What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Autoit.NOP Worm

26 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I have been running a programme on my pc for the best part of a year but when I went to open it today 2 instances of the above worm were flagged by avg resident shield alert. I clicked on heal but one of the instances remained in avg, said it couldn't be healed. I removed the programme from my pc through the programmes own uninstall option. While working on other things the resident shield threw up another alert with the same worm in a system restore point. The process name and process id are as follows: Process Name: C:\WINDOWS\System32\svchost.exe & Process ID: 1732. I looked in Windows\System32 for svchost.exe but couldn't find it. I believe individual system restore points can't be deleted, so would the best remedy be to go into system restore and switch off system restore on all drives. I think this deletes all restore points, but it might be better to be rid of this worm. On clicking on more info on the resident shield, no reference could be found for the virus. I googled it but no reference was found. I still have the resident shield alert up as I don't know whether I should try to heal it again or move it to the vault, if either. Thankyou for reading and in advance for any help offered. If any more information is required, please ask. hedley
Post #2
Hello and welcome to Posted Image

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.
Post #3
Hello hedley93

Please DO NOT turn off system restore at this time until we can diagnose what is infecting your computer. An infected restore point is better than no restore point at all.


Please download RSIT by random/random and save it to your Desktop.
  • Double click on RSIT.exe to run it.
  • Before you click "Continue", make sure you change the List files/folders created or modified to: in the last 3 months
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open - log.txt (<info.txt (<


  • Please post the contents of both log.txt and info.txt in your next reply.
Post #4
Hi Catbyte, thanks for the reply and the help. The following are the two logs you asked for:

Logfile of random's system information tool 1.05 (written by random/random)
Run by [removed] at 2009-01-25 14:52:58
Microsoft Windows XP Professional Service Pack 2
System drive C: has 12 GB (31%) free of 39 GB
Total RAM: 2047 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:53:38, on 25/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\StkASv2K.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Andrea\Desktop\RSIT.exe
C:\Program Files\trend micro\Andrea.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{1290A33C-85F5-4164-A1BE-7DD299D4986A}] "C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero BackItUp 4\NBKeyScan.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Nero MediaHome 4] "C:\Program Files\Nero\Nero MediaHome 4\NeroMediaHome.exe" /AUTORUN
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-746137067-1482476501-725345543-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NeroMediaHomeUser.4')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Nero MediaHome 4 Service (NeroMediaHomeService.4) - Nero AG - C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Syntek STK1160 Service (StkASSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkASv2K.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 12231 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\NeroLiveEpgUpdate-ANDREA-9WSYO6HI_Andrea.job
C:\WINDOWS\tasks\Uniblue SpyEraser Nag.job
C:\WINDOWS\tasks\Uniblue SpyEraser.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2005-12-07 399424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2008-08-30 455960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
UberButton Class - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2005-05-26 181352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{65D886A2-7CA7-479B-BB95-14D1EFB7946A}]
YahooTaggedBM Class - C:\Program Files\Yahoo!\Common\YIeTagBm.dll [2005-01-24 115832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-21 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CB65201-89C4-402c-BA80-02D8C59F9B1D}]
Ask Search Assistant BHO - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL [2009-01-03 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-21 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-21 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D}]
SidebarAutoLaunch Class - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll [2005-02-03 124032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}]
Ask Toolbar BHO - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2005-12-07 399424]
{FE063DB9-4EC0-403e-8DD8-394C54984B2C} - Ask Toolbar - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-09-12 16264192]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-09-17 13574144]
"nwiz"=nwiz.exe /install []
"Lexmark X1100 Series"=C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe [2003-08-19 57344]
"YBrowser"=C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe [2003-12-09 57344]
"UVS10 Preload"=C:\Program Files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe [2006-08-09 36864]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
"TrueImageMonitor.exe"=C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [2006-10-16 1164912]
"AcronisTimounterMonitor"=C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe [2006-10-16 1941784]
"Acronis Scheduler2 Service"=C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [2006-10-16 87584]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2008-11-27 1261336]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2008-05-27 413696]
"{1290A33C-85F5-4164-A1BE-7DD299D4986A}"=C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe [2004-06-08 69721]
"mmtask"=c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe [2003-10-10 53248]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-06-29 32768]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-21 136600]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-09-17 86016]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2008-12-16 1797880]
"KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k []
"NBKeyScan"=C:\Program Files\Nero\Nero BackItUp 4\NBKeyScan.exe [2008-08-29 2254120]
"REGSHAVE"=C:\Program Files\REGSHAVE\REGSHAVE.EXE [2002-02-04 53248]
"Nero MediaHome 4"=C:\Program Files\Nero\Nero MediaHome 4\NeroMediaHome.exe [2008-08-29 3622184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2004-10-13 1694208]
"Power2GoExpress"= []
"PowerBar"= []
"Eraser"=C:\Program Files\Eraser\eraser.exe [2006-12-26 643072]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-01-20 1830128]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
ExifLauncher2.lnk - C:\Program Files\FinePixViewer\QuickDCF2.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll C:\WINDOWS\system32\guard32.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 241704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=157

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\ypager.exe"="C:\Program Files\Yahoo!\Messenger\ypager.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe"="C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe:*:Enabled:Java™ Platform SE binary"
"C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe"="C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe:*:Enabled:Nero MediaHome 4"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java™ Platform SE binary"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.reg - open - regedit.exe "%1" %*

======List of files/folders created in the last 3 months======

2009-01-25 14:53:12 —-D—- C:\Program Files\trend micro
2009-01-25 14:52:58 —-D—- C:\rsit
2009-01-24 15:26:14 —-D—- C:\Documents and Settings\Andrea\Application Data\AVS4YOU
2009-01-24 15:26:14 —-D—- C:\Documents and Settings\All Users\Application Data\AVS4YOU
2009-01-24 15:18:22 —-D—- C:\Program Files\Common Files\AVSMedia
2009-01-24 15:18:17 —-A—- C:\WINDOWS\system32\msvcp70.dll
2009-01-24 15:18:17 —-A—- C:\WINDOWS\system32\mfc70.dll
2009-01-24 15:17:59 —-A—- C:\WINDOWS\system32\GdiPlus.dll
2009-01-24 15:17:54 —-D—- C:\Program Files\AVS4YOU
2009-01-22 15:27:07 —-D—- C:\WINDOWS\system32\GroupPolicy
2009-01-22 15:27:07 —-D—- C:\Program Files\Windows Desktop Search
2009-01-22 15:23:41 —-DC—- C:\WINDOWS\$NtUninstallKB940157$
2009-01-22 15:19:30 —-DC—- C:\WINDOWS\$NtUninstallKB915800-v4$
2009-01-22 15:18:46 —-DC—- C:\WINDOWS\$NtUninstallKB925876$
2009-01-22 15:18:38 —-D—- C:\WINDOWS\network diagnostic
2009-01-22 15:18:36 —-DC—- C:\WINDOWS\$NtUninstallKB914440$
2009-01-22 15:18:29 —-DC—- C:\WINDOWS\$NtUninstallKB904942$
2009-01-22 15:18:20 —-DC—- C:\WINDOWS\$NtUninstallbasecsp$
2009-01-22 15:18:13 —-DC—- C:\WINDOWS\$NtUninstallKB943460$(2)
2009-01-22 15:18:00 —-DC—- C:\WINDOWS\$NtUninstallKB896344$
2009-01-14 15:40:33 —-D—- C:\Program Files\Common Files\Wise Installation Wizard
2009-01-14 15:23:04 —-HDC—- C:\WINDOWS\$NtUninstallKB958687$
2009-01-10 14:44:48 —-A—- C:\WINDOWS\wininit.ini
2009-01-05 01:10:26 —-D—- C:\Program Files\MSXML 6.0
2009-01-05 01:10:12 —-HDC—- C:\WINDOWS\$NtUninstallKB925720$
2009-01-04 20:28:05 —-N—- C:\WINDOWS\system32\setupsvc.dll
2009-01-04 20:28:05 —-N—- C:\WINDOWS\system32\GenSvcInst.exe
2009-01-04 20:28:05 —-N—- C:\WINDOWS\system32\bgsvcgen.exe
2009-01-04 20:27:59 —-D—- C:\Program Files\PIXELA
2009-01-04 20:25:55 —-D—- C:\Documents and Settings\Andrea\Application Data\FUJIFILM
2009-01-04 20:24:59 —-A—- C:\WINDOWS\system32\FFTIFF16.dll
2009-01-04 20:24:59 —-A—- C:\WINDOWS\system32\FFRafShellEx.dll
2009-01-04 20:24:58 —-A—- C:\WINDOWS\system32\FFRAFLIB.DLL
2009-01-04 20:24:54 —-D—- C:\Program Files\FinePixViewer
2009-01-04 20:23:48 —-D—- C:\Documents and Settings\Andrea\Application Data\InstallShield
2009-01-04 20:23:32 —-N—- C:\WINDOWS\system32\FINFCOPY.dll
2009-01-04 20:23:32 —-N—- C:\WINDOWS\system32\FINFCHECK.dll
2009-01-04 20:23:32 —-D—- C:\Program Files\REGSHAVE
2009-01-04 20:23:31 —-N—- C:\WINDOWS\system32\FREGSHEX.DLL
2009-01-04 20:23:31 —-N—- C:\WINDOWS\system32\FCLKBTN.DLL
2009-01-03 17:02:13 —-D—- C:\Documents and Settings\Andrea\Application Data\Nero
2009-01-03 16:45:42 —-D—- C:\Program Files\AskTBar
2009-01-03 15:45:36 —-A—- C:\WINDOWS\Irremote.ini
2009-01-03 15:39:11 —-D—- C:\Program Files\Windows Sidebar
2009-01-03 14:59:21 —-D—- C:\Program Files\Nero
2009-01-03 14:58:54 —-D—- C:\Documents and Settings\All Users\Application Data\Nero
2009-01-03 14:57:13 —-D—- C:\Program Files\MSBuild
2009-01-03 14:55:48 —-D—- C:\WINDOWS\system32\XPSViewer
2009-01-03 14:54:57 —-D—- C:\Program Files\Reference Assemblies
2009-01-03 14:54:27 —-N—- C:\WINDOWS\system32\spmsg2.dll
2009-01-03 14:50:33 —-HDC—- C:\WINDOWS\$NtUninstallWIC$
2009-01-03 14:49:15 —-A—- C:\WINDOWS\system32\d3dx9_30.dll
2008-12-21 18:55:35 —-A—- C:\WINDOWS\system32\javaws.exe
2008-12-21 18:55:35 —-A—- C:\WINDOWS\system32\javaw.exe
2008-12-21 18:55:35 —-A—- C:\WINDOWS\system32\java.exe
2008-12-21 18:55:35 —-A—- C:\WINDOWS\system32\deploytk.dll
2008-12-16 15:40:38 —-D—- C:\Documents and Settings\All Users\Application Data\comodo
2008-12-16 15:40:38 —-A—- C:\WINDOWS\system32\guard32.dll
2008-12-11 11:30:27 —-HDC—- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-11 11:30:20 —-HDC—- C:\WINDOWS\$NtUninstallKB955839$
2008-12-11 11:29:26 —-HDC—- C:\WINDOWS\$NtUninstallKB954600$
2008-12-11 11:29:16 —-HDC—- C:\WINDOWS\$NtUninstallKB956802$
2008-11-27 11:03:44 —-D—- C:\fsaua.data
2008-11-22 14:55:17 —-D—- C:\Program Files\File Shredder
2008-11-13 01:03:29 —-HDC—- C:\WINDOWS\$NtUninstallKB957097$
2008-11-13 01:03:19 —-HDC—- C:\WINDOWS\$NtUninstallKB955069$
2008-10-30 11:23:55 —-D—- C:\Program Files\CCleaner

======List of files/folders modified in the last 3 months======

2009-01-25 14:53:38 —-D—- C:\WINDOWS\Temp
2009-01-25 14:53:12 —-RD—- C:\Program Files
2009-01-25 14:52:49 —-D—- C:\WINDOWS\Prefetch
2009-01-24 22:02:43 —-HD—- C:\$AVG8.VAULT$
2009-01-24 17:18:52 —-D—- C:\Program Files\IVCsoft
2009-01-24 16:49:17 —-D—- C:\WINDOWS\system32\CatRoot2
2009-01-24 15:48:10 —-D—- C:\WINDOWS
2009-01-24 15:30:32 —-SD—- C:\WINDOWS\Tasks
2009-01-24 15:26:06 —-D—- C:\WINDOWS\system32
2009-01-24 15:25:41 —-N—- C:\WINDOWS\SchedLgU.Txt
2009-01-24 15:25:29 —-D—- C:\Program Files\Eraser
2009-01-24 15:18:22 —-D—- C:\Program Files\Common Files
2009-01-23 15:14:23 —-HD—- C:\WINDOWS\inf
2009-01-23 15:14:22 —-D—- C:\WINDOWS\system32\CatRoot
2009-01-22 15:54:54 —-D—- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-22 15:48:13 —-AD—- C:\Documents and Settings\All Users\Application Data\TEMP
2009-01-22 15:47:27 —-D—- C:\Program Files\SpywareBlaster
2009-01-22 15:32:30 —-D—- C:\WINDOWS\system32\config
2009-01-22 15:32:00 —-D—- C:\WINDOWS\system32\wbem
2009-01-22 15:32:00 —-D—- C:\WINDOWS\Registration
2009-01-22 15:31:39 —-D—- C:\Config.Msi
2009-01-22 15:31:38 —-SHD—- C:\WINDOWS\Installer
2009-01-22 15:31:38 —-RSD—- C:\WINDOWS\assembly
2009-01-22 15:31:08 —-D—- C:\WINDOWS\security
2009-01-22 15:31:05 —-D—- C:\WINDOWS\system32\usmt
2009-01-22 15:31:00 —-RSHDC—- C:\WINDOWS\system32\dllcache
2009-01-22 15:27:10 —-D—- C:\WINDOWS\system32\en-US
2009-01-22 15:19:28 —-HD—- C:\WINDOWS\$hf_mig$
2009-01-22 15:18:58 —-D—- C:\WINDOWS\Help
2009-01-20 11:54:53 —-D—- C:\Program Files\SUPERAntiSpyware
2009-01-18 13:59:56 —-ASH—- C:\boot.ini
2009-01-18 13:59:56 —-A—- C:\WINDOWS\win.ini
2009-01-18 13:59:56 —-A—- C:\WINDOWS\system.ini
2009-01-18 13:56:21 —-D—- C:\WINDOWS\pss
2009-01-17 18:46:56 —-D—- C:\Documents and Settings
2009-01-17 18:45:55 —-SHD—- C:\WINDOWS\CSC
2009-01-17 11:15:06 —-D—- C:\Program Files\Malwarebytes' Anti-Malware
2009-01-17 11:15:05 —-D—- C:\WINDOWS\system32\drivers
2009-01-17 10:48:51 —-D—- C:\WINDOWS\system32\CatRoot_bak
2009-01-16 11:48:01 —-D—- C:\WINDOWS\Debug
2009-01-14 17:57:54 —-D—- C:\WINDOWS\Microsoft.NET
2009-01-14 15:41:09 —-D—- C:\Documents and Settings\Andrea\Application Data\SUPERAntiSpyware.com
2009-01-10 01:35:28 —-A—- C:\WINDOWS\system32\MRT.exe
2009-01-07 16:26:41 —-D—- C:\Program Files\Replay AV 8
2009-01-04 20:27:52 —-HD—- C:\Program Files\InstallShield Installation Information
2009-01-04 18:32:57 —-D—- C:\Program Files\Lexmark X1100 Series
2009-01-03 16:29:59 —-D—- C:\Program Files\Common Files\Nero
2009-01-03 14:57:30 —-A—- C:\WINDOWS\system32\PerfStringBackup.INI
2009-01-03 14:54:41 —-D—- C:\WINDOWS\system32\spool
2009-01-03 14:49:17 —-D—- C:\WINDOWS\system32\DirectX
2009-01-03 14:34:35 —-D—- C:\Program Files\Ahead
2008-12-28 15:00:13 —-D—- C:\WINDOWS\Minidump
2008-12-24 19:54:04 —-A—- C:\WINDOWS\lexstat.ini
2008-12-21 18:55:13 —-D—- C:\Program Files\Java
2008-12-20 18:52:55 —-D—- C:\Documents and Settings\Andrea\Application Data\MP3Rocket
2008-12-20 18:52:53 —-D—- C:\Program Files\MP3 Rocket
2008-12-19 09:48:32 —-D—- C:\WINDOWS\ie7updates
2008-12-16 15:40:35 —-D—- C:\Program Files\COMODO
2008-12-13 06:40:02 —-A—- C:\WINDOWS\system32\mshtml.dll
2008-12-11 11:29:58 —-D—- C:\Program Files\Internet Explorer
2008-11-27 12:06:31 —-SD—- C:\WINDOWS\Downloaded Program Files
2008-11-14 09:20:13 —-D—- C:\Documents and Settings\All Users\Application Data\NOS
2008-11-14 09:20:10 —-D—- C:\Program Files\NOS
2008-11-13 01:02:50 —-D—- C:\WINDOWS\WinSxS
2008-11-07 14:43:21 —-D—- C:\Documents and Settings\All Users\Application Data\RapidSolution
2008-11-07 11:49:27 —-D—- C:\Program Files\Spybot - Search & Destroy
2008-11-06 14:58:08 —-SD—- C:\Documents and Settings\Andrea\Application Data\Microsoft
2008-11-06 14:57:49 —-D—- C:\Documents and Settings\All Users\Application Data\avg8

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-08-30 97928]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-07-04 26824]
R1 cdrbsvsd;cdrbsvsd; C:\WINDOWS\system32\drivers\cdrbsvsd.sys [2003-07-16 13056]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [2008-12-16 101776]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [2008-12-16 31504]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-03 36096]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
R2 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-07-04 76040]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
R2 tifsfilter;Acronis True Image FS Filter; C:\WINDOWS\system32\DRIVERS\tifsfilt.sys [2008-05-16 39264]
R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2005-09-20 401664]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2005-09-19 30363]
R3 BTKRNL;Bluetooth Bus Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2005-09-20 1342122]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2005-09-19 148040]
R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-09-19 56648]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-09-12 4381184]
R3 MxlW2k;MxlW2k; C:\WINDOWS\system32\drivers\MxlW2k.sys [2009-01-03 28256]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-09-17 6132576]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-12-05 10368]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2006-08-14 83200]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2004-08-03 25856]
R3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 APLMp50;APLMp50 NDIS Protocol Driver; C:\WINDOWS\System32\Drivers\APLMp50.sys [2006-11-29 28224]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-01-25 42000]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 StkAMini;Syntek STK1160; C:\WINDOWS\System32\Drivers\StkAMini.sys [2006-11-15 242139]
S3 StkScan;Syntek STK1160 Still Image; C:\WINDOWS\System32\Drivers\StkScan.sys [2006-06-27 4772]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcrSch2Svc;Acronis Scheduler2 Service; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [2006-10-16 230944]
R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
R2 bgsvcgen;B's Recorder GOLD Library General Service; C:\WINDOWS\system32\bgsvcgen.exe [2005-04-30 86016]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2005-09-19 258103]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2008-12-16 618232]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-21 152984]
R2 LexBceS;LexBce Server; C:\WINDOWS\system32\LEXBCES.EXE [2003-08-18 303104]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe [2008-08-29 935208]
R2 NeroMediaHomeService.4;Nero MediaHome 4 Service; C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe [2008-08-29 427304]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-09-17 163908]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Program Files\Nero\Nero BackItUp 4\IoctlSvc.exe [2008-08-29 81920]
R2 StkASSrv;Syntek STK1160 Service; C:\WINDOWS\System32\StkASv2K.exe [2006-05-23 24576]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2006-09-28 49152]
R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-01-25 93048]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

—————–EOF—————–


info.txt logfile of random's system information tool 1.05 2009-01-25 14:53:40

======Uninstall list======

–>rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
4A-Studio 3.5–>"C:\Program Files\4A-Studio\unins000.exe"
Acrobat.com–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
Acrobat.com–>MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Acronis True Image Home–>MsiExec.exe /X{419CF344-3D94-4DAD-99C8-EA7B00E5EA8B}
Adobe AIR–>C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR–>MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
Adobe Flash Player ActiveX–>C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9–>MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
Apple Software Update–>MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F}
Audacity 1.2.6–>"C:\Program Files\Audacity\unins000.exe"
AVG Free 8.0–>C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Bonjour–>MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
BT Yahoo! Applications–>C:\PROGRA~1\Yahoo!\Common\uninstall.exe
CCleaner (remove only)–>"C:\Program Files\CCleaner\uninst.exe"
dBpowerAMP Music Converter–>"C:\WINDOWS\system32\SpoonUninstall.exe" C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
dBpoweramp Windows Media Audio 10 Codec–>"C:\WINDOWS\system32\SpoonUninstall.exe" C:\WINDOWS\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
diskMETA-Lite 1.0.1 (remove only)–>"C:\Program Files\META\diskMETA 101L\uninst\unins000.exe"
Eraser 5.82–>"C:\Program Files\Eraser\unins000.exe"
EVEREST Home Edition v2.20–>"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe"
File Shredder 2.0–>"C:\Program Files\File Shredder\unins000.exe"
FinePix Studio–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E3B3AB03-8ABC-46CF-8CA9-DB5581E1F368}\SETUP.EXE" -l0x9
FinePixViewer Resource–>C:\Program Files\InstallShield Installation Information\{B44529FF-501E-47CD-A06D-223C161BE058}\SETUP.EXE -runfromtemp -l0x0009 -removeonly
FinePixViewer Ver.5.3–>C:\Program Files\InstallShield Installation Information\{24ED4D80-8294-11D5-96CD-0040266301AD}\SETUP.EXE -runfromtemp -l0x0009 -removeonly
FUJIFILM USB Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE"
GIMP 2.4.2–>"C:\Program Files\GIMP-2.0\setup\unins000.exe"
HD Tune 2.55–>"C:\Program Files\HD Tune\unins000.exe"
High Definition Audio Driver Package - KB888111–>"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2–>"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Internet Explorer 7 (KB947864)–>"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399)–>"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)–>"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)–>"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)–>"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB935448)–>"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)–>"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
ImageMixer VCD2 LE for FinePix–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B093990A-AAF2-44AC-9216-14BB7A2189B6}\SETUP.EXE" -l0x9
IrfanView (remove only)–>C:\Program Files\IrfanView\iv_uninstall.exe
Java™ 6 Update 11–>MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java™ 6 Update 7–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java™ SE Runtime Environment 6 Update 1–>MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Learn Microsoft® Windows XP–>C:\WINDOWS\unvise32.exe C:\Program Files\uninstal.log
Lexmark X1100 Series–>C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBKUN5C.EXE -dLexmark X1100 Series
Malwarebytes' Anti-Malware–>"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaShow 3.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5A9B7C0-8751-11D8-9D75-000129760D75}\setup.exe" -uninstall
Microsoft .NET Framework 2.0 Service Pack 1–>MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1–>MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft Compression Client Pack 1.0 for Windows XP–>"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs–>"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs–>"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003–>MsiExec.exe /I{91110409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0–>"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable–>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works 2000–>MsiExec.exe /I{56364334-9530-11D2-BFFC-00C04FA329AA}
Mozilla Firefox (3.0)–>C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MP3 Rocket–>C:\Program Files\MP3 Rocket\Uninstall.exe
MSXML 4.0 SP2 (KB936181)–>MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)–>MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)–>MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
MUSICMATCH® Jukebox–>C:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.exe
Nero 9–>C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="1M03-0172-Z5TH-XEW8-AX6U-0HWP-741A-5LUH"
Nero BackItUp 4–>C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="1M11-014C-6708-LU7P-0CW2-A8ME-TXEP-3XE9"
Nero MediaHome 4 Trial–>C:\Program Files\Common Files\Nero\Nero ProductInstaller 4\SetupX.exe REMOVESERIALNUMBER="8M04-0085-T20T-H0LM-X4TZ-U959-4UEM-KC85"
neroxml–>MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers–>C:\WINDOWS\system32\nvuninst.exe UninstallGUI
Paint.NET v3.22–>MsiExec.exe /X{96C267DA-0926-4C11-B4E7-4D3EF85130D0}
PhotoNow! 1.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\setup.exe" -uninstall
PixiePack Codec Pack–>MsiExec.exe /I{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}
Power2Go 3.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe" -uninstall
PowerBackup 1.0–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ADD5DB49-72CF-11D8-9D75-000129760D75}\setup.exe" -uninstall
PowerDVD–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
PowerProducer Express–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
PowerStarter–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
QuickTime–>MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175}
REALTEK GbE & FE Ethernet PCI-E NIC Driver–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\Setup.exe" -l0x9 -removeonly
Realtek High Definition Audio Driver–>RtlUpd.exe -r -m
Replay AV 8–>C:\WINDOWS\iun6002.exe "C:\Program Files\Replay AV 8\uninstallRAV8.ini"
Replay Converter 2.8–>C:\WINDOWS\iun6002.exe "C:\Program Files\Replay AV 8\iruninRCV.ini"
Security Update for Windows Internet Explorer 7 (KB938127)–>"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB944533)–>"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB950759)–>"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB953838)–>"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB956390)–>"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB958215)–>"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Security Update for Windows Internet Explorer 7 (KB960714)–>"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Security Update for Windows Media Encoder (KB954156)–>"C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB911564)–>"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB952069)–>"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)–>"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 6.4 (KB925398)–>"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Security Update for Windows Media Player 9 (KB936782)–>"C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe"
Security Update for Windows XP (KB890046)–>"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Security Update for Windows XP (KB893756)–>"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896358)–>"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896423)–>"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Security Update for Windows XP (KB896428)–>"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899587)–>"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Security Update for Windows XP (KB899591)–>"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Security Update for Windows XP (KB900725)–>"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901017)–>"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Security Update for Windows XP (KB901214)–>"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Security Update for Windows XP (KB902400)–>"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905414)–>"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB905749)–>"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB908519)–>"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911562)–>"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Security Update for Windows XP (KB911927)–>"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Security Update for Windows XP (KB913580)–>"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914388)–>"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Security Update for Windows XP (KB914389)–>"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918118)–>"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Security Update for Windows XP (KB918439)–>"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Security Update for Windows XP (KB919007)–>"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920213)–>"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920670)–>"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920683)–>"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Security Update for Windows XP (KB920685)–>"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Security Update for Windows XP (KB922819)–>"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923191)–>"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923414)–>"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923980)–>"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924270)–>"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Security Update for Windows XP (KB924667)–>"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Security Update for Windows XP (KB925902)–>"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926255)–>"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB926436)–>"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927779)–>"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Security Update for Windows XP (KB927802)–>"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928255)–>"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Security Update for Windows XP (KB928843)–>"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Security Update for Windows XP (KB929123)–>"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Security Update for Windows XP (KB930178)–>"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931261)–>"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Security Update for Windows XP (KB931784)–>"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Security Update for Windows XP (KB932168)–>"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Security Update for Windows XP (KB933729)–>"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935839)–>"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB935840)–>"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Security Update for Windows XP (KB936021)–>"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Security Update for Windows XP (KB937894)–>"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938464)–>"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB938829)–>"C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941202)–>"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941568)–>"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)–>"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941644)–>"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941693)–>"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943055)–>"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943460)–>"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Security Update for Windows XP (KB943485)–>"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Security Update for Windows XP (KB944653)–>"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Security Update for Windows XP (KB945553)–>"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946026)–>"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)–>"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948590)–>"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Security Update for Windows XP (KB948881)–>"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950749)–>"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)–>"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)–>"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)–>"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)–>"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)–>"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)–>"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)–>"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)–>"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)–>"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)–>"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)–>"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954600)–>"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)–>"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)–>"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)–>"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)–>"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)–>"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)–>"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)–>"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)–>"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)–>"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Spybot - Search & Destroy–>"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
SpywareBlaster 4.1–>"C:\Program Files\SpywareBlaster\unins000.exe"
SUPERAntiSpyware Free Edition–>MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Ulead VideoStudio SE DVD–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8F8D9297-FDD2-405A-97E7-E52C7B2F97B3}\Setup.exe" -l0x9
Update for Windows XP (KB894391)–>"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update for Windows XP (KB898461)–>"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB900485)–>"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update for Windows XP (KB908531)–>"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Update for Windows XP (KB910437)–>"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update for Windows XP (KB911280)–>"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Update for Windows XP (KB916595)–>"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update for Windows XP (KB920872)–>"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update for Windows XP (KB922582)–>"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update for Windows XP (KB925720)–>"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Update for Windows XP (KB927891)–>"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update for Windows XP (KB930916)–>"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update for Windows XP (KB932823-v3)–>"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Update for Windows XP (KB936357)–>"C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Update for Windows XP (KB938828)–>"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update for Windows XP (KB942763)–>"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update for Windows XP (KB951072-v2)–>"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB955839)–>"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
USB2.0 Capture Device–>RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E337B156-DF81-48D8-8977-B1574EE87BCF}\Setup.exe" -l0x9
WaveLab Lite–>"C:\Program Files\Steinberg\WaveLab Lite\Unwise.exe" C:\PROGRA~1\STEINB~1\WAVELA~1\Install.log
WIDCOMM Bluetooth Software–>MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}
Windows Defender–>MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
Windows Imaging Component–>"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)–>"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Internet Explorer 7–>"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Encoder 9 Series–>msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9 Series–>MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime–>"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime–>"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11–>"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11–>"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Presentation Foundation–>MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Hotfix - KB873339–>C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP Hotfix - KB885835–>C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP Hotfix - KB885836–>C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP Hotfix - KB886185–>C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP Hotfix - KB887472–>C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP Hotfix - KB888302–>C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP Hotfix - KB890859–>"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP Hotfix - KB891781–>C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Windows XP Service Pack 2–>C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe
WinPcap 4.0–>C:\Program Files\WinPcap\uninstall.exe
YouSendIt Express–>C:\Program Files\InstallShield Installation Information\{1193600A-134F-40F9-9F71-FEF54C93C629}\setup.exe -runfromtemp -l0x0409

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: AVG Anti-Virus Free

System event log

Computer Name: ANDREA-9WSYO6HI
Event Code: 7035
Message: The Terminal Services service was successfully sent a start control.

Record Number: 11740
Source Name: Service Control Manager
Time Written: 20081216184110.000000+000
Event Type: information
User: NT AUTHORITY\SYSTEM

Computer Name: ANDREA-9WSYO6HI
Event Code: 6005
Message: The Event log service was started.

Record Number: 11739
Source Name: EventLog
Time Written: 20081216183957.000000+000
Event Type: information
User:

Computer Name: ANDREA-9WSYO6HI
Event Code: 6009
Message: Microsoft ® Windows ® 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 11738
Source Name: EventLog
Time Written: 20081216183957.000000+000
Event Type: information
User:

Computer Name: ANDREA-9WSYO6HI
Event Code: 6006
Message: The Event log service was stopped.

Record Number: 11737
Source Name: EventLog
Time Written: 20081216183834.000000+000
Event Type: information
User:

Computer Name: ANDREA-9WSYO6HI
Event Code: 3005
Message: Windows Defender Real-Time Protection agent has taken action to protect this machine from spyware or other potentially unwanted software.

For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409

Scan ID: {7FC77D86-EB4C-4306-B1D6-9A8097C88F3A}

User: ANDREA-9WSYO6HI\Andrea

Name: Unknown

ID:

Severity: Not Yet Classified

Category: Not Yet Classified

Alert Type: Unclassified software

Action: Ignore

Record Number: 11736
Source Name: WinDefend
Time Written: 20081216183817.000000+000
Event Type: information
User:

Application event log

Computer Name: ANDREA-9WSYO6HI
Event Code: 1000
Message: Performance counters for the Windows Workflow Foundation 3.0.0.0 (Windows Workflow Foundation 3.0.0.0) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 3359
Source Name: LoadPerf
Time Written: 20090103145730.000000+000
Event Type: information
User:

Computer Name: ANDREA-9WSYO6HI
Event Code: 11707
Message: Product: Windows Presentation Foundation – Installation completed successfully.

Record Number: 3358
Source Name: MsiInstaller
Time Written: 20090103145711.000000+000
Event Type: information
User: ANDREA-9WSYO6HI\Andrea

Computer Name: ANDREA-9WSYO6HI
Event Code: 11707
Message: Product: Windows Communication Foundation – Installation completed successfully.

Record Number: 3357
Source Name: MsiInstaller
Time Written: 20090103145533.000000+000
Event Type: information
User: ANDREA-9WSYO6HI\Andrea

Computer Name: ANDREA-9WSYO6HI
Event Code: 1000
Message: Performance counters for the ServiceModelOperation 3.0.0.0 (ServiceModelOperation 3.0.0.0) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 3356
Source Name: LoadPerf
Time Written: 20090103145533.000000+000
Event Type: information
User:

Computer Name: ANDREA-9WSYO6HI
Event Code: 1000
Message: Performance counters for the ServiceModelService 3.0.0.0 (ServiceModelService 3.0.0.0) service were loaded successfully.
The Record Data contains the new index values assigned
to this service.

Record Number: 3355
Source Name: LoadPerf
Time Written: 20090103145532.000000+000
Event Type: information
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Ulead Systems\MPEG;C:\Program Files\QuickTime\QTSystem\
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0f02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"FP_NO_HOST_CHECK"=NO
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

—————–EOF—————–
Post #5
Hi hedley93,

You have ask bar installed. this normally comes bundled with the comodo firewall.

  • Are you just using the Comodo Firewall or the Internet Security Suite? (the suite has been known to produce the odd false positive)


If you don't use the Ask tool bar, I suggest you remove it. It isn't necessarily 'bad', but it is considered "foistware', in that most users are not aware it has been installed on their system.

Their marketing practices are questionable as they target young children. If you would like further information on the Ask toolbar - read this article here

The same could be said for the Realtek AC97 Audio - Event Monitor. It is a "Sypware" file used surreptitiously to monitor one's actions.
It is not a sinister one, like remote control programs, but it is being used by Realtek to gather data about customers.
  • If you would prefer not to have to have this program run at startup it can be fixed with HJT


We can also remove your outdated versions of Java as they now pose a security vulnerability.
(This will not have to be done again as the newer versions of Java will overwrite the old program)

First

Click Start>Control Panel>Add or Remove Programs
A list of installed programs will populate

Locate the following programs and select Remove

  • Ask Tool Bar
  • Ask Search Assistant
  • Java™ 6 Update 7
  • Java™ SE Runtime Environment 6 Update 1

Note: any other programs related to Ask can also be removed.

Next
  • Open HiJackThis
  • Click on Do a system scan only
  • Check the boxes next to ONLY the entries listed below

  • R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
  • O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
  • O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
  • O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL (file missing)
  • O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

  • Close all windows except Hijackthis and click Fix Checked
  • Click Yes when prompted
  • Close HijackThis.

Now
Using Windows Explorer (Windows key+e), search for the Ask Toolbar folder.
If the program folder is still there, select/highlight the Ask Toolbar folder. DELETE it. (File > Delete.)
(If Windows is not installed on the C drive, replace C:\ with the appropriate drive letter.)
Close Windows Explorer.

Next

Please do an online scan with Kaspersky WebScanner

Using Internet Explorer, please do a Kaspersky Online Scan
Answer Yes, when prompted to install an ActiveX component.
The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure as follows:

Scan using the following Anti-Virus database:
  • Extended
Scan Options:
  • Scan Archives
  • Scan Mail Bases
Click OK & have it scan My Computer

Once the scan is complete, it will provide a report if your system is infected.
It does not provide an option to clean/disinfect. We only require a report from it.

[external image: Posted Image]

Click the Save as Text button to save the file to your desktop and post it in your next reply

NOTE: Turn off the real time scanner of any existing antivirus program while performing the online scan


In your next response include
  • the Kaspersky report
  • If you are using the entire Commodo Suite or just the Firewall
  • and advise how your system is running now
.
Post #6
Hi Catbyte, I have run Hijack This system scan and removed the items you stated with the exception of C:\Program Files\AsktBar\SrchAstt\1.bin\A5SRCHAS.DLL & C:\Program Files\AskTBar\1.bin\ASKTBAR.DLL (file missing). I had already deleted the Ask Toolbar in Add\Remove Programmes as I did not intend using it. I didn't notice it coming in with Comodo, but I recently installed Nero 9 and noticed that toolbar was with it, but I unticked to have it installed. It was only after installing Nero that I noticed the Ask Toolbar was there. I have never used Ask, so I uninstalled it right away at that time. I presume this is why the above mentioned did not show up in Hijack This. I have the Comodo Suite installed because that is what was offered at the time of the upgrade. I have thought of disabling the Defense & Security option as I don't really know what most of the alerts mean when they pop up. You mentioned the Realtek AC97 Audio - Event Monitor. My sound\video card uses Realtek AC97, if that makes any difference. Below is the Kaspersky report as asked for. The threat that has come up is in a programme that I downloaded to my pc but have not as yet installed, if that is any help. KASPERSKY ONLINE SCANNER 7 REPORT Monday, January 26, 2009 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, January 26, 2009 08:50:28 Records in database: 1697603 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ M:\ N:\ O:\ P:\ Scan statistics: Files scanned: 91223 Threat name: 1 Infected objects: 1 Suspicious objects: 0 Duration of the scan: 01:24:48 File name / Threat name / Threats count C:\Documents and Settings\Andrea\My Documents\FLV2Video_Setup_r38540 (topvideopro.com).exe Infected: Backdoor.Win32.Sheldor.bj 1 The selected area was scanned. I have not switched my computer off since this started as I didn't know what the consequences might be, e.g. the worm infecting the pc on restart etc. I have not had any more warnings given by the resident shield since I first wrote to you. Do you think it would be safe enough to reboot now, having done as you suggested? Maybe I need to reboot to see if anything untoward happens? Otherwise the pc seems to be running ok at the moment. Please let me know if I have missed anything. Thank you again for your help. hedley
Post #7
:thumbup: Good job.


Kaspersky has found a backdoor trojan in the downloaded file - it could have serious consequences for your system if you installed it.

You need to delete this file, but before you delete it I would like you to submit it for analysis, so the antivirus companies can collect the information on the infection.

Please do this:

Please go here to upload a suspicious file for analysis.
  • Enter your email address.
  • Copy and paste the link to this thread
  • In Files to submit, 1., browse for this filename: C:\Documents and Settings\Andrea\My Documents\FLV2Video_Setup_r38540(topvideopro.com).exe
  • In the comments, please mention that I asked you to upload this file
  • Click on Send File


  • Once it has been submitted it can be deleted

The file to delete is located here:
  • C:\Documents and Settings\Andrea\My Documents\FLV2Video_Setup_r38540 (topvideopro.com).exe


(should be an icon for it in your "My Documents" folder)

  • If you have any difficulty locating and deleting this file, please let me know


As long as you haven't tried to install or click on that program, then deleting it will be fine.

Where did you download this program from? If it was a torrent or p2p then no doubt it is infected


I have the Comodo Suite installed because that is what was offered at the time of the upgrade. I have thought of disabling the Defense & Security option as I don't really know what most of the alerts mean when they pop up.


That's good, leave Comodo as is, it is a very good program I use it myself - if you can give a couple of examples of the alerts you are getting we can help you out.

Most of the time it will be normal activity - automatic updates etc., once you allow the activity and set Comodo to remember your choice, you won't receive anymore alerts, just be sure of what you are allowing it to do.

Realtek AC97 Audio - no problem, we've just set it so it doesn't automatically send info about you to Realtek - your performance hasn't been altered.

  • If you are using the full Comodo suite it comes with an Antivirus, therefore you should uninstall AVG.
    You should not have more than one anti-virus program installed. They will conflict, and provide less protection, not more.

Next:

  • Please delete RSIT from your desktop and any txt log it produced.

Now we need to set a new restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it something you will remember such as All Clean and click Create, when the confirmation screen shows the restore point has been created click Close.

Next go to Start Menu > Run > type(or copy/paste)

Cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once that's finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

Hopefully you followed the very excellent advise given to you by mschroe919 here: http://forums.whatthetech.com/trojan_found…600#entry480600 back in August


I will reiterate them here:

: Make your Internet Explorer more secure :

Make your Internet Explorer more secure
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

:Take care when downloading programs:
  • Avoid illegal sites, because that's where most malware is present.
  • Don't click on links inside popups.
  • Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.
  • Download free software only from sites you know and trust.
  • A lot of free software can bundle other software, including spyware.
  • Before downloading, it is crucial to check whether the source is reputable.

A lot of malware these days will 'hitch a ride' onto your computer if you happen to land on the wrong page even without clicking a link.

One way to check is to use /McAfee SiteAdvisor.
Copy the domain name into the space provided and SiteAdvisor will give you a report on the website which can help you decide if it is safe.

The site offers a download for a toolbar for IE and a Firefox AddOn which adds this functionality to your browser.
  • Update all your programs regularly - Without regular updates you WILL NOT be protected when new malicious programs are released.

Post #8 last edited
Hi Catbyte, I have followed the instructions you have given me and also checked the post of mschroe919. Before I replied to you I thought I would run a few scans on the pc. I used Windows Defender - came up clean. Then I used spybot search & destroy. The first scan brought up 2 adware: 'My Web Search/FunwebProducts. Description: MyWebSearch/FunWebProducts component. Company Unknown\varies. Threat Level 1-10'. I 'fixed these problems'. I then used superantispyware. That brought up 2 registry keys, both associated with the Ask Toolbar. I quarantined and removed these. Sanned again with superantispyware - came up clean. Spybot S&D however brought up another warning: 'Firefox (default) bookmark - Spywareinfo. TrafficZ - www.spywareinfo.com'. I also 'fixed this problem'. Scanned again and the same infection came up. I fixed it again. Maybe saying (default) makes some difference? I checked the bookmarks in Firefox, but found no reference to this. I installed Firefox from Internet Explorer 7 and brought across the favourites. I don't know where this has come from as I know I definately did not ever do a search anywhere for spyware info. Any spyware programmes etc that I have downloaded came from this board that gave links to the proper sites. I would be grateful if I could have your thoughts on these points. On Comodo, I today tried to uninstall Nero Home Media Trial as I don't use it and it takes forever to load at startup. When I clicked on unistall in add\remove programmes Comodo came up with the following alerts, first in orange and then in red. 'SetupX.exe could not be recognized and is about to connect to the internet'. 'SetupX.exe is about to connect to the internet. Please ensure setupX.exe is a safe application. (svchost) - The parent application that is accessing the target application in memory will allow the parent application to fully control the target application. This is a common technique used by many legitimate applications as well as many malware. If SetupX.exe is one of your everyday applications you can allow this request'. The same warning was given for (svchost.exe in memory), (Service Control Manager) and (explorer.exe). Not knowing what to do I restarted the pc as it was the only way I could get the alerts to disappear. Cancelling each one only brought them up one after the other again. This is the type of thing I mean when I say I don't understand what some of the messages mean and the same sort of messages always come up when I try to install\uninstall programmes. Sorry if this is long but I thought I would explain exactly what my problem is with Comodo. Thanks again for the help. hedley
Post #9
Lets give your system a really good flushing - see if we can clear out any remnants

First click Start>MyComputer>LocalDisk(C:)>ProgramFiles - Look for the ASK folder and delete it (right click - hit delete)
  • If you have any difficulty with this process please advise

Next:
Please download ATF Cleaner by Atribune & save it to your desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
NOTE: It is normal for your computer to restart a little slower to begin with.
This program will clear out all your temporary internet files, prefetch and java cache

Then Open Mozilla Firefox
  • From the Firefox menu options, choose Tools and then Clear Private Data….
  • In the Clear Private Data window that appears, uncheck all checkboxes except for the Cache checkbox.
  • Note: If you wish to clear additional forms of "private data", feel free to check the appropriate boxes. They will be cleared with the cache in the next step.
  • Click on the Clear Private Data Now button.
  • When the Clear Private Data window disappears, all of the files saved (cached) from your Internet browsing activities will have been removed.

Next
Open MalwareBytes antiMalware - update the program and run it.
it will likely come up clean - but post the results anyway.

Now - give me an uninstall list from HJT and I'll see if there's more to remove from your computer

  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.
  • Repeat the steps for setting a new restore point from my last post.
There is no need to be overly concerned about cookies - they are generally harmless - here is an article that explains them: http://www.cookiecentral.com/cm002.htm
just by visiting web sites you will always pick-up a few. You can set you security levels higher to disallow them but it isn't necessary, just follow my recommendations from my previous post to make your browser more secure.
  • If you scan regularly with MalwarebytesAntiMalware and clean out your browsing history regularly with ATF cleaner, and following the advise re browsing more securely, then you shouldn't have to worry uneccessarily
.
  • If you have any further concerns, please advise.
Post #10
Sorry, I had already posted before I saw your edit regarding your concern with Comodo.

Comodo is a great program, but requires some learning in using it effectively.
(I use this program myself - so I know it takes a little getting used to)

Rule of thumb….If you are trying to do something yourself ie: install or uninstall a program, it is safe to allow Comodo to do it ,
as the action is self initiated.

For an example: when you are downloading and installing a program - Comodo will complain.
Choose the 'Installation Mode' while installing your program….Comodo will remind you that you are in 'Installation mode' every so often, if your not finished with your set up yet, just say no and it will wait for a while longer then remind you again, when your done installing say 'yes' - this reverts back to protection mode.

(Of course - I am referring to properly purchased and downloaded software.)

Once Comodo accepts all your settings then it remembers them and won't bother you.

In the scenario you have described, you can allow Comodo to do what it wishes as you are trying to uninstall that program. (do not check remember my settings) for this procedure as you do wan't it to ask you every time it connects to the internet.

Read the alertbox carefully, if it seems appropriate to what you are trying to accomplish yourself - allow it.
The time to be concerned is when you get a random alert out of the blue that a program is trying to 'connect to' to your computer.

Then read what it is extremely carefully - most likely this is something you would need to deny.

There are many instances where legitimate programs will randomly access the internet to update themselves such as Java and Adobe etc.

Those are OK to allow - when those happen - choose 'remember my choice' as an option and Comodo won't
bother you again.

Pretty soon you will start to recognise what's OK and what's not - the majority of the time it's going to be OK.

If you have any concern's at all over any alerts, by all means please post them and I'll try to advise.


I hope this gives you a little bit of understanding into the program….

There are lots of help articles out there that may explain it a little better.

The Comodo Firewall forum has a lot of useful information in their FAQ section
https://forums.comodo.com/comodo_firewall-b50.0/
Post #11
Hi Catbyte I have run ATF and Malwarebytes Anti Malware and the scan was clean. Attached is the log from HijackThis as asked for: 4A-Studio 3.5 Acrobat.com Acrobat.com Acronis True Image Home Adobe AIR Adobe AIR Adobe Flash Player ActiveX Adobe Reader 9 Apple Software Update Audacity 1.2.6 AVG Free 8.0 Bonjour BT Yahoo! Applications CCleaner (remove only) dBpowerAMP Music Converter dBpoweramp Windows Media Audio 10 Codec diskMETA-Lite 1.0.1 (remove only) Eraser 5.82 EVEREST Home Edition v2.20 File Shredder 2.0 FinePix Studio FinePixViewer Resource FinePixViewer Ver.5.3 FUJIFILM USB Driver GIMP 2.4.2 HD Tune 2.55 High Definition Audio Driver Package - KB888111 Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB935448) Hotfix for Windows XP (KB952287) ImageMixer VCD2 LE for FinePix IrfanView (remove only) Java™ 6 Update 11 Learn Microsoft® Windows XP Lexmark X1100 Series Malwarebytes' Anti-Malware MediaShow 3.0 Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 3.0 Service Pack 1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Microsoft Works 2000 Mozilla Firefox (3.0) MP3 Rocket MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 6 Service Pack 2 (KB954459) MUSICMATCH® Jukebox Nero 9 Nero BackItUp 4 Nero MediaHome 4 Trial neroxml NVIDIA Drivers Paint.NET v3.22 PhotoNow! 1.0 PixiePack Codec Pack Power2Go 3.0 PowerBackup 1.0 PowerDVD PowerProducer Express PowerStarter QuickTime REALTEK GbE & FE Ethernet PCI-E NIC Driver Realtek High Definition Audio Driver Replay AV 8 Replay Converter 2.8 Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Spybot - Search & Destroy SpywareBlaster 4.1 SUPERAntiSpyware Free Edition Ulead VideoStudio SE DVD Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB925720) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB932823-v3) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB951072-v2) Update for Windows XP (KB955839) USB2.0 Capture Device WaveLab Lite WIDCOMM Bluetooth Software Windows Defender Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Media Encoder 9 Series Windows Media Encoder 9 Series Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows Presentation Foundation Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Service Pack 2 WinPcap 4.0 YouSendIt Express Hope this ok. You mentioned an antivirus in Comodo suite. Is this an automatic settings type of thing as I can't find any reference to an antivirus in the interface. Thanks for the help. hedley
Post #12
Hi Hedley93


Good news - your system looks clean :thumbup:


As for a little 'excess baggage' you may have:

you could lose CC cleaner and File shredder 2.0 - ATF does the job of both of those - your choice though

uninstall the old versions of HJT (1.99.1) - if you get a new infection (which you shouldn't if your careful) you would need the most uptodate version anyway

Keep Malwarebytes - great to do a scan every month or so.

Comodo suite - depends what version you have - you probably just have the Firewall if there is no mention of the Antivirus - that's good though as you have AVG running.

I don't see anything else that's an issue - there are a couple of repeated programs there
Acrobat.com, Adobe AIR,Windows Media Encoder 9 Series,Windows Media Format 11 runtime,Windows Media Player 11


- look very carefully at your populated list - see if they are in fact duplications (same file size etc.) if your certain they are duplicates, uninstall one

If they don't show up twice in the populated list on your system then don't worry about them.


Here is a great program to assist you in removing all your unwanted programs:

Download and install the Revo Uninstaller
  • Double click the new Revo Uninstaller icon on your desktp to start the program
  • Scroll through the listed programs and Right Click on the program you wish to uninstall
  • From the pop out menu choose Uninstall
  • Click Yes to the confirmation dialogue
  • In the next window select the Advanced mode
  • Click Next to start uninstalling the program
  • Answer Yes to confirm the uninstall
  • When the program has completed the four steps, click Next to allow the program to search for leftovers
  • Once complete, click Next, then Finish
  • Repeat the above steps for any other programs you wish to remove.

Take care of any optional uninstalls you choose then we need to clean up after ourselves.

FIRST

Download ToolsCleaner2 to your desktop and run it (by A.Rothstein & Dj Quiou)
  • Click the Pt. Restauration button and press OK to the prompts.
  • Click the Corbeille button and press OK to the prompt.
  • Click the Fichiers temp button and press OK to the prompt.
  • Click the Recherche button and let it run ( it may look like it freezes but let it continue )
  • Once it is done click the Suppression button and let it remove anything it finds.
  • Close the program


Now we need to create a new System Restore point.
Click Start > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next go to Start > Run > type

Cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once that's finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

If you have any further issues or any other questions please advise.

Please return to my previous post to review my recommendations for staying clean.

Good job in following all the instructions, I will keep this thread open for a couple of days in case you have any other issues - stay safe :wavey:
Post #13
Hi Catbyte, thanks for the reply. I have followed your suggestions and have also removed HijackThis with Revo Uninstaller. The other repeat entries you mention are only listed once in the add/remove list. Comodo: on holding the mouse over the icon in the notification tray it says Comodo Internet Suite, but options under all the tabs only refer to the firewall. I run Malwarebytes, Superantispyware & Spybot every day. Too often? If I could just ask one more question. When I download any programmes from the internet I always right click on the .exe file where it was downloaded to (desktop, my docs etc) and check with Malwarebytes, Superantispyware and Avg antivirus. Everything comes up clean every time, but with the trouble I've had lately that's obviously not the case. Is there a 'proper' way to run a check on these .exe before installing them? Thank you for your time, patience and invaluable help. If anything else crops up I will contact you again. :thumbup: I wish you every success with your class. Thanks again hedley :notworthy:
Post #14
Hi Hedley93

I run Malwarebytes, Superantispyware & Spybot every day. Too often?


Depends what you are doing - for normal everyday usage of the internet then yes - too often - once a month would be good if you are not downloading programs all the time.

If you are downloading unsafe programs (cracks,keygens) then running those programs every minute won't help you!

Run ATF cleaner once a week - clears all the clutter.

When I download any programmes from the internet I always right click on the .exe file where it was downloaded to (desktop, my docs etc) and check with Malwarebytes, Superantispyware and Avg antivirus.
Everything comes up clean every time, but with the trouble I've had lately that's obviously not the case.


Quite often the malware cannot be detected until the application is installed - some useful information here

I wish you every success with your class.


Thank-you kindly

CB
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI