1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

New Threat of Spyware and need help

Discussion in 'Virus & Other Malware Removal' started by zgrillo2004, Mar 31, 2008.

Thread Status:
Not open for further replies.
Advertisement
  1. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    Hi. I recently have the Virtumonde Adware. its a type O so its really Virtumonde-O. According to Adaware I made a scan and removed the adware but it appears again. this also happens with SpyBot as well. and Windows Defender has not fix the issue. I may also have other viruses in my system which I installed by accident. this is what happened. For some reason. the adware actually disabled the taskmanager feature which I think was the virus doing that because it made a registry . I made a system restore to a earlier time and it got rid most of the spyware. but not virtumonde. its still there and it needs to be removed. I can use the Task Manager feature Currently. Here is the Hijack This Log

    Thank you and Please help
    Zack

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:03:16 AM, on 3/31/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
    C:\WINDOWS\CTHELPER.EXE
    C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\CVSNT\cvslock.exe
    C:\WINDOWS\system32\WDBtnMgr.exe
    C:\Program Files\CVSNT\cvsservice.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\DCPFLICS\DCPFLICS.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
    C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
    C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\Program Files\Logitech\SetPoint\LBTWiz.exe
    C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\AIM6\aim6.exe
    C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    C:\Program Files\Chameleon Clock\ChamClock.exe
    C:\Program Files\BoincLogX\boinclogx.exe
    C:\Program Files\ooVoo\ooVoo.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\UPHClean\uphclean.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\Program Files\VentSrv\ventrilo_svc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\VentSrv\ventrilo_srv.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\system32\WTablet\TabUserW.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
    C:\WINDOWS\system32\MsiExec.exe
    C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es
    O2 - BHO: (no name) - AutorunsDisabled - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: (no name) - {A3804E2C-C67F-4E37-8B6A-E3400A317A5E} - C:\WINDOWS\Help\nvcpl\faxinfo.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
    O4 - HKLM\..\Run: [Easy Synchronization] "C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe --ports
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [HomeAlarm] C:\Program Files\Chameleon Clock\ChamClock.exe
    O4 - HKCU\..\Run: [BoincLogX] "C:\Program Files\BoincLogX\boinclogx.exe"
    O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://extract.cr.usgs.gov
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - https://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
    O16 - DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} (DigiMeldOcx Control) - http://www.digimeld.com/download/digimeldOcx.CAB
    O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zuma/sis/popcaploader_v10.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: faxinfo - C:\WINDOWS\Help\nvcpl\faxinfo.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: CVSNT Locking Service 2.5.03.2382 (cvslock) - Unknown owner - C:\Program Files\CVSNT\cvslock.exe
    O23 - Service: CVSNT Dispatch service 2.5.03.2382 (cvsnt) - March Hare Software Ltd - C:\Program Files\CVSNT\cvsservice.exe
    O23 - Service: DCPFLICS - Unknown owner - C:\Program Files\DCPFLICS\DCPFLICS.exe
    O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: SimCity4 Startup Manager Service (sc4stupmngrService) - Unknown owner - C:\Program Files\SimCity4 StartupManager\sumservice.exe
    O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
    O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

    --
    End of file - 20159 bytes
     
  2. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Run HJT again and put a check in the following:

    R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O1 - Hosts: 66.98.148.65 auto.search.msn.com
    O1 - Hosts: 66.98.148.65 auto.search.msn.es
    O2 - BHO: (no name) - AutorunsDisabled - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {A3804E2C-C67F-4E37-8B6A-E3400A317A5E} - C:\WINDOWS\Help\nvcpl\faxinfo.dll
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...loader_v10.cab

    Close all applications and browser windows before you click "fix checked".



    Please visit this webpage for instructions for downloading and running ComboFix.

    Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
     
  3. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    Here the Combofix Log

    ComboFix 08-03-30.4 - Owner 2008-03-31 15:59:00.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1107 [GMT -4:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\install.exe
    C:\WINDOWS\system32\eeabaabffe3_r.dll
    C:\WINDOWS\system32\vrty.exe
    C:\WINDOWS\system32\winfrun32.bin
    F:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 )))))))))))))))))))))))))))))))
    .

    2008-03-30 17:34 . 2008-03-30 17:34 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Auriga Imaging
    2008-03-30 17:30 . 2008-03-30 17:30 <DIR> d-------- C:\Program Files\Auriga Imaging
    2008-03-30 17:15 . 2008-03-30 17:16 <DIR> d-------- C:\Program Files\Winamp
    2008-03-30 17:15 . 2008-03-30 17:21 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Winamp
    2008-03-30 15:37 . 2008-03-30 15:38 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-03-30 15:37 . 2008-03-30 16:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-30 00:18 . 2008-03-30 00:18 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007
    2008-03-29 22:43 . 2008-03-29 22:43 <DIR> d-------- C:\Program Files\Alwil Software
    2008-03-29 22:22 . 2008-03-30 00:18 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Subversion
    2008-03-29 21:34 . 2008-03-30 00:18 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007(2)
    2008-03-29 21:25 . 2008-03-30 00:18 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
    2008-03-29 21:08 . 2008-03-29 21:08 360,064 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2008-03-29 20:43 . 2008-03-29 20:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-03-29 00:33 . 2008-03-29 00:33 180,224 --ahs---- C:\WINDOWS\system32\oipnd.dll
    2008-03-29 00:33 . 2008-03-29 00:33 180,224 --ahs---- C:\WINDOWS\system32\fvtwb.dll
    2008-03-28 17:26 . 2008-03-28 17:26 <DIR> d-------- C:\Program Files\eRightSoft
    2008-03-28 17:26 . 2008-03-28 17:26 <DIR> d-------- C:\Program Files\AviSynth 2.5
    2008-03-28 17:21 . 2008-03-28 17:21 <DIR> d-------- C:\Program Files\Riva
    2008-03-28 17:21 . 2008-03-28 17:21 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
    2008-03-28 12:12 . 2008-03-28 12:12 <DIR> d-------- C:\Program Files\KMOD! NaW Diag
    2008-03-27 17:08 . 2008-03-30 03:12 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-03-27 17:08 . 2008-03-27 17:08 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-03-25 22:17 . 2008-03-25 22:17 40 --ah----- C:\WINDOWS\system32\ivireg.ivr
    2008-03-24 11:30 . 2008-03-24 11:34 3,350 --ahs---- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
    2008-03-24 11:30 . 2008-03-24 11:30 88 -r-hs---- C:\Documents and Settings\All Users\Application Data\79C494C3C9.sys
    2008-03-24 11:29 . 2008-03-24 11:29 <DIR> d-------- C:\Program Files\Common Files\xing shared
    2008-03-24 11:29 . 2005-09-20 17:27 10,368 --a------ C:\WINDOWS\system32\drivers\iviaspi.sys
    2008-03-24 11:28 . 2008-03-24 11:28 <DIR> d-------- C:\Program Files\InterVideo
    2008-03-24 11:28 . 2008-03-24 11:28 <DIR> d-------- C:\Program Files\Common Files\Protexis
    2008-03-24 11:28 . 2008-03-24 11:28 <DIR> d-------- C:\Program Files\Common Files\InterVideo
    2008-03-24 00:23 . 2008-03-24 00:23 303 --a------ C:\WINDOWS\ST6UNST.000
    2008-03-24 00:22 . 2008-03-24 00:22 <DIR> d-------- C:\Program Files\Generator
    2008-03-20 15:30 . 2008-03-31 14:49 <DIR> d-------- C:\Descent2
    2008-03-15 21:44 . 2008-03-21 15:49 <DIR> d-------- C:\Program Files\Vision Video Games
    2008-03-14 22:39 . 2008-03-14 22:39 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Earthsim
    2008-03-14 22:31 . 2008-03-14 22:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Earthsim
    2008-03-13 19:06 . 2008-03-13 19:06 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-03-11 13:45 . 2008-03-11 13:45 314 --a------ C:\WINDOWS\milkj2.ini
    2008-03-11 13:43 . 2008-03-11 13:48 <DIR> d-------- C:\Program Files\MilkJunkies2
    2008-03-11 13:43 . 2000-06-21 03:49 32,768 -ra------ C:\WINDOWS\UINSTamp.exe
    2008-03-11 12:13 . 2008-03-11 12:13 8 --a------ C:\WINDOWS\system32\PROTOCOL.INI
    2008-03-10 01:55 . 2008-03-10 01:55 338 --a------ C:\WINDOWS\d3xp.ini
    2008-03-10 01:52 . 2008-03-10 01:52 331 --a------ C:\WINDOWS\doom3.ini
    2008-03-10 01:51 . 2008-03-10 01:55 <DIR> d-------- C:\Program Files\Doom 3
    2008-03-10 01:46 . 2008-03-10 01:46 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
    2008-03-10 01:46 . 2008-03-10 01:46 <DIR> d-------- C:\Program Files\MSECACHE
    2008-03-06 16:21 . 2008-03-06 16:29 <DIR> d-------- C:\Program Files\IFH
    2008-03-01 16:29 . 2008-03-01 23:49 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Command & Conquer 3 Tiberium Wars
    2008-02-29 02:49 . 2008-02-29 02:52 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SoundSpectrum
    2008-02-29 02:36 . 2008-03-03 02:55 <DIR> d-------- C:\Program Files\SoundSpectrum
    2008-02-28 11:49 . 2008-02-28 12:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Screaming Bee
    2008-02-28 11:49 . 2008-02-28 19:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Screaming Bee
    2008-02-28 11:46 . 2008-02-28 11:58 <DIR> d-------- C:\Program Files\Screaming Bee
    2008-02-28 11:46 . 2008-02-28 11:46 <DIR> d-------- C:\Program Files\Common Files\Screaming Bee
    2008-02-24 22:29 . 2008-02-24 22:29 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Subversion
    2008-02-24 22:28 . 2008-02-24 22:28 <DIR> d-------- C:\Program Files\TortoiseSVN
    2008-02-24 16:17 . 2008-02-24 16:17 <DIR> d-------- C:\Program Files\gmod9
    2008-02-24 16:17 . 2008-02-24 16:40 <DIR> d-------- C:\GMOD10
    2008-02-23 11:42 . 2008-03-24 10:25 <DIR> d-------- C:\Program Files\ooVoo
    2008-02-23 11:42 . 2008-02-23 11:43 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\ooVoo Details
    2008-02-22 18:12 . 2008-03-28 17:34 <DIR> d-------- C:\Program Files\Blaze Media Pro
    2008-02-22 18:11 . 2008-03-30 16:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
    2008-02-21 16:34 . 2008-02-21 16:34 <DIR> d-------- C:\WINDOWS\uninstall\Razorworks
    2008-02-21 16:34 . 2008-02-21 16:34 <DIR> d-------- C:\WINDOWS\uninstall
    2008-02-21 16:34 . 2008-02-21 16:42 <DIR> d-------- C:\Program Files\Razorworks
    2008-02-18 01:44 . 2008-02-18 01:44 <DIR> d--h----- C:\Documents and Settings\All Users\Application Data\{0E8E33D8-193A-414A-A909-0F101A142D26}
    2008-02-18 01:42 . 2008-02-18 01:42 <DIR> d-------- C:\Program Files\Stardock Games
    2008-02-15 20:27 . 2008-02-15 20:27 <DIR> d-------- C:\WINDOWS\Starships Unlimited v3
    2008-02-15 19:29 . 2008-03-04 18:38 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\My Games
    2008-02-15 19:28 . 2008-02-16 14:21 <DIR> d-------- C:\Program Files\Firaxis Games
    2008-02-15 16:04 . 2008-03-28 21:33 <DIR> d-------- C:\Program Files\Starry Night Pro Plus 6
    2008-02-15 16:01 . 2008-02-15 16:01 <DIR> d-------- C:\Program Files\QuickTime
    2008-02-15 15:47 . 2008-02-15 15:47 23 --a------ C:\WINDOWS\system32\afdeec_r.ocx
    2008-02-06 16:06 . 2008-02-06 16:06 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\GOOD AFTERNOON
    2008-02-06 09:41 . 2008-02-06 09:41 <DIR> d-------- C:\WINDOWS\nview
    2008-02-06 09:41 . 2008-02-06 09:43 <DIR> d-------- C:\WINDOWS\NV16161624.TMP
    2008-02-06 09:41 . 2007-10-04 18:14 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
    2008-02-06 09:41 . 2008-03-16 09:54 140,158 --a------ C:\WINDOWS\system32\nvapps.xml
    2008-02-06 09:36 . 2008-02-06 09:36 262,144 --a------ C:\WINDOWS\system32\default_user_class.dat
    2008-02-06 09:33 . 2008-02-06 09:33 <DIR> d-------- C:\Program Files\UPHClean
    2008-02-06 09:13 . 2008-02-06 09:17 <DIR> d-------- C:\WINDOWS\NV81168112.TMP
    2008-02-06 09:13 . 2008-02-06 09:34 <DIR> d-------- C:\NVIDIA
    2008-02-06 09:04 . 2007-10-04 18:14 17,525 --a------ C:\WINDOWS\system32\nvdisp.nvu
    2008-02-06 09:03 . 2007-12-05 03:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
    2008-02-05 21:58 . 2008-02-05 22:05 <DIR> d-------- C:\Ecco
    2008-02-05 21:58 . 2008-02-05 21:59 69 --a------ C:\WINDOWS\Ecco.ini
    2008-02-05 15:50 . 2008-03-04 16:04 <DIR> d-------- C:\Program Files\AnyZip
    2008-02-04 20:44 . 2008-02-04 21:09 16,448 --a------ C:\v3dMission0.bai
    2008-02-04 20:44 . 2008-02-04 21:09 1,884 --a------ C:\hideMission0.bai
    2008-02-04 20:44 . 2008-02-04 21:09 264 --a------ C:\vertsMission0.bai
    2008-02-04 20:44 . 2008-02-04 21:09 68 --a------ C:\fnavMission0.bai
    2008-02-04 20:44 . 2008-02-04 21:09 36 --a------ C:\areasMission0.bai
    2008-02-04 20:44 . 2008-02-04 21:09 8 --a------ C:\waypt3DsfcMission0.bai
    2008-02-04 20:44 . 2008-02-04 21:09 8 --a------ C:\roadnavMission0.bai
    2008-02-04 20:27 . 2008-03-01 16:23 <DIR> d-------- C:\Program Files\Electronic Arts
    2008-02-04 20:13 . 2008-02-04 21:09 1,884 --a------ C:\netMission0.bai
    2008-02-03 21:48 . 2008-02-03 21:48 <DIR> d-------- C:\Documents and Settings\Owner\Bluetooth Software
    2008-02-03 21:46 . 2008-02-03 21:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-02-03 21:45 . 2008-02-03 21:45 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2008-02-03 21:43 . 2008-02-03 21:43 <DIR> d-------- C:\Program Files\Common Files\Logishrd
     
  4. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-31 20:07 --------- d-----w C:\Program Files\Chameleon Clock
    2008-03-31 20:07 --------- d-----w C:\Documents and Settings\Owner\Application Data\WTablet
    2008-03-31 20:03 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-03-31 19:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\Skype
    2008-03-31 08:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-03-31 07:44 --------- d-----w C:\Documents and Settings\Owner\Application Data\LucasArts
    2008-03-31 00:51 --------- d-----w C:\Documents and Settings\Owner\Application Data\uTorrent
    2008-03-30 20:42 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-03-30 20:07 --------- d-----w C:\Program Files\TortoiseCVS
    2008-03-30 20:06 --------- d-----w C:\Program Files\GlobalMapper9
    2008-03-30 20:06 --------- d-----w C:\Program Files\BOINC
    2008-03-30 20:06 --------- d-----w C:\Program Files\AlphaZIP
    2008-03-30 20:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Bioshock
    2008-03-30 08:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-30 06:10 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-03-30 04:19 --------- d-----w C:\Documents and Settings\Owner\Application Data\Xfire
    2008-03-30 04:18 --------- d-----w C:\Program Files\Orbiter 2006
    2008-03-30 01:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\wsInspector
    2008-03-30 00:43 --------- d-----w C:\Program Files\Lavasoft
    2008-03-29 20:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-03-27 00:34 --------- d-----w C:\Program Files\Xfire
    2008-03-26 22:15 --------- d-----w C:\Program Files\Norton Internet Security
    2008-03-26 16:41 --------- d-----w C:\Program Files\THQ
    2008-03-26 16:36 11,842 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
    2008-03-24 15:30 --------- d-----w C:\Documents and Settings\Owner\Application Data\Corel
    2008-03-24 15:29 --------- d-----w C:\Program Files\Real
    2008-03-24 15:29 --------- d-----w C:\Program Files\Common Files\Real
    2008-03-24 15:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-24 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
    2008-03-24 15:27 --------- d-----w C:\Program Files\Corel
    2008-03-24 14:31 --------- d-----w C:\Program Files\TinkleBell
    2008-03-24 04:23 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2008-03-24 04:23 286,720 ------w C:\WINDOWS\Setup1.exe
    2008-03-22 05:24 --------- d-----w C:\Program Files\SpaceShuttleMission2007
    2008-03-22 05:24 --------- d-----w C:\Program Files\FlashGet
    2008-03-21 22:51 --------- d-----w C:\Program Files\Counter-Strike 1.6
    2008-03-21 06:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\GRLevel3
    2008-03-20 10:11 --------- d-----w C:\Program Files\BoincLogX
    2008-03-20 08:39 --------- d-----w C:\Program Files\TuneUp Utilities 2007
    2008-03-16 01:11 --------- d-----w C:\Program Files\Java
    2008-03-15 02:31 --------- d-----w C:\Program Files\VirturalWeatherStation
    2008-03-15 02:30 --------- d-----w C:\Program Files\WeatherLink
    2008-03-13 00:11 --------- d-----w C:\Program Files\OpenTTD
    2008-03-07 02:23 --------- d-----w C:\Program Files\VentSrv
    2008-03-06 20:46 --------- d-----w C:\Program Files\SBaGen
    2008-03-05 18:21 --------- d-----w C:\Program Files\Sierra
    2008-03-04 22:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-03-04 22:20 --------- d-----w C:\Program Files\Uplink Demo
    2008-03-04 22:19 --------- d-----w C:\Program Files\Mumble
    2008-03-04 21:18 --------- d-----w C:\Program Files\7-Zip
    2008-02-27 01:31 --------- d-----w C:\Program Files\Teamspeak2_RC2
    2008-02-20 02:38 --------- d-----w C:\Program Files\AIM6
    2008-02-20 02:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-02-15 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-02-06 12:50 --------- d-----w C:\Program Files\Intel
    2008-02-06 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avocent AdminWorks
    2008-02-05 01:32 --------- d-----w C:\Program Files\DivX
    2008-02-05 00:38 22,328 ----a-w C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
    2008-02-04 01:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2008-02-04 01:40 --------- d-----w C:\Program Files\Logitech
    2008-02-04 01:37 --------- d-----w C:\Program Files\Common Files\Logitech
    2008-02-04 01:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\Logitech
    2008-02-03 18:48 --------- d-----w C:\Documents and Settings\Owner\Application Data\Sony
    2008-02-02 03:12 --------- d-----w C:\Program Files\Activision
    2008-02-02 00:03 --------- d-----w C:\Program Files\IDoser v4
    2008-01-29 03:51 --------- d-----w C:\Documents and Settings\Owner\Application Data\Sierra Entertainment
    2008-01-28 23:23 --------- d-----w C:\Program Files\Celestia 1.5.0
    2008-01-28 01:51 2,858 ----a-w C:\Program Files\INSTALL.LOG
    2007-12-28 13:28 262,144 ----a-w C:\ntuser.dat
    2007-12-18 05:03 94,208 ----a-w C:\WINDOWS\ScUnin.exe
    2007-07-04 22:02 3,434 ----a-w C:\Documents and Settings\Owner\Application Data\SAS7_000.DAT
    2007-06-18 07:35 6,309 ----a-w C:\Program Files\uninstal.log
    2007-06-14 19:57 57,344 ----a-w C:\Documents and Settings\Owner\iSetupNI.dll
    2007-04-03 05:55 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\1doc2pdf.dll
    2007-03-19 03:00 10,512 ----a-w C:\Documents and Settings\Owner\Device.dat
    2005-05-12 04:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    2003-12-18 16:33 20,102 ----a-w C:\Program Files\Readme.txt
    2003-09-03 12:46 10,960 ----a-w C:\Program Files\EULA.txt
    2007-08-17 20:21 8 --sh--r C:\WINDOWS\system32\79C494C3C9.sys
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-08-17 20:23 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
     
  5. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
    @={30351346-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
    @={30351347-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
    @={30351348-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
    @={3035134B-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
    @={3035134C-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
    @={3035134D-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
    @={3035134E-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS0]
    @={5d1cb710-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS1]
    @={5d1cb711-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS2]
    @={5d1cb712-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS3]
    @={5d1cb713-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS4]
    @={5d1cb714-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS5]
    @={5d1cb715-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS6]
    @={5d1cb716-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb710-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb711-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb712-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb713-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb714-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb715-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb716-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:44 140288]
    "Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 12:15 50528]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 08:00 15360]
    "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
    "HomeAlarm"="C:\Program Files\Chameleon Clock\ChamClock.exe" [2006-10-26 22:25 915456]
    "BoincLogX"="C:\Program Files\BoincLogX\boinclogx.exe" [2006-07-03 19:33 1115136]
    "ooVoo.exe"="C:\Program Files\ooVoo\ooVoo.exe" [2008-03-20 16:18 12408624]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
    "CTHelper"="CTHELPER.EXE" [2006-08-17 12:32 17920 C:\WINDOWS\CTHELPER.EXE]
    "CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 12:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
    "WD Button Manager"="WDBtnMgr.exe" [2007-02-24 20:36 339968 C:\WINDOWS\system32\WDBtnMgr.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-03-15 08:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-03-15 08:00 455168]
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-03-15 08:00 59392]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-03-15 08:00 208952]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 05:04 59392]
    "CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00 45056]
    "Easy Synchronization"="C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 12:00 53248]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24 71216]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21 54832]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 12:42 58728]
    "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-07-09 01:57 100056]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
    "Bluetooth Connection Assistant"="LBTWIZ.exe" []
    "NvCplDaemon"="RUNDLL32.exe" [2006-03-15 08:00 33280 C:\WINDOWS\system32\rundll32.exe]
    "nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="RUNDLL32.exe" [2006-03-15 08:00 33280 C:\WINDOWS\system32\rundll32.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
    "TkBellExe"="C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" [2008-03-24 11:29 180269]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Easy Synchronization"="C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 12:00 53248]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-29 23:37:20 561213]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
    HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 01:49:24 73728]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-02-03 21:50:49 789008]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{FE24CD78-7C63-465D-8787-4EDF7FC79895}"= C:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll [2005-10-05 12:00 69632]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\faxinfo]
    C:\WINDOWS\Help\nvcpl\faxinfo.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
    C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-12-25 17:29 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=wbsys.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 setuid

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WD Backup Monitor.lnk]
    backup=C:\WINDOWS\pss\WD Backup Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MagicDisc.lnk]
    backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
     
  6. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    Code:
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
    "C:\\Program Files\\backburner 2\\monitor.exe"=
    "C:\\Program Files\\backburner 2\\manager.exe"=
    "C:\\Program Files\\backburner 2\\server.exe"=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Program Files\\Infogrames\\Independence War 2 - Edge of Chaos\\bin\\release\\loader.exe"=
    "C:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
    "C:\\Program Files\\Microsoft Games\\Freelancer\\EXE\\Freelancer.exe"=
    "C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
    "C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
    "C:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=
    "C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"=
    "C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\FlashGet\\flashget.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
    "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "443:UDP"= 443:UDP:*:Disabled:ooVoo UDP port 443
    "37674:TCP"= 37674:TCP:*:Disabled:ooVoo TCP port 37674
    "37674:UDP"= 37674:UDP:*:Disabled:ooVoo UDP port 37674
    "37675:UDP"= 37675:UDP:*:Disabled:ooVoo UDP port 37675
    "37676:TCP"= 37676:TCP:*:Disabled:ooVoo TCP port 37676
    "37676:UDP"= 37676:UDP:*:Disabled:ooVoo UDP port 37676
    "37677:UDP"= 37677:UDP:*:Disabled:ooVoo UDP port 37677
    "443:TCP"= 443:TCP:*:Disabled:ooVoo TCP port 443
    
    R0 mv61xx;mv61xx;C:\WINDOWS\system32\drivers\mv61xx.sys [2006-11-14 09:32]
    R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51]
    R2 ArcGIS License Manager;ArcGIS License Manager;C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe [1999-12-01 13:38]
    R2 Marvell RAID;Marvell RAID Event Agent;C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe [2006-08-09 23:46]
    R2 MRUWebService;MRU Web Service;"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe" -k runservice []
    R2 PSI_SVC_2;Protexis Licensing V2;"C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [2007-07-24 11:15]
    R2 regi;regi;C:\WINDOWS\system32\drivers\regi.sys [2007-04-17 20:09]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-01-28 18:01]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-15 08:00]
    R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 12:16]
    S3 PciCon;PciCon;D:\PciCon.sys []
    S3 pnicml;pnicml;C:\DOCUME~1\Owner\LOCALS~1\Temp\pnicml.sys [2006-08-13 17:33]
    S3 sc4stupmngrService;SimCity4 Startup Manager Service;C:\Program Files\SimCity4 StartupManager\sumservice.exe [2007-06-02 20:38]
    S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-27 00:21]
    S3 SIUSBXP;SIUSBXP;C:\WINDOWS\system32\drivers\SiUSBXp.sys [2007-03-01 12:11]
    S3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys []
    S3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys []
    S3 ysffp_sd;ysffp_sd;C:\DOCUME~1\Owner\LOCALS~1\Temp\ysffp_sd.sys []
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
    UxTuneUp
    
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-03-30 13:38:53 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
    "2008-03-05 12:57:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-03-31 20:09:35 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2008-03-30 18:53:40 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Owner.job"
    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/task:
    .
    **************************************************************************
    
    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url]http://www.gmer.net[/url]
    Rootkit scan 2008-03-31 16:07:00
    Windows 5.1.2600 Service Pack 2 NTFS
    
    scanning hidden processes ... 
    
    scanning hidden autostart entries ...
    
    scanning hidden files ... 
    
    scan completed successfully 
    hidden files: 0 
    
    **************************************************************************
    
    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
    "ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    
    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\Program Files\TortoiseSVN\iconv\_tbl_simple.so
    -> C:\Program Files\TortoiseSVN\iconv\windows-1252.so
    -> C:\Program Files\TortoiseSVN\iconv\utf-8.so
    -> C:\Program Files\Stardock\Object Desktop\WindowBlinds\tray.dll
    -> C:\WINDOWS\system32\nvshell.dll
    -> C:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\CVSNT\cvslock.exe
    C:\Program Files\CVSNT\cvsservice.exe
    C:\Program Files\DCPFLICS\DCPFLICS.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    C:\Program Files\Logitech\SetPoint\LBTWiz.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
    C:\Program Files\Common Files\AOL\Loader\aolload.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
    C:\Program Files\UPHClean\uphclean.exe
    C:\Program Files\VentSrv\ventrilo_svc.exe
    C:\Program Files\VentSrv\ventrilo_srv.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\WINDOWS\ehome\mcrdsvc.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    .
    **************************************************************************
    .
    Completion time: 2008-03-31 16:11:09 - machine was rebooted [Owner]
    ComboFix-quarantined-files.txt  2008-03-31 20:10:59
    Pre-Run: 514,036,944,896 bytes free
    Post-Run: 513,831,612,416 bytes free
    .
    2008-03-27 18:18:39	--- E O F ---
     
  7. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    And Heres the HijackThis Log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:12:17 PM, on 3/31/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\CVSNT\cvslock.exe
    C:\Program Files\CVSNT\cvsservice.exe
    C:\Program Files\DCPFLICS\DCPFLICS.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
    C:\WINDOWS\CTHELPER.EXE
    C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
    C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
    C:\WINDOWS\system32\WDBtnMgr.exe
    C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Logitech\SetPoint\LBTWiz.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
    C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\Program Files\Common Files\AOL\Loader\aolload.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\UPHClean\uphclean.exe
    C:\Program Files\VentSrv\ventrilo_svc.exe
    C:\Program Files\VentSrv\ventrilo_srv.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
    O4 - HKLM\..\Run: [Easy Synchronization] "C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe --ports
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [HomeAlarm] C:\Program Files\Chameleon Clock\ChamClock.exe
    O4 - HKCU\..\Run: [BoincLogX] "C:\Program Files\BoincLogX\boinclogx.exe"
    O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://extract.cr.usgs.gov
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - https://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
    O16 - DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} (DigiMeldOcx Control) - http://www.digimeld.com/download/digimeldOcx.CAB
    O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: faxinfo - C:\WINDOWS\Help\nvcpl\faxinfo.dll (file missing)
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: CVSNT Locking Service 2.5.03.2382 (cvslock) - Unknown owner - C:\Program Files\CVSNT\cvslock.exe
    O23 - Service: CVSNT Dispatch service 2.5.03.2382 (cvsnt) - March Hare Software Ltd - C:\Program Files\CVSNT\cvsservice.exe
    O23 - Service: DCPFLICS - Unknown owner - C:\Program Files\DCPFLICS\DCPFLICS.exe
    O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: SimCity4 Startup Manager Service (sc4stupmngrService) - Unknown owner - C:\Program Files\SimCity4 StartupManager\sumservice.exe
    O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
    O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

    --
    End of file - 19288 bytes
     
  8. cybertech

    cybertech Retired Moderator

    Joined:
    Apr 16, 2002
    Messages:
    72,115
    Open Notepad and copy and paste the text in the quote box below into it:

    Save the file to you desktop and name it CFScript.txt

    Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

    [​IMG]

    This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.


    Please download ATF Cleaner by Atribune.
    This program is for XP and Windows 2000 only
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.

    Click Exit on the Main menu to close the program.



    Download (save and select your desktop to save it to) SUPERAntiSpyware Free for Home Users
    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
    • Under "Configuration and Preferences", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Scan for tracking cookies.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive and all other fixed drives..
    • On the right, under "Complete Scan", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    • Make sure everything has a checkmark next to it and click "Next".
    • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Please copy and paste the Scan Log results in your next reply with a new hijackthis log.
    • Click Close to exit the program.


    Please perform a scan with Kaspersky Webscan Online Virus Scanner
    • Read the Requirements and Privacy statement, then select "Accept".
    • A new window will appear promting you to install an ActiveX component from Kaspersky - "Do you want to install this software?".
    • Click "Yes" or select "Install" to download the ActiveX controls that allows ActiveScan to run.
    • When the download is complete it will say ready, click "Next".
    • Click "Scan Settings" and check the option to use the Extended Database if available otherwise Standard).
    • Click "Scan Options" and select both "Scan Archives" and "Scan Mail Bases".
    • Click "OK".
    • Under "Select a target to scan", click on "My Computer".
    • When the scan is complete choose to save the results as "Save as Text" named kaspersky.txt to your desktop and post them in your next reply.


    Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for Free Online Virus Scanner. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps here and reboot afterwards if your system does not reboot automatically or it will show 'Kaspersky Online Scanner license key was not found!
     
  9. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    Kaspersky Log

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, April 02, 2008 3:03:07 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 2/04/2008
    Kaspersky Anti-Virus database records: 677193
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\

    Scan Statistics:
    Total number of scanned objects: 570508
    Number of viruses found: 12
    Number of infected objects: 52
    Number of suspicious objects: 0
    Duration of the scan process: 07:30:38

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Creative\CADI\Preset\PCI_BUS1102-5-211102-1000.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\02ea1e414c546cb5af4f9a3d6c940a98_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\15368fb96c9d23e533cf9f24aedfd322_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\15df0d9baee481fd5565f89ad9a3b60c_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1745c6bff0fe1f10f7a3f63c51db68ba_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19bb8209af19ded90b735155cd239ce0_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1e060e773ed2764e1f70cd4adb700895_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1e3a6ebfb9ca04fe368a096f61041a03_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\21cb1344a3821b1f9f4915f5fea0588d_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\22d4ab225dc7694c9e98fd0a9e9f055b_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2899657896600ea9400d13a2c0994f17_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2c7f4870d169c3789abad38eaea2f04b_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2eb9d9c2ea90b6315f51bccf9051ad21_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3142885e29587e0579589b874e6456a4_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\35d14f1a0725a2e67212688ed2e1ae68_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3d242416f8dc8e1c14e244108a660a96_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\424b523fcdfc97dee47de160feb49ecc_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\42858265a6bf7ffd5ffce169dfd4d630_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4430da144a7e7ca3b5d8bf26b4b9da24_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\44893ab8839f458f4c921820d6e7f803_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4abfab286feda03a81339532b1a63a49_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\513c984a21f7f6776d6627d52146e431_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\576938f1d953a7fcd8a23b2e32cd68d8_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\58c46dae4e3f345161857e777fee19e3_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5fd002d0392a5670fa64c8259d6c857c_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5fd2d6b1b537e7a53732e9b298b225d2_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\60b7df55244fdc236817f9f41c90b3af_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\63dbfc75eae2701109c6d81cb087882c_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7144e579a05cf3b27f991ebedd4ddde6_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\834472a8eebb4c768f2cfa098b78efa6_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8344af251bfa45a831248ea42658a45f_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\875dd53a37d339cc1621255308640058_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\896679ecb3c33ef54701e9ab9301c956_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b365e38e22902d6734ff602ad1a1b76_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8bb668c0ee65912e1aca67b4a2246fa3_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8c37edaeb0ff0de2f3e2cd83ca06d304_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8cf6625eca8bf4a1e0c6a11cb1a65740_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\90b5ba85672abb3f192252a4f123b510_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\91146b62b7852f3672bbd7956aad9d8d_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9199286caffb68e6340ddfd2beb1244b_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95388a2fe6de529e4e8df5ce4d36285e_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9a2e06ea65f45aa3df7261d2542656e4_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ad454e87c7915e4da55cd4988b9aa421_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ae3a81f712d30385f2ec656507d9fa11_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aea105a20391c46e2d813de7cafbb715_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b1d0749a3d7bd14ae8b5871338470eb4_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b32bfee8795944c074c20c648cb7f86f_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b32ffef48609f8711ed8e969c2e5d923_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b40590dbd1f679da8514cc2ad3748c57_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bd6cf682b3ac5e55685ef4458902edb9_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2f2689ec69156d630c4f0b9cba6180b_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c3026e79128edc9c49dd2731534255d9_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c777953820563e862b39cd2a50fc81d6_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c86903968d6d5e8542dd45b6d1765c99_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ce78e03f3bab7502769d25b8166712ca_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d8dd3dcd9a1f19665df10d7011d52fc5_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\dc197c5c572508c48f38a083ae0baa57_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\de0841d9e5ef39dd4b88b35e636d1fae_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e40122b1200d24c1c883bf12c77f6274_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e4a7cb1d7144077df340953c5cf75b2e_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eaa043faeeb75827a82df8c63d6508ae_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ed26d58d292f57f4bc34e55dfe11988a_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ed4883f33c61c0445f5e4cc6d6532801_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f31f4acb5f5616e33087b5ce6e6af99b_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fdb64579f3fcbbf1d5635f11d76e88f4_60b6c60d-1e26-44c8-9d94-38f29e40b008 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-06142007-003117.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-04-02_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\cert8.db Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\flashgot.log Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\formhistory.dat Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\history.dat Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\key3.db Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\parent.lock Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\call256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\callmember256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\chat512.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\chatmember256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\chatmsg256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\chatmsg512.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\contactgroup256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\dyncontent\bundle.dat Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\index2.dat Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\profile256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\transfer512.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\user1024.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\user16384.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\Skype\zgrillo2004\voicemail256.dbb Object is locked skipped
    C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-4-1-2008( 15-2-59 ).LOG Object is locked skipped
    C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Owner\Desktop\HiJackThis\backups\backup-20080331-155330-584.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe\Acrobat\8.0\Updater\updater.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Adobe\Updater5\aumLib.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\common.cls Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\AOL OCP\AIM\Storage\data\zgrillo88654325\localStorage\common.cls Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\ApplicationHistory\hpqimzone.exe.3204510e.ini.inuse Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\propertiesTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\pending.dat Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_20EC_46D4_EC46_A3BE\dfsr.db Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_20EC_46D4_EC46_A3BE\fsr.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_20EC_46D4_EC46_A3BE\fsrtmp.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_20EC_46D4_EC46_A3BE\tmp.edb Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{B4ED1FC9-2CE6-4A11-9B4F-B1795BA64B24} Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\real\members.stg Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\shadow\members.stg Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\tmvjyg5q.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008040120080402\index.dat Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008040220080403\index.dat Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\$AR2092.tmp Object is locked skipped
     
  10. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    C:\Documents and Settings\Owner\Local Settings\Temp\hpodvd09.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\IMG17F0.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\IMG18BB.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo10 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo11 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo12 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo13 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo14 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo15 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo16 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo17 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo18 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo19 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo2 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo20 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo21 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo22 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo23 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo24 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo25 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo26 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo27 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo28 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo29 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo3 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo30 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo31 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo32 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo33 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo4 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo5 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo6 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo7 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo8 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lilo9 Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\lmgrd9.log Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\Perflib_Perfdata_cd8.dat Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\~DF2EF9.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\~DF6D79.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\~DF6DF1.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\~DF89FD.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temp\~DF8A1D.tmp Object is locked skipped
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Active.Desktop.Calendar.6.3.Build.060817-=(E.D)=-BRD.(osloskop.net).rar/Active Desktop Calendar 6.3 Build 060817-=(E.D)=-BRD/adc.exe/file062 Infected: not-a-virus:Monitor.Win32.KeyPressHooker.c skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Active.Desktop.Calendar.6.3.Build.060817-=(E.D)=-BRD.(osloskop.net).rar/Active Desktop Calendar 6.3 Build 060817-=(E.D)=-BRD/adc.exe Infected: not-a-virus:Monitor.Win32.KeyPressHooker.c skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Active.Desktop.Calendar.6.3.Build.060817-=(E.D)=-BRD.(osloskop.net).rar RAR: infected - 2 skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Sitni.Sati.Afterburn.v3.2a.for.3DS.Max.9.x32-BB3D.zip/Sitni.Sati.Afterburn.v3.2a.for.3DS.Max.9.x32-BB3D/AfterBurn 3.2a for 3ds max 9 32Bit.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Sitni.Sati.Afterburn.v3.2a.for.3DS.Max.9.x32-BB3D.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Sitni.Sati.FumeFX.v1.0.for.3DS.Max.9.x32-BB3D.zip/Sitni.Sati.FumeFX.v1.0.for.3DS.Max.9.x32-BB3D/FumeFX10_R9_32.EXE Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\Programs\Sitni.Sati.FumeFX.v1.0.for.3DS.Max.9.x32-BB3D.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\Registry.Mechanic.v6.0.0.780-TBE.rar/Registry.Mechanic.v6.0.0.780-TBE/Registry.Mechanic.v6.0 Patch.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\Registry.Mechanic.v6.0.0.780-TBE.rar/Registry.Mechanic.v6.0.0.780-TBE/Registry.Mechanic.v6.0..exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\Registry.Mechanic.v6.0.0.780-TBE.rar RAR: infected - 2 skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\Sitni.Sati.DreamScape.v2.5c.for.3DS.Max.9.x32-BB3D.zip/Sitni.Sati.DreamScape.v2.5c.for.3DS.Max.9.x32-BB3D/DreamScape 2.5c for 3ds max 9 32Bit.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\Sitni.Sati.DreamScape.v2.5c.for.3DS.Max.9.x32-BB3D.zip ZIP: infected - 1 skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\The.Panorama.Factory.v4.4.m32.Edition-dT.zip/The.Panorama.Factory.v4.4.m32.Edition-dT/keygen.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\The.Panorama.Factory.v4.4.m32.Edition-dT.zip/The.Panorama.Factory.v4.4.m32.Edition-dT/setup.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\The.Panorama.Factory.v4.4.m32.Edition-dT.zip ZIP: infected - 2 skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\The.Panorama.Factory.v4.4.m32.Edition.Incl.Keygen-dT.zip/The.Panorama.Factory.v4.4.m32.Edition.Incl.Keygen-dT/keygen.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\The.Panorama.Factory.v4.4.m32.Edition.Incl.Keygen-dT.zip/The.Panorama.Factory.v4.4.m32.Edition.Incl.Keygen-dT/setup.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\Documents and Settings\Owner\My Documents\The Terminal\The.Panorama.Factory.v4.4.m32.Edition.Incl.Keygen-dT.zip ZIP: infected - 2 skipped
    C:\Documents and Settings\Owner\ntuser.dat Object is locked skipped
    C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPPolicy.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPStart.log Object is locked skipped
    C:\Program Files\Common Files\Symantec Shared\SPStop.log Object is locked skipped
    C:\Program Files\Creative\ShareDLL\CADI\CTPLang.dat Object is locked skipped
    C:\Program Files\Marvell\61xx\Apache2\logs\access.log Object is locked skipped
    C:\Program Files\Marvell\61xx\Apache2\logs\error.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped
    C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped
    C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\RealVNC\VNC4\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\Program Files\VentSrv\ventrilo_srv.log Object is locked skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\fvtwb.dll.vir Infected: Trojan.Win32.Zapchast.fq skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\oipnd.dll.vir Infected: Trojan.Win32.Zapchast.fq skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183345.old Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183346.old Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183347.old Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183349.old Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183460.exe/file1 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183460.exe/file2 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183460.exe/file3 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183460.exe/file5 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP701\A0183460.exe Inno: infected - 4 skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198532.com Infected: Trojan.Win32.Buzus.aa skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198533.com Infected: Trojan.Win32.Buzus.aa skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198535.exe Infected: Trojan.Win32.Delf.acq skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198536.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198537.exe Infected: Backdoor.Win32.Hupigon.gay skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198538.exe Infected: Backdoor.Win32.Hupigon.gay skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP797\A0198539.exe Infected: Backdoor.Win32.Hupigon.gay skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP855\A0213788.dll Infected: not-a-virus:AdWare.Win32.Rabio.m skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP855\A0213791.dll Infected: not-a-virus:AdWare.Win32.Rabio.m skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP855\A0213857.dll Infected: Trojan.Win32.Zapchast.fq skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP856\A0214164.dll Infected: not-a-virus:AdWare.Win32.Rabio.m skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP856\A0214166.dll Infected: not-a-virus:AdWare.Win32.Rabio.m skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP856\A0214169.exe Infected: Trojan-Downloader.Win32.Homles.at skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP869\A0216215.dll Infected: Trojan.Win32.BHO.aoy skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP870\A0216232.dll Infected: Trojan.Win32.Zapchast.fq skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP870\A0216233.dll Infected: Trojan.Win32.Zapchast.fq skipped
    C:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP872\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b skipped
    C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F8E87FD8-211A-46E1-811A-12038CD861B0}.crmlog Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{2B562EC4-EF2E-4EAD-8EB6-073E340C322D}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
     
  11. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SB Insta.evt Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\ivireg.ivr Object is locked skipped
    C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
    C:\WINDOWS\system32\msexec.dll Infected: Trojan-Downloader.Win32.Agent.kht skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\Cookies\index.dat Object is locked skipped
    C:\WINDOWS\Temp\History\History.IE5\index.dat Object is locked skipped
    C:\WINDOWS\Temp\Perflib_Perfdata_a8c.dat Object is locked skipped
    C:\WINDOWS\Temp\Perflib_Perfdata_ea0.dat Object is locked skipped
    C:\WINDOWS\Temp\spnserv.dat Object is locked skipped
    C:\WINDOWS\Temp\spserv.dat Object is locked skipped
    C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\WINDOWS\Temp\TMP0000004B48A1F85245E488E9 Object is locked skipped
    C:\WINDOWS\Temp\TMP000003822DDC0F1F54B17532 Object is locked skipped
    C:\WINDOWS\Temp\TMP0000038379DF0AAED5B96868 Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    F:\Primary Backup\~ArcTFR.~$ArcSoftBackupTFR$ Object is locked skipped
    F:\Primary Backup\ArcNB80.NBZ Object is locked skipped
    F:\System Volume Information\_restore{C9DA8230-D68A-4DF7-BAB5-4F23B78C609E}\RP872\change.log Object is locked skipped

    Scan process completed.
     
  12. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    Combo Fix Log

    ComboFix 08-03-30.5 - Owner 2008-04-01 13:26:08.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.861 [GMT -4:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\milkj2.ini
    C:\WINDOWS\system32\fvtwb.dll
    C:\WINDOWS\system32\oipnd.dll
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\milkj2.ini
    C:\WINDOWS\system32\fvtwb.dll
    C:\WINDOWS\system32\oipnd.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
    .

    2008-04-01 00:51 . 2008-04-01 00:51 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
    2008-03-30 17:34 . 2008-03-30 17:34 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Auriga Imaging
    2008-03-30 17:30 . 2008-03-30 17:30 <DIR> d-------- C:\Program Files\Auriga Imaging
    2008-03-30 17:15 . 2008-03-31 22:37 <DIR> d-------- C:\Program Files\Winamp
    2008-03-30 17:15 . 2008-03-30 17:21 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Winamp
    2008-03-30 15:37 . 2008-03-30 15:38 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-03-30 15:37 . 2008-03-30 16:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-30 00:18 . 2008-03-30 00:18 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007
    2008-03-29 22:43 . 2008-03-29 22:43 <DIR> d-------- C:\Program Files\Alwil Software
    2008-03-29 22:22 . 2008-03-30 00:18 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Subversion
    2008-03-29 21:34 . 2008-03-30 00:18 <DIR> d-------- C:\Program Files\jv16 PowerTools 2007(2)
    2008-03-29 21:25 . 2008-03-30 00:18 <DIR> d-------- C:\WINDOWS\system32\GroupPolicy
    2008-03-29 21:08 . 2008-03-29 21:08 360,064 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2008-03-29 20:43 . 2008-03-29 20:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-03-28 17:26 . 2008-03-28 17:26 <DIR> d-------- C:\Program Files\eRightSoft
    2008-03-28 17:26 . 2008-03-28 17:26 <DIR> d-------- C:\Program Files\AviSynth 2.5
    2008-03-28 17:21 . 2008-03-28 17:21 <DIR> d-------- C:\Program Files\Riva
    2008-03-28 17:21 . 2008-03-28 17:21 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
    2008-03-28 12:12 . 2008-03-28 12:12 <DIR> d-------- C:\Program Files\KMOD! NaW Diag
    2008-03-27 17:08 . 2008-03-31 23:39 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-03-27 17:08 . 2008-03-27 17:08 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-03-25 22:17 . 2008-03-25 22:17 40 --ah----- C:\WINDOWS\system32\ivireg.ivr
    2008-03-24 11:30 . 2008-03-24 11:34 3,350 --ahs---- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
    2008-03-24 11:30 . 2008-03-24 11:30 88 -r-hs---- C:\Documents and Settings\All Users\Application Data\79C494C3C9.sys
    2008-03-24 11:29 . 2008-03-24 11:29 <DIR> d-------- C:\Program Files\Common Files\xing shared
    2008-03-24 11:29 . 2005-09-20 17:27 10,368 --a------ C:\WINDOWS\system32\drivers\iviaspi.sys
    2008-03-24 11:28 . 2008-03-24 11:28 <DIR> d-------- C:\Program Files\InterVideo
    2008-03-24 11:28 . 2008-03-24 11:28 <DIR> d-------- C:\Program Files\Common Files\Protexis
    2008-03-24 11:28 . 2008-03-24 11:28 <DIR> d-------- C:\Program Files\Common Files\InterVideo
    2008-03-24 00:23 . 2008-03-24 00:23 303 --a------ C:\WINDOWS\ST6UNST.000
    2008-03-24 00:22 . 2008-03-24 00:22 <DIR> d-------- C:\Program Files\Generator
    2008-03-20 15:30 . 2008-03-31 14:49 <DIR> d-------- C:\Descent2
    2008-03-15 21:44 . 2008-03-21 15:49 <DIR> d-------- C:\Program Files\Vision Video Games
    2008-03-14 22:39 . 2008-03-14 22:39 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Earthsim
    2008-03-14 22:31 . 2008-03-14 22:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Earthsim
    2008-03-13 19:06 . 2008-03-13 19:06 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
    2008-03-11 13:43 . 2008-03-11 13:48 <DIR> d-------- C:\Program Files\MilkJunkies2
    2008-03-11 13:43 . 2000-06-21 03:49 32,768 -ra------ C:\WINDOWS\UINSTamp.exe
    2008-03-11 12:13 . 2008-03-11 12:13 8 --a------ C:\WINDOWS\system32\PROTOCOL.INI
    2008-03-10 01:55 . 2008-03-10 01:55 338 --a------ C:\WINDOWS\d3xp.ini
    2008-03-10 01:52 . 2008-03-10 01:52 331 --a------ C:\WINDOWS\doom3.ini
    2008-03-10 01:51 . 2008-03-10 01:55 <DIR> d-------- C:\Program Files\Doom 3
    2008-03-10 01:46 . 2008-03-10 01:46 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
    2008-03-10 01:46 . 2008-03-10 01:46 <DIR> d-------- C:\Program Files\MSECACHE
    2008-03-06 16:21 . 2008-03-06 16:29 <DIR> d-------- C:\Program Files\IFH
    2008-03-01 16:29 . 2008-03-01 23:49 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Command & Conquer 3 Tiberium Wars

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-01 17:29 --------- d-----w C:\Program Files\Chameleon Clock
    2008-04-01 17:29 --------- d-----w C:\Documents and Settings\Owner\Application Data\WTablet
    2008-04-01 17:23 --------- d-----w C:\Documents and Settings\Owner\Application Data\uTorrent
    2008-04-01 04:52 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-04-01 00:44 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-03-31 21:04 --------- d-----w C:\Program Files\Orbiter 2006
    2008-03-31 20:09 --------- d-----w C:\Documents and Settings\Owner\Application Data\Skype
    2008-03-31 08:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-03-31 07:44 --------- d-----w C:\Documents and Settings\Owner\Application Data\LucasArts
    2008-03-30 20:07 --------- d-----w C:\Program Files\TortoiseCVS
    2008-03-30 20:06 --------- d-----w C:\Program Files\GlobalMapper9
    2008-03-30 20:06 --------- d-----w C:\Program Files\BOINC
    2008-03-30 20:06 --------- d-----w C:\Program Files\AlphaZIP
    2008-03-30 20:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\Bioshock
    2008-03-30 20:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\{CFAB4006-0AE0-414D-866A-DCB2C46553CF}
    2008-03-30 08:12 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-30 06:10 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-03-30 04:19 --------- d-----w C:\Documents and Settings\Owner\Application Data\Xfire
    2008-03-30 01:20 --------- d-----w C:\Documents and Settings\Owner\Application Data\wsInspector
    2008-03-30 00:43 --------- d-----w C:\Program Files\Lavasoft
    2008-03-29 20:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-03-29 01:33 --------- d-----w C:\Program Files\Starry Night Pro Plus 6
    2008-03-28 21:34 --------- d-----w C:\Program Files\Blaze Media Pro
    2008-03-27 00:34 --------- d-----w C:\Program Files\Xfire
    2008-03-26 22:15 --------- d-----w C:\Program Files\Norton Internet Security
    2008-03-26 16:41 --------- d-----w C:\Program Files\THQ
    2008-03-26 16:36 11,842 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
    2008-03-24 15:30 --------- d-----w C:\Documents and Settings\Owner\Application Data\Corel
    2008-03-24 15:29 --------- d-----w C:\Program Files\Real
    2008-03-24 15:29 --------- d-----w C:\Program Files\Common Files\Real
    2008-03-24 15:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-24 15:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Corel
    2008-03-24 15:27 --------- d-----w C:\Program Files\Corel
    2008-03-24 14:31 --------- d-----w C:\Program Files\TinkleBell
    2008-03-24 14:25 --------- d-----w C:\Program Files\ooVoo
    2008-03-24 04:23 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2008-03-24 04:23 286,720 ------w C:\WINDOWS\Setup1.exe
    2008-03-22 05:24 --------- d-----w C:\Program Files\SpaceShuttleMission2007
    2008-03-22 05:24 --------- d-----w C:\Program Files\FlashGet
    2008-03-21 22:51 --------- d-----w C:\Program Files\Counter-Strike 1.6
    2008-03-21 06:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\GRLevel3
    2008-03-20 10:11 --------- d-----w C:\Program Files\BoincLogX
    2008-03-20 08:39 --------- d-----w C:\Program Files\TuneUp Utilities 2007
    2008-03-16 01:11 --------- d-----w C:\Program Files\Java
    2008-03-15 02:31 --------- d-----w C:\Program Files\VirturalWeatherStation
    2008-03-15 02:30 --------- d-----w C:\Program Files\WeatherLink
    2008-03-13 00:11 --------- d-----w C:\Program Files\OpenTTD
    2008-03-07 02:23 --------- d-----w C:\Program Files\VentSrv
    2008-03-06 20:46 --------- d-----w C:\Program Files\SBaGen
    2008-03-05 18:21 --------- d-----w C:\Program Files\Sierra
    2008-03-04 22:38 --------- d-----w C:\Documents and Settings\Owner\Application Data\My Games
    2008-03-04 22:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-03-04 22:20 --------- d-----w C:\Program Files\Uplink Demo
    2008-03-04 22:19 --------- d-----w C:\Program Files\Mumble
    2008-03-04 21:18 --------- d-----w C:\Program Files\7-Zip
    2008-03-04 20:04 --------- d-----w C:\Program Files\AnyZip
    2008-03-03 06:55 --------- d-----w C:\Program Files\SoundSpectrum
    2008-03-01 20:23 --------- d-----w C:\Program Files\Electronic Arts
    2008-02-29 06:52 --------- d-----w C:\Documents and Settings\Owner\Application Data\SoundSpectrum
    2008-02-28 23:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Screaming Bee
    2008-02-28 16:04 --------- d-----w C:\Documents and Settings\Owner\Application Data\Screaming Bee
    2008-02-28 15:58 --------- d-----w C:\Program Files\Screaming Bee
    2008-02-28 15:46 --------- d-----w C:\Program Files\Common Files\Screaming Bee
    2008-02-27 01:31 --------- d-----w C:\Program Files\Teamspeak2_RC2
    2008-02-25 02:29 --------- d-----w C:\Documents and Settings\Owner\Application Data\Subversion
    2008-02-25 02:28 --------- d-----w C:\Program Files\TortoiseSVN
    2008-02-24 20:17 --------- d-----w C:\Program Files\gmod9
    2008-02-23 15:43 --------- d-----w C:\Documents and Settings\Owner\Application Data\ooVoo Details
    2008-02-21 20:42 --------- d-----w C:\Program Files\Razorworks
    2008-02-20 02:38 --------- d-----w C:\Program Files\AIM6
    2008-02-20 02:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
    2008-02-18 05:44 --------- d--h--w C:\Documents and Settings\All Users\Application Data\{0E8E33D8-193A-414A-A909-0F101A142D26}
    2008-02-18 05:42 --------- d-----w C:\Program Files\Stardock Games
    2008-02-16 18:21 --------- d-----w C:\Program Files\Firaxis Games
    2008-02-15 20:01 --------- d-----w C:\Program Files\QuickTime
    2008-02-15 20:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-02-06 20:06 --------- d-----w C:\Documents and Settings\Owner\Application Data\GOOD AFTERNOON
    2008-02-06 13:33 --------- d-----w C:\Program Files\UPHClean
    2008-02-06 12:50 --------- d-----w C:\Program Files\Intel
    2008-02-06 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avocent AdminWorks
    2008-02-05 01:32 --------- d-----w C:\Program Files\DivX
    2008-02-05 00:38 22,328 ----a-w C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
    2008-02-04 01:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-02-04 01:45 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2008-02-04 01:43 --------- d-----w C:\Program Files\Common Files\Logishrd
    2008-02-04 01:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2008-02-04 01:41 --------- d-----w C:\Program Files\WIDCOMM
    2008-02-04 01:40 --------- d-----w C:\Program Files\Logitech
    2008-02-04 01:37 --------- d-----w C:\Program Files\Common Files\Logitech
    2008-02-04 01:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\Logitech
    2008-02-03 18:48 --------- d-----w C:\Documents and Settings\Owner\Application Data\Sony
    2008-02-02 19:54 --------- d-----w C:\Program Files\Unity
    2008-02-02 03:12 --------- d-----w C:\Program Files\Activision
    2008-02-02 01:15 --------- d-----w C:\Program Files\World Machine
    2008-02-02 00:03 --------- d-----w C:\Program Files\IDoser v4
    2008-01-28 01:51 2,858 ----a-w C:\Program Files\INSTALL.LOG
    2007-07-04 22:02 3,434 ----a-w C:\Documents and Settings\Owner\Application Data\SAS7_000.DAT
    2007-06-18 07:35 6,309 ----a-w C:\Program Files\uninstal.log
    2007-06-14 19:57 57,344 ----a-w C:\Documents and Settings\Owner\iSetupNI.dll
    2007-04-03 05:55 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\1doc2pdf.dll
    2007-08-17 20:21 8 --sh--r C:\WINDOWS\system32\79C494C3C9.sys
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-08-17 20:23 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
    .
     
  13. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    ((((((((((((((((((((((((((((( [email protected]_16.10.43.04 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-03-30 20:42:35 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    + 2008-04-01 00:44:09 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    - 2008-03-31 20:06:45 16,384 ------w C:\WINDOWS\Temp\Cookies\index.dat
    + 2008-04-01 17:31:09 16,384 ------w C:\WINDOWS\Temp\Cookies\index.dat
    - 2008-03-31 20:06:45 32,768 ----a-w C:\WINDOWS\Temp\History\History.IE5\index.dat
    + 2008-04-01 17:31:09 32,768 ----a-w C:\WINDOWS\Temp\History\History.IE5\index.dat
    + 2008-04-01 17:31:45 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_d3c.dat
    - 2008-03-31 20:06:45 32,768 ------w C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat
    + 2008-04-01 17:31:09 32,768 ------w C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
    @={30351346-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
    @={30351347-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
    @={30351348-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
    @={3035134B-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
    @={3035134C-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
    @={3035134D-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
    @={3035134E-7B7D-4FCC-81B4-1E394CA267EB}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS0]
    @={5d1cb710-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS1]
    @={5d1cb711-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS2]
    @={5d1cb712-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS3]
    @={5d1cb713-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS4]
    @={5d1cb714-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS5]
    @={5d1cb715-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\TortoiseCVS6]
    @={5d1cb716-1c4b-11d4-bed5-005004b1f42f}

    [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
    2008-02-16 13:35 536576 --a------ C:\Program Files\TortoiseSVN\bin\tortoisesvn.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb710-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb711-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb712-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb713-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb714-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb715-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CLASSES_ROOT\CLSID\{5d1cb716-1c4b-11d4-bed5-005004b1f42f}]
    2007-03-15 22:50 1073152 --a------ C:\Program Files\TortoiseCVS\TrtseShl.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CursorXP"="C:\Program Files\CursorXP\CursorXP.exe" [2005-01-19 17:44 140288]
    "Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 12:15 50528]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 08:00 15360]
    "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
    "HomeAlarm"="C:\Program Files\Chameleon Clock\ChamClock.exe" [2006-10-26 22:25 915456]
    "BoincLogX"="C:\Program Files\BoincLogX\boinclogx.exe" [2006-07-03 19:33 1115136]
    "ooVoo.exe"="C:\Program Files\ooVoo\ooVoo.exe" [2008-03-20 16:18 12408624]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
    "CTHelper"="CTHELPER.EXE" [2006-08-17 12:32 17920 C:\WINDOWS\CTHELPER.EXE]
    "CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 12:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
    "WD Button Manager"="WDBtnMgr.exe" [2007-02-24 20:36 339968 C:\WINDOWS\system32\WDBtnMgr.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-03-15 08:00 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-03-15 08:00 455168]
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2006-03-15 08:00 59392]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-03-15 08:00 208952]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 05:04 59392]
    "CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00 45056]
    "Easy Synchronization"="C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe" [2005-10-05 12:00 53248]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24 71216]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21 54832]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 12:42 58728]
    "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-07-09 01:57 100056]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-12 00:12 49152]
    "Bluetooth Connection Assistant"="LBTWIZ.exe" []
    "NvCplDaemon"="RUNDLL32.exe" [2006-03-15 08:00 33280 C:\WINDOWS\system32\rundll32.exe]
    "nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="RUNDLL32.exe" [2006-03-15 08:00 33280 C:\WINDOWS\system32\rundll32.exe]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
    "TkBellExe"="C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" [2008-03-24 11:29 180269]
    "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [ ]
     
  14. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-11-29 23:37:20 561213]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
    HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 01:49:24 73728]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-02-03 21:50:49 789008]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{FE24CD78-7C63-465D-8787-4EDF7FC79895}"= C:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll [2005-10-05 12:00 69632]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
    C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2007-12-25 17:29 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=wbsys.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 setuid

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
    backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WD Backup Monitor.lnk]
    backup=C:\WINDOWS\pss\WD Backup Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Adobe Gamma.lnk]
    backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MagicDisc.lnk]
    backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
    "C:\\Program Files\\backburner 2\\monitor.exe"=
    "C:\\Program Files\\backburner 2\\manager.exe"=
    "C:\\Program Files\\backburner 2\\server.exe"=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Program Files\\Infogrames\\Independence War 2 - Edge of Chaos\\bin\\release\\loader.exe"=
    "C:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
    "C:\\Program Files\\Microsoft Games\\Freelancer\\EXE\\Freelancer.exe"=
    "C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\bin\\SupremeCommander.exe"=
    "C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
    "C:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=
    "C:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander - Forged Alliance\\bin\\ForgedAlliance.exe"=
    "C:\\Program Files\\THQ\\Gas Powered Games\\GPGNet\\GPG.Multiplayer.Client.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\FlashGet\\flashget.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
    "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "443:UDP"= 443:UDP:*:Disabled:eek:oVoo UDP port 443
    "37674:TCP"= 37674:TCP:*:Disabled:eek:oVoo TCP port 37674
    "37674:UDP"= 37674:UDP:*:Disabled:eek:oVoo UDP port 37674
    "37675:UDP"= 37675:UDP:*:Disabled:eek:oVoo UDP port 37675
    "37676:TCP"= 37676:TCP:*:Disabled:eek:oVoo TCP port 37676
    "37676:UDP"= 37676:UDP:*:Disabled:eek:oVoo UDP port 37676
    "37677:UDP"= 37677:UDP:*:Disabled:eek:oVoo UDP port 37677
    "443:TCP"= 443:TCP:*:Disabled:eek:oVoo TCP port 443

    R0 mv61xx;mv61xx;C:\WINDOWS\system32\drivers\mv61xx.sys [2006-11-14 09:32]
    R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 16:51]
    R2 ArcGIS License Manager;ArcGIS License Manager;C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe [1999-12-01 13:38]
    R2 Marvell RAID;Marvell RAID Event Agent;C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe [2006-08-09 23:46]
    R2 MRUWebService;MRU Web Service;"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe" -k runservice []
    R2 PSI_SVC_2;Protexis Licensing V2;"C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe" [2007-07-24 11:15]
    R2 regi;regi;C:\WINDOWS\system32\drivers\regi.sys [2007-04-17 20:09]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-01-28 18:01]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-15 08:00]
    R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 12:16]
    S3 PciCon;PciCon;D:\PciCon.sys []
    S3 pnicml;pnicml;C:\DOCUME~1\Owner\LOCALS~1\Temp\pnicml.sys []
    S3 sc4stupmngrService;SimCity4 Startup Manager Service;C:\Program Files\SimCity4 StartupManager\sumservice.exe [2007-06-02 20:38]
    S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-27 00:21]
    S3 SIUSBXP;SIUSBXP;C:\WINDOWS\system32\drivers\SiUSBXp.sys [2007-03-01 12:11]
    S3 wacommousefilter;Wacom Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys []
    S3 wacomvhid;Wacom Virtual Hid Driver;C:\WINDOWS\system32\DRIVERS\wacomvhid.sys []
    S3 ysffp_sd;ysffp_sd;C:\DOCUME~1\Owner\LOCALS~1\Temp\ysffp_sd.sys []

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    *Newly Created Service* - NVR0DEV
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-03-30 13:38:53 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
    "2008-03-05 12:57:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-04-01 17:33:59 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2008-03-30 18:53:40 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Owner.job"
    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/task:
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-01 13:31:17
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
    "ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\000.fcl"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\Program Files\TortoiseSVN\iconv\_tbl_simple.so
    -> C:\Program Files\TortoiseSVN\iconv\windows-1252.so
    -> C:\Program Files\TortoiseSVN\iconv\utf-8.so
    -> C:\Program Files\Stardock\Object Desktop\WindowBlinds\tray.dll
    -> C:\Program Files\Logitech\Easy Synchronization\shellexecutehook.dll
    -> C:\WINDOWS\system32\nvshell.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\CVSNT\cvslock.exe
    C:\Program Files\CVSNT\cvsservice.exe
    C:\Program Files\DCPFLICS\DCPFLICS.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    C:\Program Files\UPHClean\uphclean.exe
    C:\Program Files\VentSrv\ventrilo_svc.exe
    C:\Program Files\VentSrv\ventrilo_srv.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\WINDOWS\ehome\mcrdsvc.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\WINDOWS\system32\WTablet\TabUserW.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\nvCplUI.exe
    .
    **************************************************************************
    .
    Completion time: 2008-04-01 13:35:20 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-01 17:35:14
    ComboFix2.txt 2008-03-31 20:11:10
    Pre-Run: 513,987,297,280 bytes free
    Post-Run: 513,970,327,552 bytes free
    .
    2008-03-27 18:18:39 --- E O F ---
     
  15. zgrillo2004

    zgrillo2004 Thread Starter

    Joined:
    Aug 28, 2006
    Messages:
    102
    Hijack This Log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:10:17 PM, on 4/2/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton Internet Security\ISSVC.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
    C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\CTHELPER.EXE
    C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
    C:\WINDOWS\system32\CTXFIHLP.EXE
    C:\WINDOWS\system32\WDBtnMgr.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\CVSNT\cvslock.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
    C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\CVSNT\cvsservice.exe
    C:\Program Files\DCPFLICS\DCPFLICS.exe
    C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
    C:\Program Files\Logitech\SetPoint\LBTWiz.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\Program Files\CursorXP\CursorXP.exe
    C:\Program Files\AIM6\aim6.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
    C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe
    C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    C:\Program Files\CyberLink\Shared files\RichVideo.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    C:\Program Files\Chameleon Clock\ChamClock.exe
    C:\Program Files\BoincLogX\boinclogx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\UPHClean\uphclean.exe
    C:\Program Files\VentSrv\ventrilo_svc.exe
    C:\Program Files\VentSrv\ventrilo_srv.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\system32\WTablet\TabUserW.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
    C:\Program Files\Creative\Sound Blaster X-Fi\Console Launcher\ConsoLC.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Program Files\Xfire\xfire.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\My Book\WD Backup\uWDBackup.exe
    C:\Program Files\My Book\WD Backup\uBBMonitor.exe
    C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Owner\Desktop\HiJackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
    O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
    O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
    O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
    O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
    O4 - HKLM\..\Run: [Easy Synchronization] "C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] "C:\PROGRA~1\SYMNET~1\SNDMon.exe" /Consumer
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\K-Lite Codec Pack\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\RunOnce: [Easy Synchronization] C:\Program Files\Logitech\Easy Synchronization\LogitechEasySync.exe --ports
    O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [HomeAlarm] C:\Program Files\Chameleon Clock\ChamClock.exe
    O4 - HKCU\..\Run: [BoincLogX] "C:\Program Files\BoincLogX\boinclogx.exe"
    O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://extract.cr.usgs.gov
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - https://h20364.www2.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
    O16 - DPF: {8ACDC08B-DC64-4613-97F2-299B65F66E1D} (DigiMeldOcx Control) - http://www.digimeld.com/download/digimeldOcx.CAB
    O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15033/CTPID.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: faxinfo - C:\WINDOWS\
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: CVSNT Locking Service 2.5.03.2382 (cvslock) - Unknown owner - C:\Program Files\CVSNT\cvslock.exe
    O23 - Service: CVSNT Dispatch service 2.5.03.2382 (cvsnt) - March Hare Software Ltd - C:\Program Files\CVSNT\cvsservice.exe
    O23 - Service: DCPFLICS - Unknown owner - C:\Program Files\DCPFLICS\DCPFLICS.exe
    O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
    O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Logitech Easy Synchronization - Unknown owner - C:\Program Files\Logitech\Easy Synchronization\servicestub.exe
    O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe
    O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
    O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
    O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: SimCity4 Startup Manager Service (sc4stupmngrService) - Unknown owner - C:\Program Files\SimCity4 StartupManager\sumservice.exe
    O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
    O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

    --
    End of file - 20637 bytes
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/698840

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice