wise Installation Wizard

——————–\\ Process

( 63 Processes )

IEXPLORE.EXE ~ [PID:5188]
iexplore.exe ~ [PID:2484]
iexplore.exe ~ [PID:3428]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\TOPSYW~1\Cookies\topsy_wright@advertising[2].txt

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-10 11:42:55
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job



[F:150][D:21]-> C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp
[F:151][D:0]-> C:\DOCUME~1\TOPSYW~1\Cookies
[F:5448][D:46]-> C:\DOCUME~1\TOPSYW~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 11/10/2008|11:44 - Option : [1]

——————–\\ Scan completed at 11:44:38
Thats fine, I thought something was missing

Do this

Please download the OTMoveIt3 by OldTimer or from here.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
    explorer.exe
    
    :Services
    
    :Reg
    
    :Files
    C:\WINDOWS\tasks\At*.job
    
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
——————–\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel® Pentium® D CPU 2.80GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
USER : Topsy Wright ( Administrator )
BOOT : Normal boot
Antivirus : AVG Anti-Virus Free 8.0 (Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:69 Go (Free:41 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Mon 11/10/2008|12:06 )

——————–\\ Listing folders in APPLIC~1

[08/16/2005|04:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Identities
[11/09/2008|03:24] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Microsoft
[12/12/2005|10:23] C:\DOCUME~1\ADMINI~1\APPLIC~1\ Sun

[10/13/2008|09:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[11/10/2008|09:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ {B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
[10/22/2007|01:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Adobe
[07/15/2008|10:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ AOL
[07/09/2007|02:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple
[04/05/2007|09:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Apple Computer
[11/09/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ avg8
[11/09/2008|02:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ BitDefender
[11/30/2007|06:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Dell
[08/16/2005|08:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ DIGStream
[11/06/2008|02:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Eastman Kodak Company
[09/14/2006|10:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google
[11/09/2008|01:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Google Updater
[12/12/2005|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ GTek
[12/15/2005|10:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ HotSync
[12/12/2005|10:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ InstallShield
[02/03/2006|01:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Intuit
[11/07/2008|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ kds_kodak
[11/06/2008|02:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Kodak
[07/09/2008|10:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Lavasoft
[11/04/2008|09:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Malwarebytes
[03/30/2007|03:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee
[12/15/2005|05:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ McAfee.com
[07/15/2008|10:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Microsoft
[09/24/2008|03:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ MSScanAppDataDir
[12/20/2005|11:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Napster
[08/12/2008|01:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Office Genuine Advantage
[12/12/2005|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ QuickTime
[11/15/2007|10:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ SupportSoft
[12/12/2005|10:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Viewpoint
[04/04/2008|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ WildTangent
[12/21/2005|04:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Windows Genuine Advantage
[10/13/2008|03:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Winferno
[07/06/2007|11:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ yahoo!
[12/19/2007|10:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ Yahoo! Companion

[08/16/2005|04:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Identities
[09/19/2008|09:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Macromedia
[12/12/2005|10:31] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Microsoft
[12/12/2005|10:23] C:\DOCUME~1\DEFAUL~1\APPLIC~1\ Sun

[03/17/2008|08:06] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Adobe
[03/17/2008|08:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Google
[02/13/2007|09:25] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Help
[12/16/2005|01:20] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Macromedia
[11/09/2008|03:24] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Microsoft
[03/17/2008|08:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\ Yahoo!

[11/05/2008|04:05] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Adobe
[11/09/2008|05:00] C:\DOCUME~1\NETWOR~1\APPLIC~1\ AVGTOOLBAR
[11/04/2008|02:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Google
[09/19/2008|12:26] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Macromedia
[11/09/2008|03:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Microsoft
[11/04/2008|02:24] C:\DOCUME~1\NETWOR~1\APPLIC~1\ Yahoo!

[10/13/2008|03:25] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Adobe
[11/29/2006|02:54] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ AdobeUM
[08/19/2008|01:02] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Apple Computer
[11/09/2008|03:31] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ AVGTOOLBAR
[11/09/2008|02:42] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ BitDefender
[12/19/2005|09:10] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Corel Photo Album
[03/17/2008|01:49] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Google
[04/10/2007|01:04] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Gtek
[12/15/2005|08:36] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Help
[12/15/2005|10:00] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ HotSync
[09/17/2008|12:08] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ ICAClient
[11/09/2006|04:28] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Identities
[07/09/2008|09:54] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Lavasoft
[12/15/2005|10:04] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Leadertech
[01/15/2008|11:43] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ LimeWire
[10/05/2008|12:09] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ LinkedIn
[02/12/2007|05:41] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Macromedia
[11/04/2008|09:24] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Malwarebytes
[11/03/2008|01:40] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Microsoft
[04/04/2008|12:10] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Mozilla
[10/29/2008|12:09] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Real
[03/07/2006|11:49] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Roxio
[11/05/2007|04:54] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Sonic
[12/12/2005|10:23] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Sun
[04/04/2008|12:11] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Talkback
[01/07/2008|04:00] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Uniblue
[03/10/2007|10:12] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ Viewpoint
[04/04/2008|12:15] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ WildTangent
[10/14/2008|05:14] C:\DOCUME~1\TOPSYW~1\APPLIC~1\ yahoo!

——————–\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/09/2008 02:30 PM][–a——] C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
[11/06/2008 01:05 PM][–a——] C:\WINDOWS\tasks\EasyShare Registration Task.job
[11/08/2008 11:00 PM][–a——] C:\WINDOWS\tasks\At74.job
[11/09/2008 08:00 PM][–a——] C:\WINDOWS\tasks\At71.job
[11/08/2008 10:00 PM][–a——] C:\WINDOWS\tasks\At73.job
[11/09/2008 09:00 PM][–a——] C:\WINDOWS\tasks\At72.job
[11/09/2008 07:00 PM][–a——] C:\WINDOWS\tasks\At70.job
[11/09/2008 06:00 PM][–a——] C:\WINDOWS\tasks\At69.job
[11/09/2008 05:00 PM][–a——] C:\WINDOWS\tasks\At68.job
[11/09/2008 02:00 PM][–a——] C:\WINDOWS\tasks\At65.job
[11/09/2008 04:00 PM][–a——] C:\WINDOWS\tasks\At67.job
[11/09/2008 03:00 PM][–a——] C:\WINDOWS\tasks\At66.job
[11/10/2008 10:00 AM][–a——] C:\WINDOWS\tasks\At61.job
[11/09/2008 01:00 PM][–a——] C:\WINDOWS\tasks\At64.job
[11/10/2008 12:00 PM][–a——] C:\WINDOWS\tasks\At63.job
[11/10/2008 11:00 AM][–a——] C:\WINDOWS\tasks\At62.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\At60.job
[11/09/2008 08:00 AM][–a——] C:\WINDOWS\tasks\At59.job
[11/09/2008 07:00 AM][–a——] C:\WINDOWS\tasks\At58.job
[11/09/2008 06:00 AM][–a——] C:\WINDOWS\tasks\At57.job
[11/09/2008 05:00 AM][–a——] C:\WINDOWS\tasks\At56.job
[11/09/2008 04:00 AM][–a——] C:\WINDOWS\tasks\At55.job
[11/09/2008 03:00 AM][–a——] C:\WINDOWS\tasks\At54.job
[11/09/2008 02:00 AM][–a——] C:\WINDOWS\tasks\At53.job
[11/09/2008 01:00 AM][–a——] C:\WINDOWS\tasks\At52.job
[11/09/2008 12:21 AM][–a——] C:\WINDOWS\tasks\At51.job
[11/08/2008 11:00 PM][–a——] C:\WINDOWS\tasks\At50.job
[11/08/2008 10:00 PM][–a——] C:\WINDOWS\tasks\At49.job
[11/09/2008 09:00 PM][–a——] C:\WINDOWS\tasks\At48.job
[11/09/2008 06:00 PM][–a——] C:\WINDOWS\tasks\At45.job
[11/09/2008 08:00 PM][–a——] C:\WINDOWS\tasks\At47.job
[11/09/2008 07:00 PM][–a——] C:\WINDOWS\tasks\At46.job
[11/09/2008 05:00 PM][–a——] C:\WINDOWS\tasks\At44.job
[11/09/2008 04:00 PM][–a——] C:\WINDOWS\tasks\At43.job
[11/09/2008 02:00 PM][–a——] C:\WINDOWS\tasks\At41.job
[11/09/2008 01:00 PM][–a——] C:\WINDOWS\tasks\At40.job
[11/09/2008 03:00 PM][–a——] C:\WINDOWS\tasks\At42.job
[11/10/2008 10:00 AM][–a——] C:\WINDOWS\tasks\At37.job
[11/10/2008 12:00 PM][–a——] C:\WINDOWS\tasks\At39.job
[11/10/2008 11:00 AM][–a——] C:\WINDOWS\tasks\At38.job
[11/09/2008 07:00 AM][–a——] C:\WINDOWS\tasks\At34.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\At36.job
[11/09/2008 08:00 AM][–a——] C:\WINDOWS\tasks\At35.job
[11/09/2008 04:00 AM][–a——] C:\WINDOWS\tasks\At31.job
[11/09/2008 06:00 AM][–a——] C:\WINDOWS\tasks\At33.job
[11/09/2008 05:00 AM][–a——] C:\WINDOWS\tasks\At32.job
[11/09/2008 03:00 AM][–a——] C:\WINDOWS\tasks\At30.job
[11/09/2008 01:00 AM][–a——] C:\WINDOWS\tasks\At28.job
[11/09/2008 02:00 AM][–a——] C:\WINDOWS\tasks\At29.job
[11/09/2008 12:18 AM][–a——] C:\WINDOWS\tasks\At27.job
[11/08/2008 10:00 PM][–a——] C:\WINDOWS\tasks\At25.job
[11/08/2008 11:00 PM][–a——] C:\WINDOWS\tasks\At26.job
[11/09/2008 07:00 PM][–a——] C:\WINDOWS\tasks\At22.job
[11/09/2008 08:00 PM][–a——] C:\WINDOWS\tasks\At23.job
[11/09/2008 09:00 PM][–a——] C:\WINDOWS\tasks\At24.job
[11/09/2008 05:00 PM][–a——] C:\WINDOWS\tasks\At20.job
[11/09/2008 06:00 PM][–a——] C:\WINDOWS\tasks\At21.job
[11/09/2008 02:00 PM][–a——] C:\WINDOWS\tasks\At17.job
[11/09/2008 04:00 PM][–a——] C:\WINDOWS\tasks\At19.job
[11/09/2008 03:00 PM][–a——] C:\WINDOWS\tasks\At18.job
[11/10/2008 11:00 AM][–a——] C:\WINDOWS\tasks\At14.job
[11/09/2008 01:00 PM][–a——] C:\WINDOWS\tasks\At16.job
[11/10/2008 12:00 PM][–a——] C:\WINDOWS\tasks\At15.job
[11/09/2008 08:00 AM][–a——] C:\WINDOWS\tasks\At11.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\At12.job
[11/10/2008 10:00 AM][–a——] C:\WINDOWS\tasks\At13.job
[11/09/2008 06:00 AM][–a——] C:\WINDOWS\tasks\At9.job
[11/09/2008 05:00 AM][–a——] C:\WINDOWS\tasks\At8.job
[11/09/2008 07:00 AM][–a——] C:\WINDOWS\tasks\At10.job
[11/09/2008 04:00 AM][–a——] C:\WINDOWS\tasks\At7.job
[11/09/2008 03:00 AM][–a——] C:\WINDOWS\tasks\At6.job
[11/09/2008 01:00 AM][–a——] C:\WINDOWS\tasks\At4.job
[11/09/2008 02:00 AM][–a——] C:\WINDOWS\tasks\At5.job
[11/09/2008 12:48 AM][–a——] C:\WINDOWS\tasks\At3.job
[11/10/2008 09:00 AM][–a——] C:\WINDOWS\tasks\rpc.job
[11/08/2008 02:37 PM][–a——] C:\WINDOWS\tasks\At2.job
[11/06/2008 09:02 PM][–a——] C:\WINDOWS\tasks\At1.job
[11/10/2008 08:26 AM][–a——] C:\WINDOWS\tasks\RegCure Program Check.job
[10/30/2008 07:29 AM][–a——] C:\WINDOWS\tasks\RegCure.job
[10/30/2008 07:09 AM][–a——] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/10/2008 08:26 AM][–ah—–] C:\WINDOWS\tasks\SA.DAT
[08/10/2004 05:00 AM][-r-h—–] C:\WINDOWS\tasks\desktop.ini

——————–\\ Listing Folders in C:\Program Files

[10/13/2008|02:32] C:\Program Files\ 7-Zip
[08/28/2008|11:44] C:\Program Files\ Adobe
[08/19/2008|10:49] C:\Program Files\ Apple Software Update
[11/09/2008|03:26] C:\Program Files\ AVG
[11/06/2008|10:06] C:\Program Files\ BitDefender
[09/11/2008|07:30] C:\Program Files\ Bonjour
[11/06/2008|10:04] C:\Program Files\ Common Files
[08/16/2005|04:38] C:\Program Files\ ComPlus Applications
[12/12/2005|10:11] C:\Program Files\ CONEXANT
[12/12/2005|10:37] C:\Program Files\ Corel
[11/03/2008|01:43] C:\Program Files\ Coupons
[12/12/2005|10:28] C:\Program Files\ CyberLink
[12/15/2005|09:14] C:\Program Files\ Dell
[11/15/2007|10:29] C:\Program Files\ Dell Support Center
[04/10/2007|12:43] C:\Program Files\ DellSupport
[12/12/2005|10:28] C:\Program Files\ Digital Line Detect
[12/19/2006|11:29] C:\Program Files\ Digonex
[05/07/2008|09:28] C:\Program Files\ DIGStream
[12/12/2005|10:33] C:\Program Files\ EarthLink Setup
[08/16/2005|08:51] C:\Program Files\ EnglishOtto
[08/16/2005|08:54] C:\Program Files\ ESPNMotion
[11/24/2007|02:06] C:\Program Files\ GemMaster
[09/19/2008|09:56] C:\Program Files\ Google
[05/06/2008|04:03] C:\Program Files\ Grisoft
[11/10/2008|10:51] C:\Program Files\ Hijackthis
[11/09/2008|08:47] C:\Program Files\ InstallShield Installation Information
[12/12/2005|10:27] C:\Program Files\ Intel
[10/16/2008|02:03] C:\Program Files\ Internet Explorer
[12/12/2005|10:33] C:\Program Files\ Intuit
[10/13/2008|09:36] C:\Program Files\ iPod
[11/07/2008|06:55] C:\Program Files\ iTunes
[10/29/2008|11:36] C:\Program Files\ Java
[11/06/2008|02:23] C:\Program Files\ Kodak
[07/09/2008|09:54] C:\Program Files\ Lavasoft
[11/10/2008|10:40] C:\Program Files\ Malwarebytes' Anti-Malware
[09/19/2008|08:19] C:\Program Files\ Messenger
[12/12/2005|10:30] C:\Program Files\ Microsoft ActiveSync
[05/05/2006|08:18] C:\Program Files\ Microsoft AntiSpyware
[10/29/2008|01:54] C:\Program Files\ Microsoft CAPICOM 2.1.0.2
[08/16/2005|04:43] C:\Program Files\ microsoft frontpage
[12/12/2005|10:30] C:\Program Files\ Microsoft Office
[12/12/2005|10:32] C:\Program Files\ Microsoft Plus! Digital Media Edition
[12/12/2005|10:32] C:\Program Files\ Microsoft Plus! Photo Story 2 LE
[10/29/2008|12:54] C:\Program Files\ Microsoft Silverlight
[12/12/2005|10:30] C:\Program Files\ Microsoft Visual Studio
[12/12/2005|10:40] C:\Program Files\ Microsoft Works
[12/12/2005|10:29] C:\Program Files\ Microsoft.NET
[12/12/2005|10:28] C:\Program Files\ Modem Helper
[09/19/2008|08:14] C:\Program Files\ Movie Maker
[07/15/2008|01:30] C:\Program Files\ Mozilla Firefox
[12/22/2005|09:18] C:\Program Files\ MSN
[08/16/2005|04:37] C:\Program Files\ MSN Gaming Zone
[11/17/2006|03:01] C:\Program Files\ MSXML 4.0
[01/09/2008|10:46] C:\Program Files\ MUSICMATCH
[11/09/2008|08:47] C:\Program Files\ Napster
[09/19/2008|08:10] C:\Program Files\ NetMeeting
[12/12/2005|10:28] C:\Program Files\ NetWaiting
[12/12/2005|10:31] C:\Program Files\ NetZeroInstallers
[09/19/2008|12:26] C:\Program Files\ Norton PC Checkup
[08/16/2005|04:38] C:\Program Files\ Online Services
[09/19/2008|08:10] C:\Program Files\ Outlook Express
[12/16/2005|03:50] C:\Program Files\ palmOne
[07/15/2008|10:08] C:\Program Files\ PopCap Games
[09/11/2008|07:30] C:\Program Files\ QuickTime
[12/12/2005|10:33] C:\Program Files\ Real
[11/06/2007|03:50] C:\Program Files\ RegCure
[08/16/2005|08:58] C:\Program Files\ RGB
[11/05/2007|10:02] C:\Program Files\ Seagate Software
[12/12/2005|10:25] C:\Program Files\ Sigmatel
[11/05/2008|06:42] C:\Program Files\ SpyHeal
[10/29/2008|11:37] C:\Program Files\ Sun
[11/05/2007|10:02] C:\Program Files\ Teleflora
[02/03/2007|09:26] C:\Program Files\ TryMedia
[11/10/2008|09:54] C:\Program Files\ Uniblue
[08/16/2005|04:50] C:\Program Files\ Uninstall Information
[12/12/2005|10:33] C:\Program Files\ Viewpoint
[12/12/2005|10:35] C:\Program Files\ WebCyberCoach
[04/04/2008|12:17] C:\Program Files\ WildTangent
[11/04/2008|10:27] C:\Program Files\ Windows Media Connect 2
[03/06/2007|09:39] C:\Program Files\ Windows Media Player
[09/19/2008|08:10] C:\Program Files\ Windows NT
[08/16/2005|04:37] C:\Program Files\ Windows Plus
[08/16/2005|04:40] C:\Program Files\ WindowsUpdate
[08/16/2005|04:43] C:\Program Files\ xerox
[11/04/2008|10:38] C:\Program Files\ Yahoo!
[12/12/2005|10:32] C:\Program Files\ Your Company Name
[10/13/2008|02:31] C:\Program Files\ Zumie

——————–\\ Listing Folders in C:\Program Files\Common Files

[10/22/2007|01:27] C:\Program Files\Common Files\ Adobe
[08/28/2008|11:44] C:\Program Files\Common Files\ Adobe AIR
[12/11/2007|10:43] C:\Program Files\Common Files\ AnswerWorks 4.0
[07/15/2008|10:05] C:\Program Files\Common Files\ AOL
[09/11/2008|07:30] C:\Program Files\Common Files\ Apple
[11/09/2008|02:42] C:\Program Files\Common Files\ BitDefender
[12/12/2005|10:37] C:\Program Files\Common Files\ Corel
[12/12/2005|10:30] C:\Program Files\Common Files\ DESIGNER
[12/12/2005|10:35] C:\Program Files\Common Files\ InstallShield
[12/12/2005|10:34] C:\Program Files\Common Files\ Intuit
[12/12/2005|10:23] C:\Program Files\Common Files\ Java
[12/12/2005|10:30] C:\Program Files\Common Files\ L&H
[10/29/2008|01:55] C:\Program Files\Common Files\ Microsoft Shared
[08/16/2005|04:40] C:\Program Files\Common Files\ MSSoap
[10/09/2006|02:57] C:\Program Files\Common Files\ Napster Shared
[12/12/2005|10:33] C:\Program Files\Common Files\ Nullsoft
[08/16/2005|04:33] C:\Program Files\Common Files\ ODBC
[10/29/2008|12:09] C:\Program Files\Common Files\ Real
[11/04/2008|02:24] C:\Program Files\Common Files\ Scanner
[08/16/2005|04:40] C:\Program Files\Common Files\ Services
[08/16/2005|04:33] C:\Program Files\Common Files\ SpeechEngines
[11/15/2007|10:29] C:\Program Files\Common Files\ supportsoft
[11/08/2008|11:52] C:\Program Files\Common Files\ Symantec Shared
[09/19/2008|08:10] C:\Program Files\Common Files\ System
[07/09/2008|09:47] C:\Program Files\Common Files\ Wise Installation Wizard

——————–\\ Process

( 63 Processes )

IEXPLORE.EXE ~ [PID:5188]
iexplore.exe ~ [PID:2484]
iexplore.exe ~ [PID:3428]

——————–\\ Searching with S_Lop

No Lop folder found !

——————–\\ Searching for Lop Files - Folders

C:\DOCUME~1\TOPSYW~1\Cookies\topsy_wright@advertising[2].txt

——————–\\ Searching within the Registry

….. OK !

——————–\\ Checking the Hosts file

Hosts file CLEAN


——————–\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-10 12:09:54
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden files: 0

——————–\\ Searching for other infections

C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job



[F:150][D:21]-> C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp
[F:151][D:0]-> C:\DOCUME~1\TOPSYW~1\Cookies
[F:5451][D:46]-> C:\DOCUME~1\TOPSYW~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Mon 11/10/2008|11:44 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - Mon 11/10/2008|12:12 - Option : [1]

——————–\\ Scan completed at 12:12:02
========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\WINDOWS\tasks\At1.job moved successfully. C:\WINDOWS\tasks\At10.job moved successfully. C:\WINDOWS\tasks\At11.job moved successfully. C:\WINDOWS\tasks\At12.job moved successfully. C:\WINDOWS\tasks\At13.job moved successfully. C:\WINDOWS\tasks\At14.job moved successfully. C:\WINDOWS\tasks\At15.job moved successfully. C:\WINDOWS\tasks\At16.job moved successfully. C:\WINDOWS\tasks\At17.job moved successfully. C:\WINDOWS\tasks\At18.job moved successfully. C:\WINDOWS\tasks\At19.job moved successfully. C:\WINDOWS\tasks\At2.job moved successfully. C:\WINDOWS\tasks\At20.job moved successfully. C:\WINDOWS\tasks\At21.job moved successfully. C:\WINDOWS\tasks\At22.job moved successfully. C:\WINDOWS\tasks\At23.job moved successfully. C:\WINDOWS\tasks\At24.job moved successfully. C:\WINDOWS\tasks\At25.job moved successfully. C:\WINDOWS\tasks\At26.job moved successfully. C:\WINDOWS\tasks\At27.job moved successfully. C:\WINDOWS\tasks\At28.job moved successfully. C:\WINDOWS\tasks\At29.job moved successfully. C:\WINDOWS\tasks\At3.job moved successfully. C:\WINDOWS\tasks\At30.job moved successfully. C:\WINDOWS\tasks\At31.job moved successfully. C:\WINDOWS\tasks\At32.job moved successfully. C:\WINDOWS\tasks\At33.job moved successfully. C:\WINDOWS\tasks\At34.job moved successfully. C:\WINDOWS\tasks\At35.job moved successfully. C:\WINDOWS\tasks\At36.job moved successfully. C:\WINDOWS\tasks\At37.job moved successfully. C:\WINDOWS\tasks\At38.job moved successfully. C:\WINDOWS\tasks\At39.job moved successfully. C:\WINDOWS\tasks\At4.job moved successfully. C:\WINDOWS\tasks\At40.job moved successfully. C:\WINDOWS\tasks\At41.job moved successfully. C:\WINDOWS\tasks\At42.job moved successfully. C:\WINDOWS\tasks\At43.job moved successfully. C:\WINDOWS\tasks\At44.job moved successfully. C:\WINDOWS\tasks\At45.job moved successfully. C:\WINDOWS\tasks\At46.job moved successfully. C:\WINDOWS\tasks\At47.job moved successfully. C:\WINDOWS\tasks\At48.job moved successfully. C:\WINDOWS\tasks\At49.job moved successfully. C:\WINDOWS\tasks\At5.job moved successfully. C:\WINDOWS\tasks\At50.job moved successfully. C:\WINDOWS\tasks\At51.job moved successfully. C:\WINDOWS\tasks\At52.job moved successfully. C:\WINDOWS\tasks\At53.job moved successfully. C:\WINDOWS\tasks\At54.job moved successfully. C:\WINDOWS\tasks\At55.job moved successfully. C:\WINDOWS\tasks\At56.job moved successfully. C:\WINDOWS\tasks\At57.job moved successfully. C:\WINDOWS\tasks\At58.job moved successfully. C:\WINDOWS\tasks\At59.job moved successfully. C:\WINDOWS\tasks\At6.job moved successfully. C:\WINDOWS\tasks\At60.job moved successfully. C:\WINDOWS\tasks\At61.job moved successfully. C:\WINDOWS\tasks\At62.job moved successfully. C:\WINDOWS\tasks\At63.job moved successfully. C:\WINDOWS\tasks\At64.job moved successfully. C:\WINDOWS\tasks\At65.job moved successfully. C:\WINDOWS\tasks\At66.job moved successfully. C:\WINDOWS\tasks\At67.job moved successfully. C:\WINDOWS\tasks\At68.job moved successfully. C:\WINDOWS\tasks\At69.job moved successfully. C:\WINDOWS\tasks\At7.job moved successfully. C:\WINDOWS\tasks\At70.job moved successfully. C:\WINDOWS\tasks\At71.job moved successfully. C:\WINDOWS\tasks\At72.job moved successfully. C:\WINDOWS\tasks\At73.job moved successfully. C:\WINDOWS\tasks\At74.job moved successfully. C:\WINDOWS\tasks\At8.job moved successfully. C:\WINDOWS\tasks\At9.job moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\Perflib_Perfdata_1254.dat scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DF1364.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DF7F21.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DFB939.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\AcrC.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_5b0.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\~DF6D1B.tmp scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11102008_122151 Files moved on Reboot… File C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\Perflib_Perfdata_1254.dat not found! C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DF1364.tmp moved successfully. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DF7F21.tmp moved successfully. File C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DFB939.tmp not found! File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. C:\WINDOWS\temp\AcrC.tmp moved successfully. C:\WINDOWS\temp\Perflib_Perfdata_5b0.dat moved successfully. C:\WINDOWS\temp\~DF6D1B.tmp moved successfully.
Hello

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
log.txt results:

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-11-10 12:36:35
Microsoft Windows XP Professional Service Pack 3
System drive C: has 43 GB (60%) free of 71 GB
Total RAM: 2046 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:58 PM, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\notepad.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Documents and Settings\Topsy Wright\Desktop\RSIT.exe
C:\Program Files\trend micro\Topsy Wright.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\IntCodec\isaddon.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
O2 - BHO: (no name) - {577a1314-91d1-4fba-addd-1d1576ff90f1} - C:\WINDOWS\system32\tizelazi.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [P3000x_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [CPMb381c931] Rundll32.exe "c:\windows\system32\kugatugi.dll",a
O4 - HKLM\..\Run: [sopafupoda] Rundll32.exe "C:\WINDOWS\system32\zubewudi.dll",s
O4 - HKLM\..\Run: [BDWizReg] "C:\Program Files\BitDefender\BitDefender 2009\bdwizreg.exe" /complete
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-19\..\Run: [sopafupoda] Rundll32.exe "C:\WINDOWS\system32\zubewudi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'Default user')
O8 - Extra context menu item: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS; - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\pomukuhe.dll,c:\windows\system32\kugatugi.dll,avgrsstx.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

–
End of file - 12989 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\EasyShare Registration Task.job
C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
C:\WINDOWS\tasks\RegCure Program Check.job
C:\WINDOWS\tasks\RegCure.job
C:\WINDOWS\tasks\rpc.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
&Yahoo;! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll [2007-09-05 816400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1da7dbe8-c51b-4ae4-bc6e-21863349b0b4}]
C:\Program Files\IntCodec\isaddon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-11-09 455960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}]
C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{577a1314-91d1-4fba-addd-1d1576ff90f1}]
C:\WINDOWS\system32\tizelazi.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 198136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-11-09 2055960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll [2008-10-10 652784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll [2007-09-05 816400]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google; - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392]
{0BF43445-2F28-4351-9252-17FE6E806AA0}
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2008-08-13 90112]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-11-09 2055960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-10-07 111856]
"DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2008-08-13 206064]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-09-29 67584]
"SigmatelSysTrayApp"=C:\WINDOWS\stsystra.exe [2005-03-23 339968]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2005-06-17 139264]
"ISUSPM Startup"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2005-06-10 249856]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-06-10 81920]
"P3000x_S2P"=C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe [2004-10-27 57344]
"DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2005-02-23 53248]
"dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2007-10-09 16384]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]
"MMTray"=C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe []
"EKIJ5000StatusMonitor"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe [2008-02-15 1052672]
"CPMb381c931"=c:\windows\system32\kugatugi.dll [2008-11-09 92212]
"sopafupoda"=C:\WINDOWS\system32\zubewudi.dll []
"BDWizReg"=C:\Program Files\BitDefender\BitDefender 2009\bdwizreg.exe [2008-09-30 839680]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2008-09-26 716800]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2008-08-10 69632]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-09 1234712]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-18 68856]
"DellSupport"=C:\Program Files\DellSupport\DSAgnt.exe [2007-03-15 460784]
"Search Protection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [2007-03-09 63712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [2006-02-09 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NapsterShell]
C:\Program Files\Napster\napster.exe /systray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2005-10-24 307200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-12-17 3810544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\WINDOWS\system32\pomukuhe.dll,c:\windows\system32\kugatugi.dll,avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll [2008-11-09 92212]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
{874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak
STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll [2008-11-09 92212]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\WINDOWS\system32\pomukuhe.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\GameHouse\TextTwist\TextTwist.exe"="C:\Program Files\GameHouse\TextTwist\TextTwist.exe:*:Enabled:Super TextTwist"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"
"C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui"
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon"
"C:\Program Files\AVG\AVG8\avgrsx.exe"="C:\Program Files\AVG\AVG8\avgrsx.exe:*:Enabled:avgrsx"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Disabled:Internet Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
shell\AutoRun\command - E:\setup.exe


======List of files/folders created in the last 1 months======

2008-11-10 12:36:36 —-D—- C:\Program Files\trend micro
2008-11-10 12:36:35 —-D—- C:\rsit
2008-11-10 12:21:51 —-D—- C:\_OTMoveIt
2008-11-10 11:39:45 —-A—- C:\lopR.txt
2008-11-10 11:38:38 —-D—- C:\Lop SD
2008-11-10 10:49:34 —-D—- C:\Program Files\Hijackthis
2008-11-10 09:53:51 —-HDC—- C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-11-09 15:26:41 —-A—- C:\WINDOWS\system32\avgrsstx.dll
2008-11-09 15:26:35 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\AVGTOOLBAR
2008-11-09 15:26:27 —-D—- C:\Program Files\AVG
2008-11-09 15:14:54 —-A—- C:\WINDOWS\system32\J64GaLky.exe_
2008-11-09 15:14:54 —-A—- C:\WINDOWS\system32\J64GaLky.exe
2008-11-09 14:42:30 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\BitDefender
2008-11-09 14:42:00 —-D—- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-11-09 08:33:01 —-SH—- C:\WINDOWS\system32\azuvutir.ini
2008-11-08 20:33:57 —-SH—- C:\WINDOWS\system32\ipifegan.ini
2008-11-08 08:34:37 —-SH—- C:\WINDOWS\system32\owewajup.ini
2008-11-07 13:25:35 —-SH—- C:\WINDOWS\system32\ibamodiy.ini
2008-11-07 09:56:20 —-D—- C:\Documents and Settings\All Users\Application Data\kds_kodak
2008-11-06 15:21:23 —-A—- C:\WINDOWS\system32\EKDeviceServices.dll
2008-11-06 14:31:48 —-D—- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company
2008-11-06 14:23:30 —-A—- C:\WINDOWS\system32\EKIJ5000MON.dll
2008-11-06 12:52:00 —-D—- C:\Program Files\Kodak
2008-11-06 12:26:45 —-D—- C:\Documents and Settings\All Users\Application Data\Kodak
2008-11-06 12:07:04 —-D—- C:\WINDOWS\system32\kodak
2008-11-06 12:07:00 —-A—- C:\WINDOWS\system32\wiafbdrv.dll
2008-11-06 10:04:41 —-D—- C:\Program Files\Common Files\BitDefender
2008-11-06 08:49:23 —-A—- C:\WINDOWS\bdagent.INI
2008-11-05 18:11:31 —-D—- C:\Program Files\BitDefender
2008-11-05 17:08:37 —-D—- C:\WINDOWS\BDOSCAN8
2008-11-05 15:15:11 —-A—- C:\WINDOWS\system32\J64GaLky.exe.a_a
2008-11-04 14:24:04 —-D—- C:\Program Files\Common Files\Scanner
2008-11-04 10:26:29 —-A—- C:\WINDOWS\system32\CF27613.exe
2008-11-04 10:17:24 —-A—- C:\WINDOWS\system32\CF25830.exe
2008-11-04 10:05:48 —-A—- C:\WINDOWS\system32\CF23560.exe
2008-11-04 09:59:01 —-A—- C:\WINDOWS\system32\CF22228.exe
2008-11-04 09:56:38 —-A—- C:\WINDOWS\system32\CF21761.exe
2008-11-04 09:56:36 —-A—- C:\Bug.txt
2008-11-04 09:24:20 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\Malwarebytes
2008-11-04 09:24:15 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-01 16:43:04 —-A—- C:\WINDOWS\system32\hn578EHV.exe
2008-10-30 16:43:00 —-D—- C:\Program Files\Coupons
2008-10-29 13:55:05 —-SHD—- C:\Config.Msi
2008-10-29 13:54:16 —-D—- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-10-29 12:59:37 —-A—- C:\WINDOWS\system32\muweb.dll
2008-10-29 12:59:37 —-A—- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-29 12:59:37 —-A—- C:\WINDOWS\system32\mucltui.dll
2008-10-29 12:54:22 —-D—- C:\Program Files\Microsoft Silverlight
2008-10-29 11:37:07 —-D—- C:\Program Files\Sun
2008-10-29 11:36:51 —-A—- C:\WINDOWS\system32\javaws.exe
2008-10-29 11:36:51 —-A—- C:\WINDOWS\system32\javaw.exe
2008-10-29 11:36:50 —-A—- C:\WINDOWS\system32\java.exe
2008-10-24 02:00:26 —-HDC—- C:\WINDOWS\$NtUninstallKB958644$
2008-10-16 02:03:35 —-HDC—- C:\WINDOWS\$NtUninstallKB956803$
2008-10-16 02:03:29 —-HDC—- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 02:03:23 —-HDC—- C:\WINDOWS\$NtUninstallKB957095$
2008-10-16 02:02:49 —-HDC—- C:\WINDOWS\$NtUninstallKB954211$
2008-10-16 02:02:27 —-HDC—- C:\WINDOWS\$NtUninstallKB956841$
2008-10-13 15:26:30 —-D—- C:\Documents and Settings\All Users\Application Data\Winferno
2008-10-13 14:32:22 —-D—- C:\Program Files\7-Zip
2008-10-13 14:31:17 —-D—- C:\Program Files\Zumie
2008-10-13 09:36:41 —-D—- C:\Program Files\iPod
2008-10-13 09:36:38 —-D—- C:\Program Files\iTunes
2008-10-13 09:36:38 —-D—- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

======List of files/folders modified in the last 1 months======

2008-11-10 12:36:58 —-D—- C:\WINDOWS\Temp
2008-11-10 12:36:36 —-AD—- C:\Program Files
2008-11-10 12:36:24 —-D—- C:\WINDOWS\Prefetch
2008-11-10 12:29:09 —-A—- C:\WINDOWS\win.ini
2008-11-10 12:25:47 —-A—- C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt
2008-11-10 12:25:42 —-D—- C:\WINDOWS
2008-11-10 12:24:13 —-D—- C:\WINDOWS\Registration
2008-11-10 12:22:51 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-11-10 12:21:52 —-SD—- C:\WINDOWS\Tasks
2008-11-10 11:20:13 —-D—- C:\WINDOWS\system32
2008-11-10 11:20:11 —-HD—- C:\$AVG8.VAULT$
2008-11-10 10:53:21 —-D—- C:\WINDOWS\system32\CatRoot2
2008-11-10 10:40:35 —-SHD—- C:\WINDOWS\Installer
2008-11-10 10:40:35 —-D—- C:\WINDOWS\system32\drivers
2008-11-10 09:54:30 —-D—- C:\Program Files\Uniblue
2008-11-09 15:26:27 —-D—- C:\Documents and Settings\All Users\Application Data\avg8
2008-11-09 13:46:06 —-D—- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-11-09 08:47:51 —-D—- C:\Program Files\Napster
2008-11-09 08:47:47 —-HD—- C:\Program Files\InstallShield Installation Information
2008-11-09 08:32:59 —-N—- C:\WINDOWS\system32\rituvuza.dll
2008-11-09 08:32:59 —-ASH—- C:\WINDOWS\system32\kugatugi.dll
2008-11-08 20:33:54 —-N—- C:\WINDOWS\system32\nagefipi.dll
2008-11-08 20:33:54 —-ASH—- C:\WINDOWS\system32\heduvehe.dll
2008-11-08 12:16:47 —-A—- C:\WINDOWS\system32\DEBUG_LOG.txt
2008-11-08 11:52:06 —-D—- C:\Program Files\Common Files\Symantec Shared
2008-11-08 08:34:34 —-N—- C:\WINDOWS\system32\pujawewo.dll
2008-11-08 08:34:34 —-ASH—- C:\WINDOWS\system32\yatodimi.dll
2008-11-07 17:44:41 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-07 13:25:37 —-ASH—- C:\WINDOWS\system32\metedoyi.dll
2008-11-07 13:25:32 —-N—- C:\WINDOWS\system32\yidomabi.dll
2008-11-06 15:21:27 —-RSD—- C:\WINDOWS\assembly
2008-11-06 15:16:05 —-D—- C:\WINDOWS\Microsoft.NET
2008-11-06 14:24:07 —-RSHD—- C:\WINDOWS\system32\dllcache
2008-11-06 14:24:01 —-D—- C:\WINDOWS\system32\ReinstallBackups
2008-11-06 14:23:58 —-HD—- C:\WINDOWS\inf
2008-11-06 14:23:58 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-11-06 14:23:54 —-D—- C:\WINDOWS\twain_32
2008-11-06 14:23:49 —-D—- C:\WINDOWS\system32\FxsTmp
2008-11-06 14:21:02 —-D—- C:\WINDOWS\WinSxS
2008-11-06 10:04:41 —-D—- C:\Program Files\Common Files
2008-11-05 18:42:24 —-D—- C:\Program Files\SpyHeal
2008-11-05 17:08:40 —-SD—- C:\WINDOWS\Downloaded Program Files
2008-11-04 14:23:48 —-SHD—- C:\RECYCLER
2008-11-04 10:38:33 —-D—- C:\Program Files\Yahoo!
2008-11-04 10:27:03 —-D—- C:\Program Files\Windows Media Connect 2
2008-11-03 16:18:39 —-A—- C:\WINDOWS\system.ini
2008-11-03 13:47:42 —-A—- C:\WINDOWS\wininit.ini
2008-11-03 13:40:28 —-SD—- C:\Documents and Settings\Topsy Wright\Application Data\Microsoft
2008-11-03 13:33:19 —-D—- C:\WINDOWS\pss
2008-10-31 08:20:58 —-D—- C:\WINDOWS\system32\wbem
2008-10-29 13:55:46 —-RSD—- C:\WINDOWS\Fonts
2008-10-29 13:55:12 —-D—- C:\Program Files\Common Files\Microsoft Shared
2008-10-29 13:24:02 —-D—- C:\WINDOWS\system32\CatRoot
2008-10-29 12:09:51 —-D—- C:\Program Files\Common Files\Real
2008-10-29 12:09:38 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\Real
2008-10-29 11:36:50 —-D—- C:\Program Files\Java
2008-10-24 02:00:16 —-HD—- C:\WINDOWS\$hf_mig$
2008-10-20 19:39:46 —-A—- C:\WINDOWS\cdplayer.ini
2008-10-16 02:03:38 —-A—- C:\WINDOWS\imsins.BAK
2008-10-16 02:03:12 —-D—- C:\Program Files\Internet Explorer
2008-10-16 02:03:02 —-D—- C:\WINDOWS\ie7updates
2008-10-15 10:34:24 —-A—- C:\WINDOWS\system32\netapi32.dll
2008-10-14 17:14:18 —-RHD—- C:\Documents and Settings\Topsy Wright\Application Data\yahoo!
2008-10-13 15:25:36 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-11-09 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-11-09 26824]
R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2007-07-09 2432]
R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2007-07-09 2560]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R2 dsunidrv;DellSupport UniDriver; C:\WINDOWS\system32\DRIVERS\dsunidrv.sys [2007-02-25 5376]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 DSproct;DSproct; \??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys []
R3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2005-03-31 180736]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2003-11-17 1042432]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2003-11-17 212224]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 RSC4_A02;U.S. Robotics Wireless USB Adapter Driver; C:\WINDOWS\system32\DRIVERS\RSC4USB.sys [2004-08-11 380160]
R3 STHDA;High Definition Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2005-06-14 180864]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2003-11-17 680704]
S3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2008-08-12 108864]
S3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-08-12 228672]
S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
S3 E100B;Intel® PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2005-12-15 16694]
S3 SMC2862W;SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter Driver; C:\WINDOWS\system32\DRIVERS\2862WICB.sys [2005-06-28 349856]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-09 611664]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-11-09 231704]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-10 168432]
R2 IAANTMon;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe [2005-06-17 86140]
R2 KodakSvc;Kodak AiO Device Service; C:\Program Files\Kodak\printer\center\KodakSvc.exe [2008-02-28 18944]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-08-13 201968]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 DSBrokerService;DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [2007-03-07 76848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2004-11-19 147456]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\wmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

—————–EOF—————–

info.txt results:

info.txt logfile of random's system information tool 1.04 2008-11-10 12:37:02

======Uninstall list======

–>MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095}
–>MsiExec.exe /I{F543B12A-13F5-487E-9314-F7D25E1BBE3E}
–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E6BF946C-C6A8-4799-A9C7-7EC6EBD79992}\Setup.exe" /L9 remove
–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.57–>"C:\Program Files\7-Zip\Uninstall.exe"
Acrobat.com–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com–>MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Ad-Aware–>MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe AIR–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR–>MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0.7–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
Adobe Shockwave Player–>C:\WINDOWS\system32\Adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
Adobe® Photoshop® Album Starter Edition 3.2–>MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
aiofw–>MsiExec.exe /I{791E3D44-33D3-4446-82AD-5CD4B0169083}
aioocr–>MsiExec.exe /I{3BED0238-3A25-41AE-BC23-316914B5B048}
aioprnt–>MsiExec.exe /I{2A97D5B3-A989-47E1-B207-1CA9E3635655}
aioscnnr–>MsiExec.exe /I{C0251585-1BE8-4278-B3CB-964B6E01C59D}
AOLIcon–>MsiExec.exe /I{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}
Apple Mobile Device Support–>MsiExec.exe /I{976C2B2A-CE59-4AB3-83FB-BF895E28F2E6}
Apple Software Update–>MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI Display Driver–>rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG Free 8.0–>C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
BitDefender Antivirus 2009–>MsiExec.exe /X{71C7B5A3-D3D9-433D-A6AF-D255822CF4A0}
Bonjour–>MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
center–>MsiExec.exe /I{79E41D91-BA1C-44B9-9358-48E598263ECF}
Conexant D850 56K V.9x DFVc Modem–>C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_14F1&DEV;_2F20&SUBSYS;_200F14F1\HXFSETUP.EXE -U -Idel200fk.inf
Corel Photo Album 6–>MsiExec.exe /X{8A9B8148-DDD7-448F-BD6C-358386D32354}
Dell Digital Jukebox Driver–>C:\Program Files\Dell\Digital Jukebox Drivers\DrvUnins.exe /s
Dell Driver Reset Tool–>MsiExec.exe /I{5905F42D-3F5F-4916-ADA6-94A3646AEE76}
Dell Support Center (Support Software)–>MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
DellSupport–>MsiExec.exe /X{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}
Digital Content Portal–>MsiExec.exe /I{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}
Digital Line Detect–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanelAnyText
EarthLink setup files–>MsiExec.exe /X{728278A1-0BB7-45E4-AC5E-91D7C0FD1EDE}
EducateU–>MsiExec.exe /I{A683A2C0-821C-486F-858C-FA634DB5E864}
ESPNMotion–>C:\PROGRA~1\ESPNMO~1\UNWISE.EXE /u C:\PROGRA~1\ESPNMO~1\INSTALL.LOG
Google Earth–>MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer–>regsvr32 /u /s "c:\program files\google\googletoolbar4.dll"
Google Updater–>"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Help_CTR–>MsiExec.exe /I{0996C331-6DCB-4E38-A3EC-0A77ABAE1361}
helptut–>MsiExec.exe /I{843081BD-351F-46FC-8A17-517A0D9117A3}
helpug–>MsiExec.exe /I{DC626A21-EDF1-40C7-8F2F-D2BA7535529F}
High Definition Audio Driver Package - KB835221–>C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
Hijackthis 1.99.1–>"C:\Program Files\Hijackthis\unins000.exe"
HijackThis 2.0.2–>"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 10 (KB903157)–>"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel Matrix Storage Manager–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}\setup.exe" -l0409 -INTELUNINST
Intel® PRO Network Connections Drivers–>Prounstl.exe
Intel® PROSet for Wired Connections–>MsiExec.exe /I{4CEA6811-DFAD-4892-828D-49941FE3B779}
Internet Explorer Default Page–>MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395}
iTunes–>MsiExec.exe /I{DDDE0BE3-0CBE-4BF6-B75A-E3F69C947843}
J2SE Runtime Environment 5.0 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150070}
Java 2 Runtime Environment, SE v1.4.2_03–>MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
KODAK All-in-One Printer Software–>C:\Documents and Settings\All Users\Application Data\Kodak\EasyShareSetup\$SETUP_1e0002_103e88f\Setup.exe /APR-REMOVE
ksdip–>MsiExec.exe /I{73F1681F-ADE1-461F-9F18-B7640507D395}
Macromedia Flash Player–>MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c}
MCU–>MsiExec.exe /I{D2988E9B-C73F-422C-AD4B-A66EBE257120}
Microsoft .NET Framework 1.1 Hotfix (KB928366)–>"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1–>msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1–>MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0–>C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Basic Edition 2003–>MsiExec.exe /I{91130409-6000-11D3-8CFE-0150048383C9}
Microsoft Plus! Digital Media Edition Installer–>MsiExec.exe /X{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}
Microsoft Plus! Photo Story 2 LE–>MsiExec.exe /X{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}
Microsoft Silverlight–>MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MobileMe Control Panel–>MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
Modem Helper–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
MSN–>C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB927978)–>MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MyWay Search Assistant–>MsiExec.exe /X{E7559288-223B-453C-9F06-340E3BE21E39}
Nabit–>MsiExec.exe /I{4D730327-AC6F-42D3-8FF4-A079F84D0D93}
Napster for Windows Media Player–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CF2606C7-63AF-40F4-8919-F2EC654ACC91}\setup.exe" -l0x9
netbrdg–>MsiExec.exe /I{4537EA4B-F603-4181-89FB-2953FC695AB1}
NetWaiting–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanelAnyText
NetZeroInstallers–>MsiExec.exe /X{352310C3-E46B-42D3-8F32-54721FDD72D9}
Norton PC Checkup–>C:\Program Files\Norton PC Checkup\uninstall.exe
OpenOffice.org Installer 1.0–>MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
Otto–>"C:\Program Files\EnglishOtto\uninstallotto.exe"
palmOne–>MsiExec.exe /X{FF24F097-D090-41D2-8E9C-BAFEBBFD938C}
PowerDVD 5.5–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
QuickBooks Pro 2005–>msiexec.exe /I {F543B12A-13F5-487E-9314-F7D25E1BBE3E} UNIQUE_NAME="pro" QBFULLNAME="QuickBooks Pro 2005" ADDREMOVE=1
QuickTime–>MsiExec.exe /I{8DC42D05-680B-41B0-8878-6C14D24602DB}
RegCure 1.3.0.2–>C:\Program Files\RegCure\uninst.exe
Security Update for CAPICOM (KB931906)–>MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)–>MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB939653)–>"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB942615)–>"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)–>"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB911565)–>"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Security Update for Windows Media Player 10 (KB917734)–>"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)–>"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)–>"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)–>"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)–>"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)–>"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)–>"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
SFR–>MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}
Sonic Encoders–>MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
Teleflora Pricing–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5EF8FED7-61A5-4170-8587-791678AFA585}\setup.exe"
Uniblue RegistryBooster 2–>"C:\Program Files\Uniblue\RegistryBooster 2\unins000.exe"
Uniblue RegistryBooster 2009–>"C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE
Uniblue RegistryBooster 2009–>C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}\Uniblue RegistryBooster.exe
Update for Windows Media Player 10 (KB910393)–>"C:\WINDOWS\$NtUninstallKB910393$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB913800)–>"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
Update for Windows Media Player 10 (KB926251)–>"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)–>"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update Rollup 2 for Windows XP Media Center Edition 2005–>C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
Viewpoint Media Player–>C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
WebCyberCoach 3.2 Dell–>"C:\Program Files\WebCyberCoach\b_Dell\WCC_Wipe.exe" "WebCyberCoach ext\wtrb" /inf "engine.inf,RealUninstallSection,,4" /infcfg "enginecf.inf,RealUninstallSection,,4"
Windows Defender Signatures–>MsiExec.exe /I{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}
Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 10 Hotfix - KB895316–>"C:\WINDOWS\$NtUninstallKB895316$\spuninst\spuninst.exe"
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]–>C:\WINDOWS\$NtUninstallEmeraldQFE2$\spuninst\spuninst.exe
Windows Media Player 10–>MsiExec.exe /I{33BB4982-DC52-4886-A03B-F4C5C80BEE89}
Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB908246–>"C:\WINDOWS\$NtUninstallKB908246$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB925766–>"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
Windows XP Service Pack 3–>"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Yahoo! Anti-Spy–>C:\PROGRA~1\Yahoo!\Common\unypsr.exe
Yahoo! Browser Services–>C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
Yahoo! Browser Services–>C:\PROGRA~1\Yahoo!\Common\unyext.exe
Yahoo! Install Manager–>C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Internet Mail–>C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\YMMAPI.dll
Yahoo! Messenger–>C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Photos Easy Upload Tool 1v7–>C:\WINDOWS\system32\regsvr32 /u /s "C:\WINDOWS\cache\YDropper.dll"
Yahoo! Search Protection–>C:\PROGRA~1\Yahoo!\SEARCH~1\UNINST~1.EXE
Yahoo! Toolbar–>C:\PROGRA~1\Yahoo!\Common\unyt.exe

======Security center information======

AV: AVG Anti-Virus Free

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0404
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre1.5.0_07\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.5.0_07\lib\ext\QTJava.zip
"KDS_LANGUAGE"=13

—————–EOF—————–
Hello

Please click on Start > Control Panel > Add/Remove Programs and uninstall the following programs(if present):

MyWay Search Assistant



1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: (no name) - {1da7dbe8-c51b-4ae4-bc6e-21863349b0b4} - C:\Program Files\IntCodec\isaddon.dll (file missing)
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
O2 - BHO: (no name) - {577a1314-91d1-4fba-addd-1d1576ff90f1} - C:\WINDOWS\system32\tizelazi.dll (file missing)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [CPMb381c931] Rundll32.exe "c:\windows\system32\kugatugi.dll",a
O4 - HKLM\..\Run: [sopafupoda] Rundll32.exe "C:\WINDOWS\system32\zubewudi.dll",s
O4 - HKUS\S-1-5-19\..\Run: [sopafupoda] Rundll32.exe "C:\WINDOWS\system32\zubewudi.dll",s (User 'LOCAL SERVICE')
O20 - AppInit_DLLs: C:\WINDOWS\system32\pomukuhe.dll,c:\windows\system32\kugatugi.dll,avgrsstx.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll


2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.




Please download the OTMoveIt3 by OldTimer or from here.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
    explorer.exe
    
    :Services
    
    :Reg
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
    "notification packages"=scecli
    
    :files
    C:\WINDOWS\system32\J64GaLky.exe_
    C:\WINDOWS\system32\J64GaLky.exe
    C:\WINDOWS\system32\azuvutir.ini
    C:\WINDOWS\system32\ipifegan.ini
    C:\WINDOWS\system32\owewajup.ini
    C:\WINDOWS\system32\ibamodiy.ini
    C:\WINDOWS\system32\J64GaLky.exe.a_a
    C:\WINDOWS\system32\hn578EHV.exe
    C:\Program Files\Coupons
    
    
    
    :Commands
    [purity]
    [emptytemp]
    [start explorer]
    [Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Also post a new Rsit log
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\"notification packages"|scecli /E : value set successfully!
========== FILES ==========
C:\WINDOWS\system32\J64GaLky.exe_ moved successfully.
C:\WINDOWS\system32\J64GaLky.exe moved successfully.
C:\WINDOWS\system32\azuvutir.ini moved successfully.
C:\WINDOWS\system32\ipifegan.ini moved successfully.
C:\WINDOWS\system32\owewajup.ini moved successfully.
C:\WINDOWS\system32\ibamodiy.ini moved successfully.
C:\WINDOWS\system32\J64GaLky.exe.a_a moved successfully.
C:\WINDOWS\system32\hn578EHV.exe moved successfully.
C:\Program Files\Coupons moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DF57C3.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DFCFC2.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11102008_125718

Files moved on Reboot…
C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DF57C3.tmp moved successfully.
File C:\DOCUME~1\TOPSYW~1\LOCALS~1\Temp\~DFCFC2.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

rsit:

Logfile of random's system information tool 1.04 (written by random/random)
Run by [removed] at 2008-11-10 13:03:27
Microsoft Windows XP Professional Service Pack 3
System drive C: has 43 GB (60%) free of 71 GB
Total RAM: 2046 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:03:46 PM, on 11/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\BitDefender\BitDefender 2009\bdwizreg.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Documents and Settings\Topsy Wright\Desktop\RSIT.exe
C:\Program Files\trend micro\Topsy Wright.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [P3000x_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [BDWizReg] "C:\Program Files\BitDefender\BitDefender 2009\bdwizreg.exe" /complete
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CPMb381c931] Rundll32.exe "c:\windows\system32\kugatugi.dll",a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKUS\S-1-5-19\..\Run: [sopafupoda] Rundll32.exe "C:\WINDOWS\system32\zubewudi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe (User 'Default user')
O8 - Extra context menu item: &Yahoo;! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary; - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps; - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS; - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\windows\system32\kugatugi.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll
O22 - SharedTaskScheduler: {874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

–
End of file - 12358 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\EasyShare Registration Task.job
C:\WINDOWS\tasks\Kodak AiO Scheduled Maintenance.job
C:\WINDOWS\tasks\RegCure Program Check.job
C:\WINDOWS\tasks\RegCure.job
C:\WINDOWS\tasks\rpc.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
&Yahoo;! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll [2007-09-05 816400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 63128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-11-09 455960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 198136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-11-09 2055960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll [2008-10-10 652784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn3\yt.dll [2007-09-05 816400]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google; - c:\program files\google\googletoolbar4.dll [2007-01-19 2403392]
{381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2008-08-13 90112]
{A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2008-11-09 2055960]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"YSearchProtection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-10-07 111856]
"DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2008-08-13 206064]
"ehTray"=C:\WINDOWS\ehome\ehtray.exe [2005-09-29 67584]
"SigmatelSysTrayApp"=C:\WINDOWS\stsystra.exe [2005-03-23 339968]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2005-06-17 139264]
"ISUSPM Startup"=C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [2005-06-10 249856]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-06-10 81920]
"P3000x_S2P"=C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe [2004-10-27 57344]
"DVDLauncher"=C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [2005-02-23 53248]
"dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2007-10-09 16384]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-09-06 413696]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-10-01 289576]
"MMTray"=C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe []
"EKIJ5000StatusMonitor"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe [2008-02-15 1052672]
"BDWizReg"=C:\Program Files\BitDefender\BitDefender 2009\bdwizreg.exe [2008-09-30 839680]
"BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2008-09-26 716800]
"BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2008-08-10 69632]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-09 1234712]
"CPMb381c931"=c:\windows\system32\kugatugi.dll [2008-11-09 92212]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-18 68856]
"DellSupport"=C:\Program Files\DellSupport\DSAgnt.exe [2007-03-15 460784]
"Search Protection"=C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [2007-03-09 63712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [2006-02-09 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NapsterShell]
C:\Program Files\Napster\napster.exe /systray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2005-10-24 307200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2007-12-17 3810544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="c:\windows\system32\kugatugi.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll [2008-11-09 92212]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler]
{874443fe-aa33-4ebf-a6ac-73208787e62d} - bestreak
STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kugatugi.dll [2008-11-09 92212]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\Yahoo!\Messenger\YPager.exe"="C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\Program Files\GameHouse\TextTwist\TextTwist.exe"="C:\Program Files\GameHouse\TextTwist\TextTwist.exe:*:Enabled:Super TextTwist"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\WINDOWS\explorer.exe"="C:\WINDOWS\explorer.exe:*:Enabled:Explorer"
"C:\WINDOWS\system32\logonui.exe"="C:\WINDOWS\system32\logonui.exe:*:Enabled:logonui"
"C:\WINDOWS\system32\winlogon.exe"="C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon"
"C:\Program Files\AVG\AVG8\avgrsx.exe"="C:\Program Files\AVG\AVG8\avgrsx.exe:*:Enabled:avgrsx"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Disabled:Internet Explorer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
"C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\Program Files\MSN Messenger\msncall.exe"="C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
shell\AutoRun\command - E:\setup.exe


======List of files/folders created in the last 1 months======

2008-11-10 12:36:36 —-D—- C:\Program Files\trend micro
2008-11-10 12:36:35 —-D—- C:\rsit
2008-11-10 12:21:51 —-D—- C:\_OTMoveIt
2008-11-10 11:39:45 —-A—- C:\lopR.txt
2008-11-10 11:38:38 —-D—- C:\Lop SD
2008-11-10 10:49:34 —-D—- C:\Program Files\Hijackthis
2008-11-10 09:53:51 —-HDC—- C:\Documents and Settings\All Users\Application Data\{B46E1EF5-0B37-4DB4-A4E2-9F2B41036185}
2008-11-09 15:26:41 —-A—- C:\WINDOWS\system32\avgrsstx.dll
2008-11-09 15:26:35 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\AVGTOOLBAR
2008-11-09 15:26:27 —-D—- C:\Program Files\AVG
2008-11-09 14:42:30 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\BitDefender
2008-11-09 14:42:00 —-D—- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-11-07 09:56:20 —-D—- C:\Documents and Settings\All Users\Application Data\kds_kodak
2008-11-06 15:21:23 —-A—- C:\WINDOWS\system32\EKDeviceServices.dll
2008-11-06 14:31:48 —-D—- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company
2008-11-06 14:23:30 —-A—- C:\WINDOWS\system32\EKIJ5000MON.dll
2008-11-06 12:52:00 —-D—- C:\Program Files\Kodak
2008-11-06 12:26:45 —-D—- C:\Documents and Settings\All Users\Application Data\Kodak
2008-11-06 12:07:04 —-D—- C:\WINDOWS\system32\kodak
2008-11-06 12:07:00 —-A—- C:\WINDOWS\system32\wiafbdrv.dll
2008-11-06 10:04:41 —-D—- C:\Program Files\Common Files\BitDefender
2008-11-06 08:49:23 —-A—- C:\WINDOWS\bdagent.INI
2008-11-05 18:11:31 —-D—- C:\Program Files\BitDefender
2008-11-05 17:08:37 —-D—- C:\WINDOWS\BDOSCAN8
2008-11-04 14:24:04 —-D—- C:\Program Files\Common Files\Scanner
2008-11-04 10:26:29 —-A—- C:\WINDOWS\system32\CF27613.exe
2008-11-04 10:17:24 —-A—- C:\WINDOWS\system32\CF25830.exe
2008-11-04 10:05:48 —-A—- C:\WINDOWS\system32\CF23560.exe
2008-11-04 09:59:01 —-A—- C:\WINDOWS\system32\CF22228.exe
2008-11-04 09:56:38 —-A—- C:\WINDOWS\system32\CF21761.exe
2008-11-04 09:56:36 —-A—- C:\Bug.txt
2008-11-04 09:24:20 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\Malwarebytes
2008-11-04 09:24:15 —-D—- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-29 13:55:05 —-SHD—- C:\Config.Msi
2008-10-29 13:54:16 —-D—- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-10-29 12:59:37 —-A—- C:\WINDOWS\system32\muweb.dll
2008-10-29 12:59:37 —-A—- C:\WINDOWS\system32\mucltui.dll.mui
2008-10-29 12:59:37 —-A—- C:\WINDOWS\system32\mucltui.dll
2008-10-29 12:54:22 —-D—- C:\Program Files\Microsoft Silverlight
2008-10-29 11:37:07 —-D—- C:\Program Files\Sun
2008-10-29 11:36:51 —-A—- C:\WINDOWS\system32\javaws.exe
2008-10-29 11:36:51 —-A—- C:\WINDOWS\system32\javaw.exe
2008-10-29 11:36:50 —-A—- C:\WINDOWS\system32\java.exe
2008-10-24 02:00:26 —-HDC—- C:\WINDOWS\$NtUninstallKB958644$
2008-10-16 02:03:35 —-HDC—- C:\WINDOWS\$NtUninstallKB956803$
2008-10-16 02:03:29 —-HDC—- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 02:03:23 —-HDC—- C:\WINDOWS\$NtUninstallKB957095$
2008-10-16 02:02:49 —-HDC—- C:\WINDOWS\$NtUninstallKB954211$
2008-10-16 02:02:27 —-HDC—- C:\WINDOWS\$NtUninstallKB956841$
2008-10-13 15:26:30 —-D—- C:\Documents and Settings\All Users\Application Data\Winferno
2008-10-13 14:32:22 —-D—- C:\Program Files\7-Zip
2008-10-13 14:31:17 —-D—- C:\Program Files\Zumie
2008-10-13 09:36:41 —-D—- C:\Program Files\iPod
2008-10-13 09:36:38 —-D—- C:\Program Files\iTunes
2008-10-13 09:36:38 —-D—- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

======List of files/folders modified in the last 1 months======

2008-11-10 13:03:46 —-D—- C:\WINDOWS\Temp
2008-11-10 13:01:11 —-A—- C:\WINDOWS\win.ini
2008-11-10 13:00:57 —-D—- C:\WINDOWS\Prefetch
2008-11-10 13:00:54 —-A—- C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt
2008-11-10 13:00:47 —-D—- C:\WINDOWS
2008-11-10 12:58:59 —-D—- C:\WINDOWS\Registration
2008-11-10 12:57:38 —-A—- C:\WINDOWS\SchedLgU.Txt
2008-11-10 12:57:21 —-D—- C:\WINDOWS\system32
2008-11-10 12:57:21 —-AD—- C:\Program Files
2008-11-10 12:46:53 —-SHD—- C:\WINDOWS\Installer
2008-11-10 12:21:52 —-SD—- C:\WINDOWS\Tasks
2008-11-10 11:20:11 —-HD—- C:\$AVG8.VAULT$
2008-11-10 10:53:21 —-D—- C:\WINDOWS\system32\CatRoot2
2008-11-10 10:40:35 —-D—- C:\WINDOWS\system32\drivers
2008-11-10 09:54:30 —-D—- C:\Program Files\Uniblue
2008-11-09 15:26:27 —-D—- C:\Documents and Settings\All Users\Application Data\avg8
2008-11-09 13:46:06 —-D—- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-11-09 08:47:51 —-D—- C:\Program Files\Napster
2008-11-09 08:47:47 —-HD—- C:\Program Files\InstallShield Installation Information
2008-11-09 08:32:59 —-N—- C:\WINDOWS\system32\rituvuza.dll
2008-11-09 08:32:59 —-ASH—- C:\WINDOWS\system32\kugatugi.dll
2008-11-08 20:33:54 —-N—- C:\WINDOWS\system32\nagefipi.dll
2008-11-08 20:33:54 —-ASH—- C:\WINDOWS\system32\heduvehe.dll
2008-11-08 12:16:47 —-A—- C:\WINDOWS\system32\DEBUG_LOG.txt
2008-11-08 11:52:06 —-D—- C:\Program Files\Common Files\Symantec Shared
2008-11-08 08:34:34 —-N—- C:\WINDOWS\system32\pujawewo.dll
2008-11-08 08:34:34 —-ASH—- C:\WINDOWS\system32\yatodimi.dll
2008-11-07 17:44:41 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-07 13:25:37 —-ASH—- C:\WINDOWS\system32\metedoyi.dll
2008-11-07 13:25:32 —-N—- C:\WINDOWS\system32\yidomabi.dll
2008-11-06 15:21:27 —-RSD—- C:\WINDOWS\assembly
2008-11-06 15:16:05 —-D—- C:\WINDOWS\Microsoft.NET
2008-11-06 14:24:07 —-RSHD—- C:\WINDOWS\system32\dllcache
2008-11-06 14:24:01 —-D—- C:\WINDOWS\system32\ReinstallBackups
2008-11-06 14:23:58 —-HD—- C:\WINDOWS\inf
2008-11-06 14:23:58 —-DC—- C:\WINDOWS\system32\DRVSTORE
2008-11-06 14:23:54 —-D—- C:\WINDOWS\twain_32
2008-11-06 14:23:49 —-D—- C:\WINDOWS\system32\FxsTmp
2008-11-06 14:21:02 —-D—- C:\WINDOWS\WinSxS
2008-11-06 10:04:41 —-D—- C:\Program Files\Common Files
2008-11-05 18:42:24 —-D—- C:\Program Files\SpyHeal
2008-11-05 17:08:40 —-SD—- C:\WINDOWS\Downloaded Program Files
2008-11-04 14:23:48 —-SHD—- C:\RECYCLER
2008-11-04 10:38:33 —-D—- C:\Program Files\Yahoo!
2008-11-04 10:27:03 —-D—- C:\Program Files\Windows Media Connect 2
2008-11-03 16:18:39 —-A—- C:\WINDOWS\system.ini
2008-11-03 13:47:42 —-A—- C:\WINDOWS\wininit.ini
2008-11-03 13:40:28 —-SD—- C:\Documents and Settings\Topsy Wright\Application Data\Microsoft
2008-11-03 13:33:19 —-D—- C:\WINDOWS\pss
2008-10-31 08:20:58 —-D—- C:\WINDOWS\system32\wbem
2008-10-29 13:55:46 —-RSD—- C:\WINDOWS\Fonts
2008-10-29 13:55:12 —-D—- C:\Program Files\Common Files\Microsoft Shared
2008-10-29 13:24:02 —-D—- C:\WINDOWS\system32\CatRoot
2008-10-29 12:09:51 —-D—- C:\Program Files\Common Files\Real
2008-10-29 12:09:38 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\Real
2008-10-29 11:36:50 —-D—- C:\Program Files\Java
2008-10-24 02:00:16 —-HD—- C:\WINDOWS\$hf_mig$
2008-10-20 19:39:46 —-A—- C:\WINDOWS\cdplayer.ini
2008-10-16 02:03:38 —-A—- C:\WINDOWS\imsins.BAK
2008-10-16 02:03:12 —-D—- C:\Program Files\Internet Explorer
2008-10-16 02:03:02 —-D—- C:\WINDOWS\ie7updates
2008-10-15 10:34:24 —-A—- C:\WINDOWS\system32\netapi32.dll
2008-10-14 17:14:18 —-RHD—- C:\Documents and Settings\Topsy Wright\Application Data\yahoo!
2008-10-13 15:25:36 —-D—- C:\Documents and Settings\Topsy Wright\Application Data\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-11-09 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-11-09 26824]
R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2007-07-09 2432]
R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2007-07-09 2560]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R2 dsunidrv;DellSupport UniDriver; C:\WINDOWS\system32\DRIVERS\dsunidrv.sys [2007-02-25 5376]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2003-04-09 11043]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
R3 DSproct;DSproct; \??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys []
R3 e1express;Intel® PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2005-03-31 180736]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 HSF_DP;HSF_DP; C:\WINDOWS\system32\DRIVERS\HSF_DP.sys [2003-11-17 1042432]
R3 HSFHWBS2;HSFHWBS2; C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys [2003-11-17 212224]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 RSC4_A02;U.S. Robotics Wireless USB Adapter Driver; C:\WINDOWS\system32\DRIVERS\RSC4USB.sys [2004-08-11 380160]
R3 STHDA;High Definition Audio Driver (WDM) - SigmaTel CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2005-06-14 180864]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2003-11-17 680704]
S3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2008-08-12 108864]
S3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2008-08-12 228672]
S3 bvrp_pci;bvrp_pci; C:\WINDOWS\system32\drivers\bvrp_pci.sys []
S3 E100B;Intel® PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 PalmUSBD;PalmUSBD; C:\WINDOWS\system32\drivers\PalmUSBD.sys [2005-12-15 16694]
S3 SMC2862W;SMC2862W-G EZ Connect g 2.4Ghz 802.11g Wireless USB 2.0 Adapter Driver; C:\WINDOWS\system32\DRIVERS\2862WICB.sys [2005-06-28 349856]
S3 SONYPVU1;Sony USB Filter Driver (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]
S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-09 611664]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-10-01 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2005-08-04 380928]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-11-09 231704]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-10 168432]
R2 IAANTMon;Intel® Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe [2005-06-17 86140]
R2 KodakSvc;Kodak AiO Device Service; C:\Program Files\Kodak\printer\center\KodakSvc.exe [2008-02-28 18944]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-08-13 201968]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-10-01 536872]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 DSBrokerService;DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [2007-03-07 76848]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
S3 NetSvc;Intel NCS NetService; C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe [2004-11-19 147456]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\wmpnetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

—————–EOF—————–

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI