Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: 1 2 3 [All]   Go Down

Author Topic: At9  (Read 13393 times)

0 Members and 2 Guests are viewing this topic.

Ralph12

    Topic Starter


    Rookie

    At9
    « on: February 12, 2009, 09:37:29 AM »
    Here are the logs the HijackThis log will have to be in another post

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 02/12/2009 at 10:20 AM

    Application Version : 4.25.1012

    Core Rules Database Version : 3724
    Trace Rules Database Version: 1698

    Scan type       : Quick Scan
    Total Scan Time : 00:25:53

    Memory items scanned      : 648
    Memory threats detected   : 0
    Registry items scanned    : 784
    Registry threats detected : 3
    File items scanned        : 32913
    File threats detected     : 54

    Trojan.Net-DamnUA/A
       HKU\S-1-5-21-2969014591-1171066246-3971638899-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18CB1A7B-94CD-4582-8022-ADA16851E44B}

    Adware.Tracking Cookie
       C:\Documents and Settings\Ralph Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\NetworkService\Cookies\system@apmebf[1].txt
       C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
       C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
       C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
       C:\Documents and Settings\NetworkService\Cookies\system@imediablast[1].txt
       C:\Documents and Settings\NetworkService\Cookies\system@imrworldwide[2].txt
       C:\Documents and Settings\NetworkService\Cookies\system@incentaclick[2].txt
       C:\Documents and Settings\NetworkService\Cookies\system@insightexpressai[1].txt
       C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
       C:\Documents and Settings\NetworkService\Cookies\system@media6degrees[1].txt
       C:\Documents and Settings\NetworkService\Cookies\system@specificclick[1].txt
       C:\Documents and Settings\NetworkService\Cookies\system@specificmedia[2].txt
       C:\Documents and Settings\NetworkService\Cookies\[email protected][1].txt
       C:\Documents and Settings\NetworkService\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@adecn[1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@adinterax[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@adlegend[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@bannerconnect[1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@chitika[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@collective-media[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@exitexchange[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@imrworldwide[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@insightexpressai[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@media6degrees[1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@revsci[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\sandra_foster@specificmedia[2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][1].txt
       C:\Documents and Settings\Sandra Foster\Cookies\[email protected][2].txt

    Adware.MyWebSearch/FunWebProducts
       HKCR\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}
       HKCR\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}\TreatAs

    Trojan.Dropper/Gen
       C:\DOCUMENTS AND SETTINGS\RALPH FOSTER\LOCAL SETTINGS\APPLICATION DATA\SUPPORTSOFT\PCCHECKUPONLINE\RALPH FOSTER\TEMPFILES\SETUP_ACTIVEX.EXE


    Malwarebytes' Anti-Malware 1.34
    Database version: 1753
    Windows 5.1.2600 Service Pack 3

    2/12/2009 10:46:26 AM
    mbam-log-2009-02-12 (10-46-26).txt

    Scan type: Quick Scan
    Objects scanned: 90516
    Time elapsed: 7 minute(s), 45 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 17
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 3

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{66186f05-bbbb-4a39-864f-72d84615c679} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{5d2631e5-8696-7543-50b2-f674cd4308eb} (Trojan.Fakealert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{f4406238-983a-4845-9053-f1d0007fd135} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3aa42713-5c1e-48e2-b432-d8bf420dd31d} (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{343ce214-9998-4b21-a151-ffe970167297} (Rogue.Installer) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6860a44b-5d3e-433d-a7b5-d517f810d0e7} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db9fba9d-ab1b-4cc6-9745-f3b549d64e40} (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{66186f05-bbbb-4a39-864f-72d84615c679} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\568267acfc5644dab06f058006ddbae3 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\9ee2330ae5f4470cac801baac83818c9 (Adware.Zango) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\rhc1fjj0ec93 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fb465b61-9d06-c89d-4593-f794c032c35d} (Adware.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{fb465b61-9d06-c89d-4593-f794c032c35d} (Adware.BHO) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smzbsjmltgekpmd (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\system32\regsvr32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\T2T0TE0k.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\index.html (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Logged

    Ralph12

      Topic Starter


      Rookie

      Re: At9
      « Reply #1 on: February 12, 2009, 09:38:56 AM »
      Here is the HijackThis log

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 11:09:45 AM, on 2/12/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16791)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Windows Defender\MsMpEng.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\WLTRYSVC.EXE
      C:\WINDOWS\System32\bcmwltry.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\WINDOWS\system32\dllhost.exe
      C:\WINDOWS\eHome\ehRecvr.exe
      C:\WINDOWS\eHome\ehSched.exe
      C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
      C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      C:\PROGRA~1\AVG\AVG8\avgrsx.exe
      C:\PROGRA~1\AVG\AVG8\avgnsx.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Common Files\LightScribe\LSSrvc.exe
      C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
      C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
      C:\Program Files\Dell Support Center\bin\sprtsvc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\dllhost.exe
      C:\WINDOWS\System32\vssvc.exe
      C:\Program Files\Windows Live\installer\WLSetupSvc.exe
      C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Program Files\Common Files\Real\Update_OB\realsched.exe
      C:\PROGRA~1\AVG\AVG8\avgemc.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Logitech\QuickCam\Quickcam.exe
      C:\WINDOWS\System32\dmadmin.exe
      C:\Program Files\AVG\AVG8\avgcsrvx.exe
      C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
      C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
      C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
      C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      C:\Program Files\Dell Support Center\bin\sprtcmd.exe
      C:\Program Files\Dell\QuickSet\Quickset.exe
      C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE
      C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
      C:\WINDOWS\system32\WLTRAY.exe
      C:\PROGRA~1\AVG\AVG8\avgtray.exe
      C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe
      C:\Program Files\Weather Watcher Live\ww.exe
      C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
      C:\Program Files\Secunia\PSI\psi.exe
      C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
      C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
      C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSCM.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
      C:\Program Files\Trend Micro\sniper.exe\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
      O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - (no file)
      O2 - BHO: (no name) - {053F9267-DC04-4294-A72C-58F732D338C0} - (no file)
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
      O2 - BHO: addestination search enhancer - {52217D1A-11A9-9B1F-8CDB-BA7F100E616C} - (no file)
      O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
      O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
      O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
      O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
      O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
      O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
      O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
      O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
      O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
      O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
      O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
      O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
      O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
      O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
      O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
      O4 - HKCU\..\Run: [Uniblue ProcessQuickLink 2] "C:\Program Files\Uniblue\ProcessQuickLink 2\ProcessQuickLink2.exe" /autostart
      O4 - HKCU\..\Run: [WeatherWatcherLive] "C:\Program Files\Weather Watcher Live\ww.exe"
      O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
      O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
      O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
      O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
      O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
      O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
      O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
      O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
      O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
      O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
      O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1184181844002
      O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
      O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{0F34B328-516A-44EF-B7D7-E1016ACA898F}: NameServer = 68.28.242.91 68.28.250.92
      O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
      O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
      O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
      O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
      O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
      O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
      O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
      O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
      O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
      O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
      O23 - Service: SPCSUtilityService - Sprint Spectrum, L.L.C - C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
      O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
      O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

      --
      End of file - 15082 bytes
      Logged

      Dusty



        Egghead

      • I could if she would, but she won't so I don't.
        • Thanked: 75
      • Experience: Beginner
      • OS: Windows XP
      Re: At9
      « Reply #2 on: February 19, 2009, 01:20:43 PM »
      It is CH policy that only approved Malware Removal Specialists give advice on malware removal so that users can have confidence in the advice given.

      Please be patient, the specialists are extremely busy and I'm sure someone will get to your problem shortly.

      Good luck.

      Dusty
      Logged
      One good deed is worth more than a year of good intentions.

      Ralph12

        Topic Starter


        Rookie

        Re: At9
        « Reply #3 on: February 20, 2009, 06:35:34 AM »
        Thank you for your reply and I will be patient as I know they are very busy
        Logged

        evilfantasy

        • Malware Removal Specialist
        • Moderator


          • Genius
        • Calm like a bomb
          • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11
        Re: At9
        « Reply #4 on: February 20, 2009, 06:47:53 AM »
        Download random's system information tool (RSIT) by random/random from and save it to your Desktop.

        • Double click on RSIT.exe to run.
        • Click Continue at the disclaimer screen.
        • Once it has finished, two logs will open.
        • log.txt <will be maximized and info.txt <will be minimized
        • Please post the contents of both logs in the next reply.
        Logged

        Ralph12

          Topic Starter


          Rookie

          Re: At9
          « Reply #5 on: February 23, 2009, 07:33:16 AM »
          evilfantasy how can I put an attachment in the log and info log that you want are to big to just post in a reply
          Logged

          evilfantasy

          • Malware Removal Specialist
          • Moderator


            • Genius
          • Calm like a bomb
            • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: At9
          « Reply #6 on: February 23, 2009, 10:38:21 AM »
          Use two posts.
          Logged

          Ralph12

            Topic Starter


            Rookie

            Re: At9
            « Reply #7 on: February 24, 2009, 07:11:21 AM »
            I will probably have to use more than two as the one log won't fit in a single post
            Logged

            Ralph12

              Topic Starter


              Rookie

              Re: At9
              « Reply #8 on: February 24, 2009, 07:20:26 AM »
              info.txt logfile of random's system information tool 1.05 2009-02-23 09:17:10

              ======Uninstall list======

              -->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
              -->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
              -->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
              -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
              -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
              -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
              -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
              -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
              -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
              -->C:\WINDOWS\UNNMP.exe /UNINSTALL
              -->C:\WINDOWS\UNNVEContent.exe /UNINSTALL
              -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
              32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
              Acrobat.com-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe -uninstall com.adobe.mauby 4875E02D9FB21EE389F73B8D1702B320485DF8C E.1
              Acrobat.com-->MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
              Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe -arp:uninstall
              Adobe AIR-->MsiExec.exe /I{00203668-8170-44A0-BE44-B632FA4D780F}
              Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
              Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
              Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}
              Adobe® Photoshop® Album Starter Edition 3.2-->MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61}
              Advanced SystemCare 3-->"C:\Program Files\IObit\Advanced SystemCare 3\unins000.exe"
              AOLIcon-->MsiExec.exe /I{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}
              Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
              Ask Toolbar-->"C:\Program Files\AskBarDis\unins000.exe"
              ATI Catalyst Control Center-->MsiExec.exe /I{A02ED372-22FA-448B-AB6A-1B0FC23B7D08}
              ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
              AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
              Broadcom Management Programs-->MsiExec.exe /I{26E1BFB0-E87E-4696-9F89-B467F01F81E5}
              CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
              Conexant HDA D110 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3\HXFSETUP.EXE -U -Idel1028p.inf
              Dell Support 3.2.1-->MsiExec.exe /X{CEE2252C-4035-4B27-8EC6-0B085DD3A413}
              Dell Support Center-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
              Dell Wireless WLAN Card-->"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
              Digital Content Portal-->MsiExec.exe /I{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}
              Digital Line Detect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
              DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
              DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
              DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
              DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
              Documentation & Support Launcher-->MsiExec.exe /X{B0DF58A2-40DF-4465-AA56-38623EC9938C}
              EducateU-->MsiExec.exe /I{A683A2C0-821C-486F-858C-FA634DB5E864}
              ESPNMotion-->C:\PROGRA~1\ESPNMO~1\UNWISE.EXE /u C:\PROGRA~1\ESPNMO~1\INSTALL.LOG
              Eusing Free Registry Cleaner-->C:\PROGRA~1\EUSING~1\UNWISE.EXE C:\PROGRA~1\EUSING~1\INSTALL.LOG
              Games, Music, & Photos Launcher-->MsiExec.exe /X{B6884A07-0305-47AE-9969-8F26FADC17DE}
              Garmin City Navigator North America NT v8-->MsiExec.exe /X{5301C483-40FB-4F94-B56E-D7D5A114D2F6}
              Garmin MapSource-->MsiExec.exe /X{CF07A1C9-098F-47DD-99E0-B6558C33871B}
              GemMaster Mystic-->"C:\Program Files\GemMaster\uninstallgemmaster.exe"
              getPlus(R) for Adobe-->"C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
              getPlus(R)_ocx-->rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSo.INF, DefaultUninstall
              Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
              Google Earth-->MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
              Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
              Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
              High Definition Audio Driver Package - KB835221-->C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
              Highlight Viewer (Windows Live Toolbar)-->MsiExec.exe /X{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}
              Hotfix 2050 for SQL Server 2000 ENU (KB948110)-->"C:\WINDOWS\$SQLUninstallSQL2000-KB948110-v8.00.2050-x86-ENU$\spuninst\spuninst.exe"
              Hotfix 2055 for SQL Server 2000 ENU (KB960082)-->"C:\WINDOWS\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$\spuninst\spuninst.exe"
              Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
              Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
              Hotfix for Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
              Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
              Hotfix for Windows Media Player 10 (KB903157)-->"C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe"
              Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
              Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
              HP Customer Participation Program 9.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
              HP Document Viewer 7.0-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
              HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
              HP OCR Software 9.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
              HP Photosmart All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{B46AC30C-22D2-4610-B041-1DA7BB29EB57}\setup\hpzscr01.exe -datfile hposcr21.dat
              HP Photosmart Essential 2.01-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
              HP Photosmart Premier Software 6.5-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
              HP Photosmart, Officejet and Deskjet 7.0.A-->C:\Program Files\HP\Digital Imaging\{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat
              HP Solution Center 9.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
              HPSSupply-->MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
              Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
              Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
              Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
              Learn to Speak Spanish Essentials 9.5-->MsiExec.exe /I{44AAEDB2-057D-4330-93DF-2FA4C609960F}
              Logitech QuickCam Driver Package-->"C:\Program Files\Common Files\LogiShrd\LogiDriverStore\lvdrivers\11.80.1048\LgDrvInst.exe" -remove -instdir"C:\Program Files\Common Files\LogiShrd\LogiDriverStore\lvdrivers\" -enumdelay=2000 -enabledifx -forcedelete -usbhubsfirst -forceremove -cumulativeremove -promptuninstall -arpregkey"lvdrivers_11.80" /clone_wait /hide_progress
              Logitech QuickCam-->MsiExec.exe /X{3AF8FCCD-F51A-4014-9002-F195E1CBC876}
              Logitech Updater-->MsiExec.exe /I{53735ECE-E461-4FD0-B742-23A352436D3A}
              Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
              Map Button (Windows Live Toolbar)-->MsiExec.exe /X{7745B7A9-F323-4BB9-9811-01BF57A028DA}
              MediaDirect-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\Setup.exe" -l0x9  -cluninstall
              Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
              Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
              Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
              Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
              Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
              Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
              Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
              Microsoft Baseline Security Analyzer 2.1-->MsiExec.exe /I{6AF5CAB9-FD0A-494F-8AA6-784D4B5D06C5}
              Microsoft Color Control Panel Applet for Windows XP-->MsiExec.exe /X{CE378F36-E404-4244-A33F-F50A2A6D31BD}
              Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
              Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
              Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
              Microsoft Office Outlook 2003 with Business Contact Manager Update-->MsiExec.exe /I{BA68600E-96D9-4E92-80F2-26B9681B5A63}
              Microsoft Office Small Business Edition 2003-->MsiExec.exe /I{91CA0409-6000-11D3-8CFE-0150048383C9}
              Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
              Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
              Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
              Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
              Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
              Modem Helper-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
              MSN Toolbar-->MsiExec.exe /I{10C69612-017B-45F5-B986-7D113D5A2EA3}
              MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
              MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
              MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
              MWSnap 3-->"C:\Program Files\MWSnap\uninstall.exe"
              Nero Suite-->C:\Program Files\Common Files\Nero\Uninstall\Setupx.exe /uninstall ExtraUninstallID=""
              NetWaiting-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe" -l0x9 ControlPanel
              OpenOffice.org Installer 1.0-->MsiExec.exe /X{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}
              Otto-->"C:\Program Files\EnglishOtto\uninstallotto.exe"
              OutlookAddinSetup-->MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}
              Photo Story 3 for Windows-->MsiExec.exe /I{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}
              PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
              Qualxserve Service Agreement-->MsiExec.exe /X{0F756CD9-4A1E-409B-B101-601DDC4C03AA}
              QuickSet-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C5074CC4-0E26-4716-A307-960272A90040}\setup.exe" -l0x9  APPDRVNT4
              QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
              RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
              RON Tool Addestination-->C:\WINDOWS\system32\jdzumqauienhco.exe
              Search Assistant Addestination-->C:\WINDOWS\system32\zdqjzbewfcuu.dll-uninst.exe
              Secunia PSI-->"C:\Program Files\Secunia\PSI\uninstall.exe"
              Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
              Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
              Security Update for Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
              Security Update for Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
              Logged

              Ralph12

                Topic Starter


                Rookie

                Re: At9
                « Reply #9 on: February 24, 2009, 07:21:48 AM »
                Security Update for Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
                Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
                Security Update for Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
                Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
                Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
                Security Update for Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
                Smart Menus (Windows Live Toolbar)-->MsiExec.exe /X{F084395C-40FB-4DB3-981C-B51E74E1E83D}
                Sonic Audio module-->MsiExec.exe /I{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
                Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
                Sonic Encoders-->MsiExec.exe /I{9941F0AA-B903-4AF4-A055-83A9815CC011}
                Sonic MyDVD LE-->MsiExec.exe /I{21657574-BD54-48A2-9450-EB03B2C7FC29}
                Sonic RecordNow Copy-->MsiExec.exe /I{B12665F4-4E93-4AB4-B7FC-37053B524629}
                Sonic RecordNow Data-->MsiExec.exe /I{075473F5-846A-448B-BCB3-104AA1760205}
                Sonic Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
                Sprint Mobile Broadband (Sierra)-->MsiExec.exe /I{6DCBB845-0FA4-4723-A40A-1F320C221C30}
                SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
                SureThing CD Labeler 4 SE-->C:\WINDOWS\mvuninst\App1\mvuninst.exe "SureThing CD Labeler 4 SE"
                Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
                Trailer Life Campground Navigator 2007-->"C:\Program Files\TLCN2007\unins000.exe"
                Uniblue ProcessQuickLink 2-->"C:\Program Files\Uniblue\ProcessQuickLink 2\unins000.exe"
                Update for Windows Media Player 10 (KB913800)-->"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
                Update for Windows Media Player 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
                Update for Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
                Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
                Update for Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
                Update Rollup 2 for Windows XP Media Center Edition 2005-->C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
                URL Assistant-->regsvr32 /u /s "C:\Program Files\BAE\BAE.dll"
                Virtual Earth 3D (Beta)-->MsiExec.exe /I{3CCB26F5-E2A7-4C91-8340-9149D7B7C2BE}
                Weather Watcher Live-->"C:\Program Files\Weather Watcher Live\unins000.exe"
                Windows Defender-->MsiExec.exe /I{A06275F4-324B-4E85-95E6-87B2CD729401}
                Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
                Windows Live Favorites for Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
                Windows Live installer-->MsiExec.exe /X{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
                Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
                Windows Live Photo Gallery-->MsiExec.exe /X{2D4F6BE3-6FEF-4FE9-9D01-1406B220D08C}
                Windows Live Sign-in Assistant-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
                Windows Live Toolbar Extension (Windows Live Toolbar)-->MsiExec.exe /X{341201D4-4F61-4ADB-987E-9CCE4D83A58D}
                Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {D5A145FC-D00C-4F1A-9119-EB4D9D659750}
                Windows Live Toolbar-->MsiExec.exe /X{D5A145FC-D00C-4F1A-9119-EB4D9D659750}
                Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
                Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
                Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]-->C:\WINDOWS\$NtUninstallEmeraldQFE2$\spuninst\spuninst.exe
                Windows Media Player 10-->MsiExec.exe /I{33BB4982-DC52-4886-A03B-F4C5C80BEE89}
                Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
                Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
                Windows XP Media Center Edition 2005 KB908246-->"C:\WINDOWS\$NtUninstallKB908246$\spuninst\spuninst.exe"
                Windows XP Media Center Edition 2005 KB925766-->"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
                Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
                WinWay Resume Deluxe-->MsiExec.exe /x{536E1504-E2E0-4B25-9D61-5418DE8319A4}
                XP SysPad V7.9.5 by xtort.net ©-->"C:\Program Files\XPSysPad\unins000.exe"
                Yahoo! Browser Services-->C:\PROGRA~1\Yahoo!\Common\UNIN_Y~1.EXE /S
                Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
                Yahoo! Internet Mail-->C:\WINDOWS\system32\regsvr32 /u /s C:\PROGRA~1\Yahoo!\Common\YMMAPI.dll
                Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
                Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

                ======Security center information======

                AV: AVG Anti-Virus Free

                System event log

                Computer Name: D3JLQ6C1
                Event Code: 7024
                Message: The MSSQLServerADHelper service terminated with service-specific error 3221225572 (0xC0000064).

                Record Number: 5
                Source Name: Service Control Manager
                Time Written: 20090220132438.000000-300
                Event Type: error
                User:

                Computer Name: D3JLQ6C1
                Event Code: 2481
                Message: The UPS service is not configured correctly.

                Record Number: 4
                Source Name: UPS
                Time Written: 20090220132422.000000-300
                Event Type: error
                User:

                Computer Name: D3JLQ6C1
                Event Code: 3095
                Message: This computer is configured as a member of a workgroup, not as
                a member of a domain. The Netlogon service does not need to run in this
                configuration.

                Record Number: 3
                Source Name: NETLOGON
                Time Written: 20090220132409.000000-300
                Event Type: error
                User:

                Computer Name: D3JLQ6C1
                Event Code: 6005
                Message: The Event log service was started.

                Record Number: 2
                Source Name: EventLog
                Time Written: 20090220132408.000000-300
                Event Type: information
                User:

                Computer Name: D3JLQ6C1
                Event Code: 6009
                Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Multiprocessor Free.

                Record Number: 1
                Source Name: EventLog
                Time Written: 20090220132408.000000-300
                Event Type: information
                User:

                Application event log

                Computer Name: D3JLQ6C1
                Event Code: 100
                Message: '0' is an invalid number of start up parameters. This service takes two start up parameters.

                Record Number: 14255
                Source Name: MSSQLServerADHelper
                Time Written: 20081227064819.000000-300
                Event Type: error
                User:

                Computer Name: D3JLQ6C1
                Event Code: 0
                Message:
                Record Number: 14254
                Source Name: LVCOMSer
                Time Written: 20081227064806.000000-300
                Event Type: information
                User:

                Computer Name: D3JLQ6C1
                Event Code: 4
                Message: The LightScribe Service started successfully.

                Record Number: 14253
                Source Name: LightScribeService
                Time Written: 20081227064806.000000-300
                Event Type: information
                User:

                Computer Name: D3JLQ6C1
                Event Code: 0
                Message:
                Record Number: 14252
                Source Name: hpqddsvc
                Time Written: 20081227064806.000000-300
                Event Type: information
                User:

                Computer Name: D3JLQ6C1
                Event Code: 0
                Message:
                Record Number: 14251
                Source Name: hpqcxs08
                Time Written: 20081227064804.000000-300
                Event Type: information
                User:

                ======Environment variables======

                "ComSpec"=%SystemRoot%\system32\cmd.exe
                "FP_NO_HOST_CHECK"=NO
                "NUMBER_OF_PROCESSORS"=2
                "OS"=Windows_NT
                "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\QuickTime\QTSystem\
                "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
                "PROCESSOR_ARCHITECTURE"=x86
                "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel
                "PROCESSOR_LEVEL"=6
                "PROCESSOR_REVISION"=0f06
                "SonicCentral"=C:\Program Files\Common Files\Sonic Shared\Sonic Central\
                "TEMP"=%SystemRoot%\TEMP
                "TMP"=%SystemRoot%\TEMP
                "windir"=%SystemRoot%
                "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
                "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

                -----------------EOF-----------------
                Logged

                Ralph12

                  Topic Starter


                  Rookie

                  Re: At9
                  « Reply #10 on: February 24, 2009, 07:29:18 AM »
                  Logfile of random's system information tool 1.05 (written by random/random)
                  Run by Ralph Foster at 2009-02-23 09:16:38
                  Microsoft Windows XP Professional Service Pack 3
                  System drive C: has 45 GB (65%) free of 69 GB
                  Total RAM: 2046 MB (51% free)

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 9:17:04 AM, on 2/23/2009
                  Platform: Windows XP SP3 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16791)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\Windows Defender\MsMpEng.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\System32\WLTRYSVC.EXE
                  C:\WINDOWS\System32\bcmwltry.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                  C:\WINDOWS\system32\cisvc.exe
                  C:\WINDOWS\system32\dllhost.exe
                  C:\WINDOWS\eHome\ehRecvr.exe
                  C:\WINDOWS\eHome\ehSched.exe
                  C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
                  C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                  C:\Program Files\Java\jre6\bin\jqs.exe
                  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                  C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                  C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
                  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
                  C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
                  C:\Program Files\Dell Support Center\bin\sprtsvc.exe
                  C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\system32\dllhost.exe
                  C:\WINDOWS\System32\vssvc.exe
                  C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                  C:\Program Files\Windows Live\installer\WLSetupSvc.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\WINDOWS\system32\wbem\wmiapsrv.exe
                  C:\PROGRA~1\AVG\AVG8\avgemc.exe
                  C:\WINDOWS\System32\dmadmin.exe
                  C:\Program Files\AVG\AVG8\avgcsrvx.exe
                  C:\Program Files\Windows Defender\MSASCui.exe
                  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  C:\Program Files\Logitech\QuickCam\Quickcam.exe
                  C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
                  C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
                  C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe
                  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                  C:\Program Files\Dell Support Center\bin\sprtcmd.exe
                  C:\Program Files\Dell\QuickSet\Quickset.exe
                  C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
                  C:\WINDOWS\system32\WLTRAY.exe
                  C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
                  C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSCM.exe
                  C:\WINDOWS\system32\cidaemon.exe
                  C:\Program Files\Outlook Express\msimn.exe
                  C:\Program Files\Messenger\msmsgs.exe
                  C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
                  C:\Program Files\AVG\AVG8\avgscanx.exe
                  C:\Program Files\AVG\AVG8\avgcsrvx.exe
                  C:\PROGRA~1\AVG\AVG8\avgnsx.exe
                  C:\Program Files\Internet Explorer\iexplore.exe
                  C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
                  c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
                  C:\Documents and Settings\Ralph Foster\Local Settings\Temporary Internet Files\Content.IE5\67M78V0E\RSIT[1].exe
                  C:\Program Files\Trend Micro\sniper.exe\Ralph Foster.exe

                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx
                  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.live.com
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                  O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                  O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - (no file)
                  O2 - BHO: (no name) - {053F9267-DC04-4294-A72C-58F732D338C0} - (no file)
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                  O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
                  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
                  O2 - BHO: addestination search enhancer - {52217D1A-11A9-9B1F-8CDB-BA7F100E616C} - (no file)
                  O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
                  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
                  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
                  O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
                  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
                  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
                  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
                  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
                  O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
                  O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
                  O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
                  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
                  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
                  O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
                  O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
                  O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
                  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                  O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
                  O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
                  O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
                  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
                  O4 - HKCU\..\Run: [WeatherWatcherLive] "C:\Program Files\Weather Watcher Live\ww.exe"
                  O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
                  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
                  O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
                  O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
                  O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
                  O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
                  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
                  O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
                  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
                  O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
                  O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
                  O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
                  O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
                  O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
                  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase370.cab
                  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1184181844002
                  O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
                  O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
                  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{0F34B328-516A-44EF-B7D7-E1016ACA898F}: NameServer = 68.28.242.91 68.28.250.92
                  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
                  O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
                  O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
                  O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
                  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
                  O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
                  O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
                  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
                  O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
                  O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                  O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                  O23 - Service: SPCSUtilityService - Sprint Spectrum, L.L.C - C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
                  O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
                  O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

                  --
                  End of file - 15359 bytes

                  Logged

                  Ralph12

                    Topic Starter


                    Rookie

                    Re: At9
                    « Reply #11 on: February 24, 2009, 07:32:12 AM »
                    ======Scheduled tasks folder======

                    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
                    C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
                    C:\WINDOWS\tasks\MP Scheduled Scan.job

                    ======Registry dump======

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
                    &Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2008-05-15 817936]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
                    Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2008-06-11 61816]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
                    Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
                    AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-09-22 284040]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
                    RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-06-24 308856]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
                    AVG Safe Search - C:\Program Files\AVG\AVG8\avgssie.dll [2009-02-03 1078552]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52217D1A-11A9-9B1F-8CDB-BA7F100E616C}]
                    addestination search enhancer

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}]
                    Yahoo! IE Services Button - C:\Program Files\Yahoo!\Common\yiesrvc.dll [2007-12-12 222448]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
                    DriveLetterAccess - C:\WINDOWS\system32\dla\tfswshx.dll [2005-05-31 118844]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
                    Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
                    AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2009-02-03 1968920]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
                    Google Toolbar Helper - c:\program files\google\googletoolbar2.dll [2007-01-19 2403392]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
                    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-12-24 737776]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
                    Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
                    CBrowserHelperObject Object - C:\Program Files\BAE\BAE.dll [2006-11-17 98304]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
                    MSN Toolbar Helper - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll [2008-12-04 83800]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
                    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-02-12 35840]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
                    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-02-12 73728]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
                    {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar2.dll [2007-01-19 2403392]
                    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
                    {A057A204-BACC-4D26-9990-79A187E2698E} - AVG Security Toolbar - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL [2009-02-03 1968920]
                    {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2008-05-15 817936]
                    {3041d03e-fd4b-44e0-b742-2d9b88305f98} - Ask Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-09-22 284040]
                    {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - MSN Toolbar - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll [2008-12-04 83800]

                    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
                    "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-03 866584]
                    "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-06-24 185896]
                    "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2006-03-08 761947]
                    "LogitechQuickCamRibbon"=C:\Program Files\Logitech\QuickCam\Quickcam.exe [2008-08-14 2407184]
                    "LogitechCommunicationsManager"=C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe [2008-08-14 565008]
                    "ISUSScheduler"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe [2004-07-27 81920]
                    "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]
                    "DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2007-10-09 202544]
                    "Dell QuickSet"=C:\Program Files\Dell\QuickSet\Quickset.exe [2006-08-03 1032192]
                    "Broadcom Wireless Manager UI"=C:\WINDOWS\system32\WLTRAY.exe [2006-11-01 1392640]
                    "AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-02-03 1601304]
                    "QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2009-01-05 413696]
                    "ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [2004-07-27 221184]
                    "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-12 148888]

                    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
                    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
                    "Yahoo! Pager"=C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE [2008-09-19 4347120]
                    "WeatherWatcherLive"=C:\Program Files\Weather Watcher Live\ww.exe [2009-01-28 1171456]
                    "Advanced SystemCare 3"=C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe [2009-01-09 2262352]

                    C:\Documents and Settings\Ralph Foster\Start Menu\Programs\Startup
                    Secunia PSI.lnk - C:\Program Files\Secunia\PSI\psi.exe

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                    "AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL"

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
                    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
                    C:\WINDOWS\system32\Ati2evxx.dll [2006-05-23 61440]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
                    C:\WINDOWS\system32\avgrsstx.dll [2009-02-03 10520]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
                    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
                    "{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"=C:\PROGRA~1\WIFD1F~1\MpShHook.dll [2006-11-03 83224]
                    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdidrv32.sys]

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

                    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
                    "NoDispScrSavPage"=0

                    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
                    "dontdisplaylastusername"=0
                    "legalnoticecaption"=
                    "legalnoticetext"=
                    "shutdownwithoutlogon"=1
                    "undockwithoutlogon"=1
                    "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
                    "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles

                    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                    "NoDriveTypeAutoRun"=145

                    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
                    "NoResolveSearch"=

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
                    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                    "C:\Program Files\Dell\MediaDirect\PCMService.exe"="C:\Program Files\Dell\MediaDirect\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program"
                    "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
                    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                    "C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
                    "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
                    "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
                    "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
                    "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
                    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
                    "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
                    "C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
                    "C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console"

                    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
                    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
                    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe"="C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL"
                    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL"
                    "C:\Program Files\America Online 9.0\waol.exe"="C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL"
                    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
                    "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
                    "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

                    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
                    shell\AutoRun\command - E:\setup.exe


                    ======File associations======

                    .js - open - C:\WINDOWS\System32\WScript.exe "%1" %*
                    .vbs - open - C:\WINDOWS\System32\WScript.exe "%1" %*
                    Logged

                    Ralph12

                      Topic Starter


                      Rookie

                      Re: At9
                      « Reply #12 on: February 24, 2009, 07:36:43 AM »

                      ======List of files/folders modified in the last 1 months======

                      2009-02-23 09:17:06 ----D---- C:\WINDOWS\Temp
                      2009-02-23 08:20:19 ----A---- C:\WINDOWS\ModemLog_Conexant HDA D110 MDC V.92 Modem.txt
                      2009-02-23 08:07:43 ----HD---- C:\$AVG8.VAULT$
                      2009-02-23 07:18:28 ----A---- C:\WINDOWS\ModemLog_Sierra Wireless AC595 Modem Device #2.txt
                      2009-02-23 07:17:14 ----SD---- C:\WINDOWS\Tasks
                      2009-02-23 07:16:31 ----D---- C:\WINDOWS\system32\CatRoot2
                      2009-02-23 07:16:18 ----D---- C:\WINDOWS
                      2009-02-23 07:14:25 ----D---- C:\WINDOWS\system32\NtmsData
                      2009-02-23 07:14:17 ----D---- C:\WINDOWS\Registration
                      2009-02-21 23:18:52 ----A---- C:\WINDOWS\SchedLgU.Txt
                      2009-02-20 20:14:09 ----RSD---- C:\WINDOWS\assembly
                      2009-02-20 20:14:09 ----D---- C:\WINDOWS\Microsoft.NET
                      2009-02-20 20:08:08 ----D---- C:\WINDOWS\Debug
                      2009-02-20 16:33:34 ----D---- C:\WINDOWS\Help
                      2009-02-20 13:24:09 ----SHD---- C:\WINDOWS\CSC
                      2009-02-20 12:42:36 ----SHD---- C:\WINDOWS\Installer
                      2009-02-20 12:42:36 ----HD---- C:\Config.Msi
                      2009-02-20 12:42:25 ----D---- C:\WINDOWS\system32
                      2009-02-20 12:38:55 ----RD---- C:\Program Files
                      2009-02-20 11:47:11 ----A---- C:\WINDOWS\ModemLog_Sierra Wireless AirCard 595U Modem Device.txt
                      2009-02-20 10:13:24 ----D---- C:\WINDOWS\Prefetch
                      2009-02-20 07:37:13 ----A---- C:\WINDOWS\ModemLog_Sierra Wireless AC595 Modem Device #3.txt
                      2009-02-14 10:32:19 ----A---- C:\WINDOWS\NeroDigital.ini
                      2009-02-14 08:04:55 ----D---- C:\Documents and Settings\All Users\Application Data\avg8
                      2009-02-12 11:08:43 ----D---- C:\Program Files\Trend Micro
                      2009-02-12 10:54:46 ----D---- C:\Program Files\MSN
                      2009-02-12 10:54:03 ----A---- C:\WINDOWS\system32\deploytk.dll
                      2009-02-12 10:46:38 ----D---- C:\WINDOWS\system32\dllcache
                      2009-02-12 10:36:40 ----D---- C:\WINDOWS\system32\drivers
                      2009-02-12 09:47:58 ----D---- C:\Program Files\SUPERAntiSpyware
                      2009-02-12 09:47:56 ----D---- C:\Documents and Settings\Ralph Foster\Application Data\SUPERAntiSpyware.com
                      2009-02-12 09:47:11 ----D---- C:\Program Files\Common Files
                      2009-02-12 09:31:19 ----D---- C:\Program Files\Spybot - Search & Destroy
                      2009-02-12 09:28:48 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                      2009-02-11 14:32:22 ----D---- C:\WINDOWS\system32\FxsTmp
                      2009-02-11 14:15:12 ----HD---- C:\WINDOWS\inf
                      2009-02-11 14:14:04 ----HD---- C:\WINDOWS\$hf_mig$
                      2009-02-11 14:13:40 ----D---- C:\Program Files\Internet Explorer
                      2009-02-11 14:13:23 ----D---- C:\WINDOWS\ie7updates
                      2009-02-11 13:51:05 ----D---- C:\Program Files\Logitech
                      2009-02-11 11:18:24 ----D---- C:\Program Files\HP
                      2009-02-11 10:56:02 ----D---- C:\WINDOWS\Downloaded Installations
                      2009-02-11 10:51:13 ----SD---- C:\WINDOWS\Downloaded Program Files
                      2009-02-10 12:23:24 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
                      2009-02-10 12:22:45 ----D---- C:\WINDOWS\WinSxS
                      2009-02-10 12:18:27 ----D---- C:\WINDOWS\system32\en-US
                      2009-02-10 12:18:21 ----RSD---- C:\WINDOWS\Fonts
                      2009-02-10 12:17:58 ----D---- C:\WINDOWS\system32\spool
                      2009-02-09 13:55:56 ----D---- C:\WINDOWS\system32\CatRoot
                      2009-02-09 13:08:28 ----RASH---- C:\boot.ini
                      2009-02-09 13:08:28 ----A---- C:\WINDOWS\win.ini
                      2009-02-09 13:08:28 ----A---- C:\WINDOWS\system.ini
                      2009-02-09 12:37:44 ----D---- C:\Documents and Settings\Ralph Foster\Application Data\Adobe
                      2009-02-09 12:24:26 ----D---- C:\WINDOWS\security
                      2009-02-09 12:06:44 ----D---- C:\Program Files\Google
                      2009-02-09 12:02:00 ----D---- C:\Program Files\Lavasoft
                      2009-02-08 15:02:55 ----D---- C:\Documents and Settings\Ralph Foster\Application Data\IObit
                      2009-02-07 14:11:40 ----D---- C:\Program Files\Dell
                      2009-02-03 18:21:12 ----A---- C:\WINDOWS\system32\MRT.exe
                      2009-02-03 09:44:10 ----D---- C:\Program Files\Mozilla Firefox
                      2009-02-03 08:11:50 ----A---- C:\WINDOWS\system32\avgrsstx.dll
                      2009-02-03 07:28:19 ----D---- C:\WINDOWS\system32\inetsrv
                      2009-02-02 11:08:03 ----D---- C:\Program Files\CCleaner
                      2009-01-29 11:54:23 ----D---- C:\Documents and Settings\Ralph Foster\Application Data\WeatherWatcherLive
                      2009-01-29 07:32:45 ----D---- C:\Program Files\Weather Watcher Live
                      2009-01-26 11:05:54 ----D---- C:\Program Files\Adobe
                      2009-01-26 11:05:31 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
                      2009-01-26 11:05:01 ----D---- C:\Program Files\Common Files\Adobe
                      Logged

                      Ralph12

                        Topic Starter


                        Rookie

                        Re: At9
                        « Reply #13 on: February 24, 2009, 07:37:35 AM »
                        ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

                        R1 APPDRV;APPDRV; C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS [2005-08-12 16128]
                        R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-02-03 325128]
                        R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-02-03 27656]
                        R1 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-02-03 107272]
                        R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
                        R1 omci;OMCI WDM Device Driver; C:\WINDOWS\system32\DRIVERS\omci.sys [2004-02-13 17153]
                        R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS []
                        R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys []
                        R1 sscdbhk5;sscdbhk5; C:\WINDOWS\system32\drivers\sscdbhk5.sys [2005-05-13 5627]
                        R1 ssrtln;ssrtln; C:\WINDOWS\system32\drivers\ssrtln.sys [2005-05-13 23545]
                        R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
                        R2 drvnddm;drvnddm; C:\WINDOWS\system32\drivers\drvnddm.sys [2005-04-21 40544]
                        R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-05 12544]
                        R2 tfsnboio;tfsnboio; C:\WINDOWS\system32\dla\tfsnboio.sys [2005-05-31 25725]
                        R2 tfsncofs;tfsncofs; C:\WINDOWS\system32\dla\tfsncofs.sys [2005-05-31 34845]
                        R2 tfsndrct;tfsndrct; C:\WINDOWS\system32\dla\tfsndrct.sys [2005-05-31 4125]
                        R2 tfsndres;tfsndres; C:\WINDOWS\system32\dla\tfsndres.sys [2005-05-31 2241]
                        R2 tfsnifs;tfsnifs; C:\WINDOWS\system32\dla\tfsnifs.sys [2005-05-31 86876]
                        R2 tfsnopio;tfsnopio; C:\WINDOWS\system32\dla\tfsnopio.sys [2005-05-31 15069]
                        R2 tfsnpool;tfsnpool; C:\WINDOWS\system32\dla\tfsnpool.sys [2005-05-31 6365]
                        R2 tfsnudf;tfsnudf; C:\WINDOWS\system32\dla\tfsnudf.sys [2005-05-31 98716]
                        R2 tfsnudfa;tfsnudfa; C:\WINDOWS\system32\dla\tfsnudfa.sys [2005-05-31 100605]
                        R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
                        R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-23 1578496]
                        R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
                        R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
                        R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
                        R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys [2005-12-01 936960]
                        R3 HSXHWAZL;HSXHWAZL; C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys [2005-12-01 192512]
                        R3 LVPr2Mon;Logitech LVPr2Mon Driver; C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys [2008-07-26 25624]
                        R3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
                        R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
                        R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
                        R3 rimmptsk;rimmptsk; C:\WINDOWS\system32\DRIVERS\rimmptsk.sys [2005-07-15 28544]
                        R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-07-13 51328]
                        R3 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\system32\DRIVERS\rixdptsk.sys [2005-07-14 307968]
                        R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
                        R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2006-03-25 1156648]
                        R3 swmsflt;swmsflt; C:\WINDOWS\System32\drivers\swmsflt.sys [2007-08-10 24456]
                        R3 SWMX00;Sierra Wireless USB MUX Driver (#00); C:\WINDOWS\system32\DRIVERS\swmx00.sys [2007-06-27 73856]
                        R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2006-03-08 191872]
                        R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
                        R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
                        R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
                        R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys [2005-12-01 669696]
                        S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
                        S1 tcyazfq;tcyazfq; \??\C:\WINDOWS\system32\uwzfqas.sys []
                        S1 uwzfqas;uwzfqas; \??\řc []
                        S3 BCM43XX;Dell Wireless WLAN Card Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2006-10-12 604928]
                        S3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys [2006-08-25 44544]
                        S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
                        S3 DSproct;DSproct; \??\C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys []
                        S3 E100B;Intel(R) PRO Adapter Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2001-08-17 117760]
                        S3 FilterService;UVC Filter Service; C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys [2008-07-26 23832]
                        S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-07 49920]
                        S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-07 16496]
                        S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-07 21568]
                        S3 lvpopflt;Logitech POP Suppression Filter; C:\WINDOWS\system32\DRIVERS\lvpopflt.sys [2007-10-11 1920920]
                        S3 LVRS;Logitech RightSound Filter Driver; C:\WINDOWS\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
                        S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\LVUSBSta.sys [2008-07-26 41752]
                        S3 LVUVC;Logitech QuickCam Pro 9000(UVC); C:\WINDOWS\system32\DRIVERS\lvuvc.sys [2008-07-26 4658584]
                        S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
                        S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
                        S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
                        S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
                        S3 PSI;PSI; C:\WINDOWS\system32\DRIVERS\psi_mf.sys [2008-12-10 7808]
                        S3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS []
                        S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
                        S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
                        S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
                        S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
                        S3 SWNC5E00;Sierra Wireless MUX NDIS Driver (#00); C:\WINDOWS\system32\DRIVERS\SWNC5E00.sys [2007-06-27 101248]
                        S3 U2SP;OEM USB to Serial Converter Driver(Philips); C:\WINDOWS\system32\DRIVERS\u2s2kxp.sys [2004-05-05 23296]
                        S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
                        S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
                        S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
                        S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
                        S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
                        S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys []
                        S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
                        S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
                        S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
                        S4 agp440;Intel AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agp440.sys [2008-04-13 42368]
                        S4 agpCPQ;Compaq AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\agpCPQ.sys [2008-04-13 44928]
                        S4 alim1541;ALI AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\alim1541.sys [2008-04-13 42752]
                        S4 amdagp;AMD AGP Bus Filter Driver; C:\WINDOWS\system32\DRIVERS\amdagp.sys [2008-04-13 43008]
                        S4 cbidf;cbidf; C:\WINDOWS\system32\DRIVERS\cbidf2k.sys [2001-08-17 13952]
                        S4 IntelIde;IntelIde; C:\WINDOWS\system32\DRIVERS\intelide.sys [2008-04-13 5504]
                        S4 sisagp;SIS AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\sisagp.sys [2008-04-13 40960]
                        S4 viaagp;VIA AGP Bus Filter; C:\WINDOWS\system32\DRIVERS\viaagp.sys [2008-04-13 42240]

                        ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

                        R2 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
                        R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-02-03 903960]
                        R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-02-03 298264]
                        R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
                        R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
                        R2 HP Port Resolver;HP Port Resolver; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE [2005-05-20 81920]
                        R2 HP Status Server;HP Status Server; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE [2004-10-16 73728]
                        R2 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
                        R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
                        R2 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
                        R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-12 152984]
                        R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-06-20 53248]
                        R2 LVCOMSer;LVCOMSer; C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe [2008-07-26 186904]
                        R2 LVPrcSrv;Process Monitor; C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe [2008-07-26 150040]
                        R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
                        R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-20 322120]
                        R2 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
                        R2 MSSQL$MICROSOFTSMLBIZ;MSSQL$MICROSOFTSMLBIZ; C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe [2008-12-18 9158656]
                        R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
                        R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
                        R2 SPCSUtilityService;SPCSUtilityService; C:\Program Files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe [2007-08-29 131072]
                        R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 202544]
                        R2 SQLAgent$MICROSOFTSMLBIZ;SQLAgent$MICROSOFTSMLBIZ; C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE [2005-05-03 323584]
                        R2 WinDefend;Windows Defender; C:\Program Files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
                        R2 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
                        R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\WINDOWS\System32\WLTRYSVC.EXE [2006-11-01 20480]
                        R2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
                        R3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
                        S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
                        S2 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2005-05-03 73728]
                        S3 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-23 409600]
                        S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
                        S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
                        S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-12-01 33752]
                        S3 GoogleDesktopManager;GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe [2006-12-06 86528]
                        S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-07-11 138168]
                        S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
                        S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
                        S4 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

                        -----------------EOF-----------------
                        Logged

                        evilfantasy

                        • Malware Removal Specialist
                        • Moderator


                          • Genius
                        • Calm like a bomb
                          • Thanked: 493
                        • Experience: Experienced
                        • OS: Windows 11
                        Re: At9
                        « Reply #14 on: February 24, 2009, 08:38:23 AM »
                        Go to Add or Remove Programs and uninstall:

                        - Ask Toolbar
                        - Java(TM) 6 Update 6
                        - Java(TM) 6 Update 7
                        - Search Assistant Addestination

                        ----------

                        Open HijackThis and select Do a system scan only.

                        Place a check mark next to the following entries: (if there)

                        - R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
                        - R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
                        - O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - (no file)
                        - O2 - BHO: (no name) - {053F9267-DC04-4294-A72C-58F732D338C0} - (no file)
                        - O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
                        - O2 - BHO: addestination search enhancer - {52217D1A-11A9-9B1F-8CDB-BA7F100E616C} - (no file)
                        - O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

                        Important: Close all open windows except for HijackThis and then click Fix checked.

                        Once completed, exit HijackThis.

                        ----------

                        Go to Start > Run and type notepad.exe then click OK

                        Copy and paste the below into Notepad and save as fixme.reg to Your Desktop

                        Code: [Select]
                        REGEDIT4

                        [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdidrv32.sys]

                        [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
                        Locate fixme.reg on your Desktop and double-click it. Answer Yes when prompted to merge with the Registry.

                        Make sure that you tell me if you receive a success message about adding the above to the registry. If you do not get a success message, it did not work.

                        Delete the fixme.reg from the Desktop.

                        Run CCleaner and restart the computer.

                        ----------

                        Download Rooter.exe to your desktop

                        * Double click Rooter.exe to start the tool.
                        * A Notepad file containing the report will open, post that in your next reply.

                        A log will also save at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have Windows installed).

                        ----------

                        Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

                        Link #1
                        Link #2

                        **Note:  It is important that it is saved directly to your Desktop

                        Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

                        Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
                         
                        Double click combofix.exe & follow the prompts.
                        When finished ComboFix will produce a log for you.
                        Post the ComboFix log in your next reply.

                        Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

                        Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

                        If you have problems with ComboFix usage, see How to use ComboFix

                        Logged

                        Ralph12

                          Topic Starter


                          Rookie

                          Re: At9
                          « Reply #15 on: February 25, 2009, 07:28:40 AM »
                          The Ask Toolbar wouldn't remove from the Add or Remove Programs  it came up with a window asking to close IE and to click yes to do so when I did that nothing happened so I closed IE  and tried again still nothing happened I haven't  gone any farther and will wait on an answer from you as to whether I should
                          Logged

                          evilfantasy

                          • Malware Removal Specialist
                          • Moderator


                            • Genius
                          • Calm like a bomb
                            • Thanked: 493
                          • Experience: Experienced
                          • OS: Windows 11
                          Re: At9
                          « Reply #16 on: February 25, 2009, 08:02:19 AM »
                          Download Revo Uninstaller
                          • Go in to Revo, right click what you want to uninstall (Ask Toolbar) and choose Uninstall.
                          • Next choose Advanced Mode
                          • This will launch the programs built in uninstaller and go through the normal uninstall process.
                          • Even if the uninstaller fails still continue with the rest of the steps.
                          • Once complete: In Revo Uninstaller click Next and Revo will scan the registry for leftovers.
                            • This scan can take several seconds.
                          • Once the results are shown look at each one to ensure they are all related to the program that was uninstalled.
                          • Choose Select All then click Delete
                          • Click Next and Revo will scan for any files or folders that were not removed.
                          • If any files/folders are found choose Select all > Delete
                          Logged

                          Ralph12

                            Topic Starter


                            Rookie

                            Re: At9
                            « Reply #17 on: February 25, 2009, 12:40:54 PM »
                            Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
                            X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU         T5600  @ 1.83GHz )
                            BIOS : Phoenix ROM BIOS PLUS Version 1.10 A08
                            USER : Ralph Foster ( Administrator )
                            BOOT : Normal boot

                            Antivirus : AVG Anti-Virus Free 8.0 (Activated)


                            C:\ (Local Disk) - NTFS - Total:67 Go (Free:44 Go)
                            D:\ (CD or DVD)

                            Wed 02/25/2009|13:42

                            ----------------------\\  Search..

                            No infections found !


                            1 - "C:\Rooter$\Rooter_1.txt" - Wed 02/25/2009|13:43

                            ----------------------\\  Scan completed at 13:43


                            ComboFix 09-02-24.02 - Ralph Foster 2009-02-25 14:07:08.1 - NTFSx86
                            Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2046.1271 [GMT -5:00]
                            Running from: c:\documents and settings\Ralph Foster\Desktop\ComboFix.exe
                            AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
                             * Created a new restore point
                            .

                            (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
                            .

                            c:\windows\system32\AutoRun.inf

                            .
                            (((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
                            .

                            -------\Legacy_TDIDRV32.SYS


                            (((((((((((((((((((((((((   Files Created from 2009-01-25 to 2009-02-25  )))))))))))))))))))))))))))))))
                            .

                            2009-02-25 13:42 . 2009-02-25 13:43   <DIR>   d--------   C:\Rooter$
                            2009-02-25 13:22 . 2009-02-25 13:22   <DIR>   d--------   c:\program files\VS Revo Group
                            2009-02-25 08:34 . 2009-01-09 14:19   1,089,593   ---------   c:\windows\system32\dllcache\ntprint.cat
                            2009-02-24 08:45 . 2009-02-24 08:45   <DIR>   d--------   c:\program files\IrfanView
                            2009-02-23 09:16 . 2009-02-23 09:17   <DIR>   d--------   C:\rsit
                            2009-02-20 12:38 . 2009-02-20 12:42   <DIR>   d--------   c:\program files\Virtual Earth 3D
                            2009-02-12 10:35 . 2009-02-12 10:36   <DIR>   d--------   c:\program files\Malwarebytes' Anti-Malware
                            2009-02-12 10:35 . 2009-02-12 10:35   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\Malwarebytes
                            2009-02-12 10:35 . 2009-02-12 10:35   <DIR>   d--------   c:\documents and settings\All Users\Application Data\Malwarebytes
                            2009-02-12 10:35 . 2009-02-11 10:19   38,496   --a------   c:\windows\system32\drivers\mbamswissarmy.sys
                            2009-02-12 10:35 . 2009-02-11 10:19   15,504   --a------   c:\windows\system32\drivers\mbam.sys
                            2009-02-12 09:47 . 2009-02-12 09:47   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
                            2009-02-11 14:15 . 2009-02-11 14:15   <DIR>   d--------   c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$
                            2009-02-11 11:26 . 2009-02-11 12:04   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\HPAppData
                            2009-02-10 12:18 . 2009-02-10 12:18   <DIR>   d--------   c:\windows\system32\XPSViewer
                            2009-02-10 12:18 . 2009-02-10 12:18   <DIR>   d--------   c:\program files\Reference Assemblies
                            2009-02-10 12:18 . 2009-02-10 12:18   <DIR>   d--------   c:\program files\MSBuild
                            2009-02-10 12:17 . 2009-02-10 12:18   <DIR>   d--------   C:\13b34594bda98888c66450cc
                            2009-02-10 12:17 . 2008-07-06 07:06   1,676,288   ---------   c:\windows\system32\xpssvcs.dll
                            2009-02-10 12:17 . 2008-07-06 07:06   1,676,288   ---------   c:\windows\system32\dllcache\xpssvcs.dll
                            2009-02-10 12:17 . 2008-07-06 05:50   597,504   ---------   c:\windows\system32\dllcache\printfilterpipelinesvc.exe
                            2009-02-10 12:17 . 2008-07-06 07:06   575,488   ---------   c:\windows\system32\xpsshhdr.dll
                            2009-02-10 12:17 . 2008-07-06 07:06   575,488   ---------   c:\windows\system32\dllcache\xpsshhdr.dll
                            2009-02-10 12:17 . 2008-07-06 07:06   117,760   ---------   c:\windows\system32\prntvpt.dll
                            2009-02-10 12:17 . 2008-07-06 07:06   89,088   ---------   c:\windows\system32\dllcache\filterpipelineprintproc.dll
                            2009-02-10 12:16 . 2009-02-10 12:26   <DIR>   d--------   c:\windows\SxsCaPendDel
                            2009-02-10 07:58 . 2009-02-10 07:58   <DIR>   d--------   c:\program files\MWSnap
                            2009-02-07 14:11 . 2009-02-07 14:11   <DIR>   d--------   c:\windows\system32\Dell
                            2009-02-02 11:28 . 2009-02-02 11:29   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\DriverCure
                            2009-02-02 11:28 . 2009-02-02 11:28   <DIR>   d--------   c:\documents and settings\All Users\Application Data\ParetoLogic
                            2009-02-02 11:28 . 2009-02-02 11:32   <DIR>   d--------   c:\documents and settings\All Users\Application Data\DriverCure
                            2009-01-29 10:43 . 2009-01-29 10:49   <DIR>   d--------   c:\program files\Eusing Free Registry Cleaner
                            2009-01-26 11:05 . 2009-01-26 11:05   <DIR>   d--------   c:\program files\Common Files\Adobe AIR
                            2009-01-26 10:50 . 2009-01-26 10:50   <DIR>   d--------   c:\program files\NOS
                            2009-01-26 10:50 . 2009-01-26 10:50   <DIR>   d--------   c:\documents and settings\All Users\Application Data\NOS
                            2009-01-26 08:04 . 2009-01-26 08:05   <DIR>   d--------   c:\program files\QuickTime
                            2009-01-26 08:04 . 2009-01-26 08:04   <DIR>   d--------   c:\documents and settings\All Users\Application Data\Apple Computer

                            .
                            ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
                            .
                            2009-02-25 14:21   ---------   d-----w   c:\program files\Java
                            2009-02-24 13:01   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\WeatherWatcherLive
                            2009-02-14 13:04   ---------   d-----w   c:\documents and settings\All Users\Application Data\avg8
                            2009-02-12 16:08   ---------   d-----w   c:\program files\Trend Micro
                            2009-02-12 14:47   ---------   d-----w   c:\program files\SUPERAntiSpyware
                            2009-02-12 14:47   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\SUPERAntiSpyware.com
                            2009-02-12 14:31   ---------   d-----w   c:\program files\Spybot - Search & Destroy
                            2009-02-12 14:28   ---------   d-----w   c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
                            2009-02-11 19:26   162   ----a-w   c:\documents and settings\Ralph Foster\Application Data\wklnhst.dat
                            2009-02-11 18:51   ---------   d-----w   c:\program files\Logitech
                            2009-02-11 16:18   ---------   d-----w   c:\program files\HP
                            2009-02-09 17:06   ---------   d-----w   c:\program files\Google
                            2009-02-09 17:02   ---------   d-----w   c:\program files\Lavasoft
                            2009-02-08 20:02   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\IObit
                            2009-02-07 19:11   ---------   d-----w   c:\program files\Dell
                            2009-02-03 13:11   325,128   ----a-w   c:\windows\system32\drivers\avgldx86.sys
                            2009-02-03 13:11   107,272   ----a-w   c:\windows\system32\drivers\avgtdix.sys
                            2009-02-02 16:08   ---------   d-----w   c:\program files\CCleaner
                            2009-01-29 12:32   ---------   d-----w   c:\program files\Weather Watcher Live
                            2009-01-26 16:05   ---------   d-----w   c:\program files\Common Files\Adobe
                            2009-01-20 13:45   ---------   d-----w   c:\program files\Microsoft Baseline Security Analyzer 2
                            2009-01-20 13:28   ---------   d-----w   c:\program files\Secunia
                            2009-01-19 21:49   ---------   d-----w   c:\program files\TLCN2007
                            2009-01-19 15:04   ---------   d-----w   c:\program files\IObit
                            2009-01-14 14:02   ---------   d-----w   c:\program files\Uniblue
                            2009-01-10 14:11   0   ----a-w   c:\windows\system32\drivers\lvuvc.hs
                            2009-01-10 14:11   0   ----a-w   c:\windows\system32\drivers\logiflt.iad
                            2008-12-31 13:17   ---------   d-----w   c:\program files\Common Files\Logitech
                            2008-12-29 11:48   ---------   d-----w   c:\program files\Common Files\LogiShrd
                            2008-12-29 11:44   ---------   d-----w   c:\documents and settings\All Users\Application Data\Logishrd
                            2008-12-27 12:57   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\Move Networks
                            2007-12-17 18:08   534   ----a-w   c:\documents and settings\Sandra Foster\Application Data\wklnhst.dat
                            2008-10-08 00:16   32,768   --sha-w   c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008100720081008\index.dat
                            .

                            (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
                            .
                            .
                            *Note* empty entries & legit default entries are not shown
                            REGEDIT4

                            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
                            "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2008-09-19 4347120]
                            "WeatherWatcherLive"="c:\program files\Weather Watcher Live\ww.exe" [2009-01-28 1171456]
                            "Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                            "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-24 185896]
                            "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
                            "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
                            "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
                            "ISUSScheduler"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [2004-07-27 81920]
                            "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
                            "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544]
                            "Dell QuickSet"="c:\program files\Dell\QuickSet\Quickset.exe" [2006-08-03 1032192]
                            "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
                            "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-03 1601304]
                            "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
                            "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
                            "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-12 148888]

                            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                            "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
                            "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

                            [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                            "RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

                            c:\documents and settings\Ralph Foster\Start Menu\Programs\Startup\
                            Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2008-12-17 748840]

                            [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                            "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
                            2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
                            2009-02-03 08:11 10520 c:\windows\system32\avgrsstx.dll

                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
                            "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

                            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                            "EnableFirewall"= 0 (0x0)

                            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                            "%windir%\\system32\\sessmgr.exe"=
                            "c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
                            "c:\\Program Files\\Messenger\\msmsgs.exe"=
                            "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                            "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                            "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
                            "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
                            "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
                            "c:\\WINDOWS\\system32\\mmc.exe"=

                            R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-10 325128]
                            R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-10 107272]
                            R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-09-03 8944]
                            R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-09-03 55024]
                            R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-04 903960]
                            R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 298264]
                            R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
                            S1 tcyazfq;tcyazfq;\??\c:\windows\system32\uwzfqas.sys --> c:\windows\system32\uwzfqas.sys [?]
                            S1 uwzfqas;uwzfqas;\??\řc --> řc [?]
                            S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-26 33752]
                            S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
                            S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]

                            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                            HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
                            hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
                            .
                            Contents of the 'Scheduled Tasks' folder

                            2009-02-19 c:\windows\Tasks\AppleSoftwareUpdate.job
                            - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

                            2009-02-25 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
                            - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

                            2009-02-25 c:\windows\Tasks\MP Scheduled Scan.job
                            - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
                            .
                            - - - - ORPHANS REMOVED - - - -

                            BHO-{52217D1A-11A9-9B1F-8CDB-BA7F100E616C} - (no file)
                            WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)


                            .
                            ------- Supplementary Scan -------
                            .
                            uInternet Connection Wizard,ShellNext = iexplore
                            IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
                            IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
                            IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
                            TCP: {0F34B328-516A-44EF-B7D7-E1016ACA898F} = 68.28.242.91 68.28.250.92
                            .

                            **************************************************************************

                            catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                            Rootkit scan 2009-02-25 14:13:36
                            Windows 5.1.2600 Service Pack 3 NTFS

                            scanning hidden processes ... 

                            scanning hidden autostart entries ...

                            scanning hidden files ... 

                            scan completed successfully
                            hidden files: 0

                            **************************************************************************

                            [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uwzfqas]
                            "ImagePath"="\??\řc\08"
                            .
                            --------------------- LOCKED REGISTRY KEYS ---------------------

                            [HKEY_USERS\S-1-5-21-2969014591-1171066246-3971638899-1006\Software\Microsoft\SystemCertificates\AddressBook*]
                            @Allowed: (Read) (RestrictedCode)
                            @Allowed: (Read) (RestrictedCode)
                            .
                            --------------------- DLLs Loaded Under Running Processes ---------------------

                            - - - - - - - > 'winlogon.exe'(576)
                            c:\program files\SUPERAntiSpyware\SASWINLO.dll
                            c:\windows\system32\Ati2evxx.dll
                            c:\windows\System32\BCMLogon.dll
                            .
                            ------------------------ Other Running Processes ------------------------
                            .
                            c:\windows\system32\WLTRYSVC.EXE
                            c:\windows\system32\BCMWLTRY.EXE
                            c:\windows\system32\scardsvr.exe
                            c:\windows\system32\msdtc.exe
                            c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                            c:\windows\system32\dllhost.exe
                            c:\windows\ehome\ehrecvr.exe
                            c:\windows\ehome\ehSched.exe
                            c:\windows\system32\spool\drivers\w32x86\3\HPBPRO.EXE
                            c:\windows\system32\spool\drivers\w32x86\3\HPBOID.EXE
                            c:\program files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                            c:\program files\Java\jre6\bin\jqs.exe
                            c:\program files\Common Files\LightScribe\LSSrvc.exe
                            c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                            c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                            c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
                            c:\windows\system32\msiexec.exe
                            c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
                            c:\windows\system32\sessmgr.exe
                            c:\program files\AVG\AVG8\avgrsx.exe
                            c:\progra~1\AVG\AVG8\avgnsx.exe
                            c:\program files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
                            c:\program files\Dell Support Center\bin\sprtsvc.exe
                            c:\windows\system32\dllhost.exe
                            c:\windows\system32\vssvc.exe
                            c:\program files\Windows Live\installer\WLSetupSvc.exe
                            c:\windows\system32\wbem\wmiapsrv.exe
                            c:\program files\Windows Media Player\wmpnetwk.exe
                            c:\windows\ehome\mcrdsvc.exe
                            c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE
                            c:\program files\AVG\AVG8\avgcsrvx.exe
                            c:\windows\system32\wscntfy.exe
                            c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
                            c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
                            .
                            **************************************************************************
                            .
                            Completion time: 2009-02-25 14:17:32 - machine was rebooted
                            ComboFix-quarantined-files.txt  2009-02-25 19:17:14

                            Pre-Run: 47,678,504,960 bytes free
                            Post-Run: 47,797,551,104 bytes free

                            WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
                            [boot loader]
                            timeout=2
                            default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
                            [operating systems]
                            c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                            multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

                            263   --- E O F ---   2009-02-25 14:49:10
                            Logged

                            evilfantasy

                            • Malware Removal Specialist
                            • Moderator


                              • Genius
                            • Calm like a bomb
                              • Thanked: 493
                            • Experience: Experienced
                            • OS: Windows 11
                            Re: At9
                            « Reply #18 on: February 25, 2009, 12:46:22 PM »
                            Delete these files/folders, as follows:

                            1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
                            It must be Notepad, not Wordpad.
                            2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

                            Code: [Select]
                            KillALL::

                            Driver::
                            tcyazfq
                            uwzfqas

                            Registry::
                            [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uwzfqas]

                            3. Go to the Notepad window and click Edit > Paste
                            4. Then click File > Save
                            5. Name the file CFScript.txt - Save the file to your Desktop
                            6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



                            ComboFix will begin to execute, just follow the prompts.
                            After reboot (in case it asks to reboot), it will produce a log for you.
                            Post that log (Combofix.txt) in your next reply.

                            Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

                            Also let me know how the computer is running now.
                            Logged

                            Ralph12

                              Topic Starter


                              Rookie

                              Re: At9
                              « Reply #19 on: February 25, 2009, 01:56:45 PM »
                              ComboFix 09-02-24.02 - Ralph Foster 2009-02-25 15:36:38.2 - NTFSx86
                              Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2046.1367 [GMT -5:00]
                              Running from: c:\documents and settings\Ralph Foster\Desktop\ComboFix.exe
                              Command switches used :: c:\documents and settings\Ralph Foster\Desktop\CFScript.txt
                              AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
                               * Created a new restore point
                              .

                              (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              .
                              (((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
                              .

                              -------\Service_tcyazfq
                              -------\Service_uwzfqas


                              (((((((((((((((((((((((((   Files Created from 2009-01-25 to 2009-02-25  )))))))))))))))))))))))))))))))
                              .

                              2009-02-25 13:42 . 2009-02-25 13:43   <DIR>   d--------   C:\Rooter$
                              2009-02-25 13:22 . 2009-02-25 13:22   <DIR>   d--------   c:\program files\VS Revo Group
                              2009-02-25 08:34 . 2009-01-09 14:19   1,089,593   ---------   c:\windows\system32\dllcache\ntprint.cat
                              2009-02-24 08:45 . 2009-02-24 08:45   <DIR>   d--------   c:\program files\IrfanView
                              2009-02-23 09:16 . 2009-02-23 09:17   <DIR>   d--------   C:\rsit
                              2009-02-20 12:38 . 2009-02-20 12:42   <DIR>   d--------   c:\program files\Virtual Earth 3D
                              2009-02-12 10:35 . 2009-02-12 10:36   <DIR>   d--------   c:\program files\Malwarebytes' Anti-Malware
                              2009-02-12 10:35 . 2009-02-12 10:35   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\Malwarebytes
                              2009-02-12 10:35 . 2009-02-12 10:35   <DIR>   d--------   c:\documents and settings\All Users\Application Data\Malwarebytes
                              2009-02-12 10:35 . 2009-02-11 10:19   38,496   --a------   c:\windows\system32\drivers\mbamswissarmy.sys
                              2009-02-12 10:35 . 2009-02-11 10:19   15,504   --a------   c:\windows\system32\drivers\mbam.sys
                              2009-02-12 09:47 . 2009-02-12 09:47   <DIR>   d--------   c:\program files\Common Files\Wise Installation Wizard
                              2009-02-11 14:15 . 2009-02-11 14:15   <DIR>   d--------   c:\windows\$SQLUninstallSQL2000-KB960082-v8.00.2055-x86-ENU$
                              2009-02-11 11:26 . 2009-02-11 12:04   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\HPAppData
                              2009-02-10 12:18 . 2009-02-10 12:18   <DIR>   d--------   c:\windows\system32\XPSViewer
                              2009-02-10 12:18 . 2009-02-10 12:18   <DIR>   d--------   c:\program files\Reference Assemblies
                              2009-02-10 12:18 . 2009-02-10 12:18   <DIR>   d--------   c:\program files\MSBuild
                              2009-02-10 12:17 . 2009-02-10 12:18   <DIR>   d--------   C:\13b34594bda98888c66450cc
                              2009-02-10 12:17 . 2008-07-06 07:06   1,676,288   ---------   c:\windows\system32\xpssvcs.dll
                              2009-02-10 12:17 . 2008-07-06 07:06   1,676,288   ---------   c:\windows\system32\dllcache\xpssvcs.dll
                              2009-02-10 12:17 . 2008-07-06 05:50   597,504   ---------   c:\windows\system32\dllcache\printfilterpipelinesvc.exe
                              2009-02-10 12:17 . 2008-07-06 07:06   575,488   ---------   c:\windows\system32\xpsshhdr.dll
                              2009-02-10 12:17 . 2008-07-06 07:06   575,488   ---------   c:\windows\system32\dllcache\xpsshhdr.dll
                              2009-02-10 12:17 . 2008-07-06 07:06   117,760   ---------   c:\windows\system32\prntvpt.dll
                              2009-02-10 12:17 . 2008-07-06 07:06   89,088   ---------   c:\windows\system32\dllcache\filterpipelineprintproc.dll
                              2009-02-10 12:16 . 2009-02-10 12:26   <DIR>   d--------   c:\windows\SxsCaPendDel
                              2009-02-10 07:58 . 2009-02-10 07:58   <DIR>   d--------   c:\program files\MWSnap
                              2009-02-07 14:11 . 2009-02-07 14:11   <DIR>   d--------   c:\windows\system32\Dell
                              2009-02-02 11:28 . 2009-02-02 11:29   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\DriverCure
                              2009-02-02 11:28 . 2009-02-02 11:28   <DIR>   d--------   c:\documents and settings\All Users\Application Data\ParetoLogic
                              2009-02-02 11:28 . 2009-02-02 11:32   <DIR>   d--------   c:\documents and settings\All Users\Application Data\DriverCure
                              2009-01-29 10:43 . 2009-01-29 10:49   <DIR>   d--------   c:\program files\Eusing Free Registry Cleaner
                              2009-01-26 11:05 . 2009-01-26 11:05   <DIR>   d--------   c:\program files\Common Files\Adobe AIR
                              2009-01-26 10:50 . 2009-01-26 10:50   <DIR>   d--------   c:\program files\NOS
                              2009-01-26 10:50 . 2009-01-26 10:50   <DIR>   d--------   c:\documents and settings\All Users\Application Data\NOS
                              2009-01-26 08:04 . 2009-01-26 08:05   <DIR>   d--------   c:\program files\QuickTime
                              2009-01-26 08:04 . 2009-01-26 08:04   <DIR>   d--------   c:\documents and settings\All Users\Application Data\Apple Computer

                              .
                              ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              2009-02-25 19:17   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\WeatherWatcherLive
                              2009-02-25 14:21   ---------   d-----w   c:\program files\Java
                              2009-02-14 13:04   ---------   d-----w   c:\documents and settings\All Users\Application Data\avg8
                              2009-02-12 16:08   ---------   d-----w   c:\program files\Trend Micro
                              2009-02-12 14:47   ---------   d-----w   c:\program files\SUPERAntiSpyware
                              2009-02-12 14:47   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\SUPERAntiSpyware.com
                              2009-02-12 14:31   ---------   d-----w   c:\program files\Spybot - Search & Destroy
                              2009-02-12 14:28   ---------   d-----w   c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
                              2009-02-11 19:26   162   ----a-w   c:\documents and settings\Ralph Foster\Application Data\wklnhst.dat
                              2009-02-11 18:51   ---------   d-----w   c:\program files\Logitech
                              2009-02-11 16:18   ---------   d-----w   c:\program files\HP
                              2009-02-09 17:06   ---------   d-----w   c:\program files\Google
                              2009-02-09 17:02   ---------   d-----w   c:\program files\Lavasoft
                              2009-02-08 20:02   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\IObit
                              2009-02-07 19:11   ---------   d-----w   c:\program files\Dell
                              2009-02-03 13:11   325,128   ----a-w   c:\windows\system32\drivers\avgldx86.sys
                              2009-02-03 13:11   107,272   ----a-w   c:\windows\system32\drivers\avgtdix.sys
                              2009-02-02 16:08   ---------   d-----w   c:\program files\CCleaner
                              2009-01-29 12:32   ---------   d-----w   c:\program files\Weather Watcher Live
                              2009-01-26 16:05   ---------   d-----w   c:\program files\Common Files\Adobe
                              2009-01-20 13:45   ---------   d-----w   c:\program files\Microsoft Baseline Security Analyzer 2
                              2009-01-20 13:28   ---------   d-----w   c:\program files\Secunia
                              2009-01-19 21:49   ---------   d-----w   c:\program files\TLCN2007
                              2009-01-19 15:04   ---------   d-----w   c:\program files\IObit
                              2009-01-14 14:02   ---------   d-----w   c:\program files\Uniblue
                              2009-01-10 14:11   0   ----a-w   c:\windows\system32\drivers\lvuvc.hs
                              2009-01-10 14:11   0   ----a-w   c:\windows\system32\drivers\logiflt.iad
                              2008-12-31 13:17   ---------   d-----w   c:\program files\Common Files\Logitech
                              2008-12-29 11:48   ---------   d-----w   c:\program files\Common Files\LogiShrd
                              2008-12-29 11:44   ---------   d-----w   c:\documents and settings\All Users\Application Data\Logishrd
                              2008-12-27 12:57   ---------   d-----w   c:\documents and settings\Ralph Foster\Application Data\Move Networks
                              2007-12-17 18:08   534   ----a-w   c:\documents and settings\Sandra Foster\Application Data\wklnhst.dat
                              2008-10-08 00:16   32,768   --sha-w   c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008100720081008\index.dat
                              .

                              (((((((((((((((((((((((((((((   SnapShot@2009-02-25_14.16.24.04   )))))))))))))))))))))))))))))))))))))))))
                              .
                              + 2009-02-25 20:40:50   16,384   ----atw   c:\windows\temp\Perflib_Perfdata_214.dat
                              + 2009-02-25 20:40:49   16,384   ----atw   c:\windows\temp\Perflib_Perfdata_7b4.dat
                              .
                              (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
                              .
                              .
                              *Note* empty entries & legit default entries are not shown
                              REGEDIT4

                              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
                              "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2008-09-19 4347120]
                              "WeatherWatcherLive"="c:\program files\Weather Watcher Live\ww.exe" [2009-01-28 1171456]
                              "Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]

                              [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                              "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-24 185896]
                              "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
                              "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
                              "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
                              "ISUSScheduler"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [2004-07-27 81920]
                              "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
                              "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544]
                              "Dell QuickSet"="c:\program files\Dell\QuickSet\Quickset.exe" [2006-08-03 1032192]
                              "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
                              "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-03 1601304]
                              "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
                              "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
                              "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-12 148888]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                              "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]
                              "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

                              [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                              "RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

                              c:\documents and settings\Ralph Foster\Start Menu\Programs\Startup\
                              Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2008-12-17 748840]

                              [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                              "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
                              2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
                              2009-02-03 08:11 10520 c:\windows\system32\avgrsstx.dll

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
                              "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                              "EnableFirewall"= 0 (0x0)

                              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                              "%windir%\\system32\\sessmgr.exe"=
                              "c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
                              "c:\\Program Files\\Messenger\\msmsgs.exe"=
                              "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                              "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                              "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
                              "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
                              "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
                              "c:\\WINDOWS\\system32\\mmc.exe"=

                              R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-10 325128]
                              R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-10 107272]
                              R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-09-03 8944]
                              R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-09-03 55024]
                              R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-04 903960]
                              R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 298264]
                              R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]
                              S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-26 33752]
                              S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
                              S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-09-03 7408]

                              [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                              HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
                              hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
                              .
                              Contents of the 'Scheduled Tasks' folder

                              2009-02-19 c:\windows\Tasks\AppleSoftwareUpdate.job
                              - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

                              2009-02-25 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
                              - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

                              2009-02-25 c:\windows\Tasks\MP Scheduled Scan.job
                              - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
                              .
                              - - - - ORPHANS REMOVED - - - -

                              WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)


                              .
                              ------- Supplementary Scan -------
                              .
                              uInternet Connection Wizard,ShellNext = iexplore
                              IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
                              IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
                              IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
                              TCP: {0F34B328-516A-44EF-B7D7-E1016ACA898F} = 68.28.242.91 68.28.250.92
                              .

                              **************************************************************************

                              catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                              Rootkit scan 2009-02-25 15:45:10
                              Windows 5.1.2600 Service Pack 3 NTFS

                              scanning hidden processes ... 

                              scanning hidden autostart entries ...

                              scanning hidden files ... 

                              scan completed successfully
                              hidden files: 0

                              **************************************************************************
                              .
                              --------------------- LOCKED REGISTRY KEYS ---------------------

                              [HKEY_USERS\S-1-5-21-2969014591-1171066246-3971638899-1006\Software\Microsoft\SystemCertificates\AddressBook*]
                              @Allowed: (Read) (RestrictedCode)
                              @Allowed: (Read) (RestrictedCode)
                              .
                              --------------------- DLLs Loaded Under Running Processes ---------------------

                              - - - - - - - > 'winlogon.exe'(576)
                              c:\program files\SUPERAntiSpyware\SASWINLO.dll
                              c:\windows\system32\Ati2evxx.dll
                              c:\windows\System32\BCMLogon.dll
                              .
                              ------------------------ Other Running Processes ------------------------
                              .
                              c:\windows\system32\WLTRYSVC.EXE
                              c:\windows\system32\BCMWLTRY.EXE
                              c:\windows\system32\scardsvr.exe
                              c:\windows\system32\msdtc.exe
                              c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                              c:\windows\system32\dllhost.exe
                              c:\windows\ehome\ehrecvr.exe
                              c:\windows\ehome\ehSched.exe
                              c:\windows\system32\spool\drivers\w32x86\3\HPBPRO.EXE
                              c:\windows\system32\spool\drivers\w32x86\3\HPBOID.EXE
                              c:\program files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                              c:\program files\Java\jre6\bin\jqs.exe
                              c:\program files\Common Files\LightScribe\LSSrvc.exe
                              c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
                              c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
                              c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
                              c:\windows\system32\msiexec.exe
                              c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
                              c:\program files\AVG\AVG8\avgrsx.exe
                              c:\progra~1\AVG\AVG8\avgnsx.exe
                              c:\windows\system32\sessmgr.exe
                              c:\program files\Sprint\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe
                              c:\program files\Dell Support Center\bin\sprtsvc.exe
                              c:\windows\system32\dllhost.exe
                              c:\windows\system32\vssvc.exe
                              c:\program files\Windows Live\installer\WLSetupSvc.exe
                              c:\windows\system32\wbem\wmiapsrv.exe
                              c:\windows\ehome\mcrdsvc.exe
                              c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE
                              c:\program files\Windows Media Player\wmpnetwk.exe
                              c:\program files\AVG\AVG8\avgcsrvx.exe
                              c:\windows\system32\wscntfy.exe
                              c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
                              c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
                              .
                              **************************************************************************
                              .
                              Completion time: 2009-02-25 15:48:52 - machine was rebooted [Ralph Foster]
                              ComboFix-quarantined-files.txt  2009-02-25 20:48:48
                              ComboFix2.txt  2009-02-25 19:17:34

                              Pre-Run: 47,817,404,416 bytes free
                              Post-Run: 47,806,996,480 bytes free

                              258   --- E O F ---   2009-02-25 14:49:10


                              It seemed to be a little better but I wasn't paying close attention sorry. At least this time my sprint air card worked after boot up from combofix the last time I had to reboot
                              Logged

                              evilfantasy

                              • Malware Removal Specialist
                              • Moderator


                                • Genius
                              • Calm like a bomb
                                • Thanked: 493
                              • Experience: Experienced
                              • OS: Windows 11
                              Re: At9
                              « Reply #20 on: February 25, 2009, 02:03:56 PM »
                              Do you still have these programs installed?

                              2009-02-02 11:28 . 2009-02-02 11:29   <DIR>   d--------   c:\documents and settings\Ralph Foster\Application Data\DriverCure
                              2009-02-02 11:28 . 2009-02-02 11:28   <DIR>   d--------   c:\documents and settings\All Users\Application Data\ParetoLogic
                              2009-02-02 11:28 . 2009-02-02 11:32   <DIR>   d--------   c:\documents and settings\All Users\Application Data\DriverCure
                              2009-01-29 10:43 . 2009-01-29 10:49   <DIR>   d--------   c:\program files\Eusing Free Registry Cleaner
                              Logged

                              Ralph12

                                Topic Starter


                                Rookie

                                Re: At9
                                « Reply #21 on: February 25, 2009, 02:28:13 PM »
                                I did not find Driver Cure in c:\documents and settings\Ralph Foster\Application Data\DriverCure
                                I did find Drivrer Cure in c:\documents and settings\Ralph Foster\Application Data\DriverCure
                                and I did find Paretologic in c:\documents and settings\All Users\Application Data\ParetoLogic
                                Logged

                                evilfantasy

                                • Malware Removal Specialist
                                • Moderator


                                  • Genius
                                • Calm like a bomb
                                  • Thanked: 493
                                • Experience: Experienced
                                • OS: Windows 11
                                Re: At9
                                « Reply #22 on: February 25, 2009, 03:01:18 PM »
                                Did you uninstall them is what I need to know?

                                The files are there but the programs aren't in the Add/Remove Programs list and we can remove the folders with the next fix. Those aren't trusted programs.
                                Logged

                                Ralph12

                                  Topic Starter


                                  Rookie

                                  Re: At9
                                  « Reply #23 on: February 25, 2009, 03:07:39 PM »
                                  If I did uninstall them I don't remeber doing it.
                                  Logged

                                  evilfantasy

                                  • Malware Removal Specialist
                                  • Moderator


                                    • Genius
                                  • Calm like a bomb
                                    • Thanked: 493
                                  • Experience: Experienced
                                  • OS: Windows 11
                                  Re: At9
                                  « Reply #24 on: February 25, 2009, 03:18:41 PM »
                                  OK no problem.

                                  Download the OTMoveIt3 by OldTimer

                                  Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator.

                                  * Save it to your Desktop.
                                  * Double-click OTMoveIt3.exe to run it.
                                  * Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

                                  Code: [Select]
                                  :Processes
                                  explorer.exe

                                  :files
                                  C:\Rooter$
                                  c:\documents and settings\Ralph Foster\Application Data\DriverCure
                                  c:\documents and settings\All Users\Application Data\ParetoLogic
                                  c:\documents and settings\All Users\Application Data\DriverCure

                                  :Commands
                                  [purity]
                                  [emptytemp]
                                  [start explorer]
                                  [Reboot]

                                  * Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
                                  * Click the red Moveit! button.
                                  * Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
                                  Close OTMoveIt3

                                  Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. If not, reboot anyway.

                                  ----------

                                  After posting the OTMoveIt3 log.

                                  Use the Kaspersky Lab Online Scanner

                                  In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.

                                  • Click on SCAN NOW
                                  • Click Accept.
                                  • The program will then begin downloading the latest definition files.
                                  • Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
                                  • The scan will take a while, so be patient and let it finish.
                                  .
                                  When the scan is done, in the Scan is complete window, any infection is displayed.
                                  There is no option to clean/disinfect, however, we need to analyze the information on the report.

                                  To obtain the report:
                                  Click on: Save Report As
                                  • Next, in the Save as prompt, Save in area, select: Desktop.
                                  • In the File name area use KScan, or something similar.
                                  • In Save as type: click the drop arrow and select: Text file [*.txt]
                                  • Then, click: Save

                                  .
                                  Copy and paste the Kaspersky Online Scanner Report in your next reply.

                                  Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

                                  Logged

                                  Ralph12

                                    Topic Starter


                                    Rookie

                                    Re: At9
                                    « Reply #25 on: February 26, 2009, 06:27:06 AM »
                                    User's Internet Explorer cache folder emptied.
                                    Local Service Temp folder emptied.
                                    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                                    Local Service Temporary Internet Files folder emptied.
                                    File delete failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\17f61245-07e3-469b-a2fb-502424def491.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\6e06df26-ce89-42db-a5e2-8cdee3153178.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\7c2bf409-ac90-4f5d-a396-5b5f8ad54103.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\bb4c1f81-7c15-4d3a-b86e-eb0c8c516379.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_340.dat scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7e4.dat scheduled to be deleted on reboot.
                                    Windows Temp folder emptied.
                                    Java cache emptied.
                                    Temp folders emptied.
                                    Explorer started successfully
                                     
                                    OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02262009_081119

                                    This log came up after I rebooted I didn't know if you needed it or not so I am sending it also

                                    User's Internet Explorer cache folder emptied.
                                    Local Service Temp folder emptied.
                                    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
                                    Local Service Temporary Internet Files folder emptied.
                                    File delete failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\17f61245-07e3-469b-a2fb-502424def491.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\6e06df26-ce89-42db-a5e2-8cdee3153178.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\7c2bf409-ac90-4f5d-a396-5b5f8ad54103.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\bb4c1f81-7c15-4d3a-b86e-eb0c8c516379.tmp scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_340.dat scheduled to be deleted on reboot.
                                    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7e4.dat scheduled to be deleted on reboot.
                                    Windows Temp folder emptied.
                                    Java cache emptied.
                                    Temp folders emptied.
                                    Explorer started successfully
                                     
                                    OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02262009_081119
                                    Logged

                                    evilfantasy

                                    • Malware Removal Specialist
                                    • Moderator


                                      • Genius
                                    • Calm like a bomb
                                      • Thanked: 493
                                    • Experience: Experienced
                                    • OS: Windows 11
                                    Re: At9
                                    « Reply #26 on: February 26, 2009, 09:37:42 AM »
                                    What about the Kaspersky scan?
                                    Logged

                                    Ralph12

                                      Topic Starter


                                      Rookie

                                      Re: At9
                                      « Reply #27 on: February 26, 2009, 10:05:47 AM »
                                      --------------------------------------------------------------------------------
                                      KASPERSKY ONLINE SCANNER 7 REPORT
                                       Thursday, February 26, 2009
                                       Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
                                       Kaspersky Online Scanner 7 version: 7.0.25.0
                                       Program database last update: Thursday, February 26, 2009 11:42:48
                                       Records in database: 1847735
                                      --------------------------------------------------------------------------------

                                      Scan settings:
                                         Scan using the following database: extended
                                         Scan archives: yes
                                         Scan mail databases: yes

                                      Scan area - My Computer:
                                         C:\
                                         D:\

                                      Scan statistics:
                                         Files scanned: 88634
                                         Threat name: 0
                                         Infected objects: 0
                                         Suspicious objects: 0
                                         Duration of the scan: 01:02:51

                                      No malware has been detected. The scan area is clean.

                                      The selected area was scanned.
                                      Logged

                                      evilfantasy

                                      • Malware Removal Specialist
                                      • Moderator


                                        • Genius
                                      • Calm like a bomb
                                        • Thanked: 493
                                      • Experience: Experienced
                                      • OS: Windows 11
                                      Re: At9
                                      « Reply #28 on: February 26, 2009, 10:06:18 AM »
                                      Looks OK. How is the computer running now?
                                      Logged

                                      Ralph12

                                        Topic Starter


                                        Rookie

                                        Re: At9
                                        « Reply #29 on: February 26, 2009, 10:21:37 AM »
                                        I still get at start up get the message that a scheduled task did not start at the scheculed time I just went in to the schedule task folder and found one that I thought I had changed but hadn't I will shut down and let you know if it still pops up
                                        Thank you for your patience and help so far
                                        Logged

                                        evilfantasy

                                        • Malware Removal Specialist
                                        • Moderator


                                          • Genius
                                        • Calm like a bomb
                                          • Thanked: 493
                                        • Experience: Experienced
                                        • OS: Windows 11
                                        Re: At9
                                        « Reply #30 on: February 26, 2009, 10:23:27 AM »
                                        OK let me know if you need any help with it.

                                        1. Double click OTMoveIt3.exe to launch it.
                                        Vista users right click and choose Run As Administrator
                                        2. Click on the CleanUp! button.
                                        3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
                                        4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
                                        5. Once complete exit out of OTMoveIt3

                                        ----------

                                        Use the Secunia Software Inspector to check for out of date software.
                                        • Click Start Now
                                        • Check the box next to Enable thorough system inspection.
                                        • Click Start
                                        • Allow the scan to finish and scroll down to see if any updates are needed.
                                        • Update anything listed.
                                        .
                                        ----------

                                        Go to Microsoft Windows Update and get all critical updates.

                                        ----------

                                        Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

                                        Concerned about Browser Security? Consider using Mozilla Firefox. With more than 15,000 improvements, Firefox 3 is faster, safer and smarter than ever before.

                                        I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

                                        SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
                                        * Using SpywareBlaster to protect your computer from Spyware and Malware
                                        * If you don't know what ActiveX controls are, see here

                                        Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

                                        Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.
                                        Logged

                                        Ralph12

                                          Topic Starter


                                          Rookie

                                          Re: At9
                                          « Reply #31 on: February 27, 2009, 07:19:37 AM »
                                          I had one program that was still trying to run and the computer was off I changed it and it seems to be working.
                                          Logged

                                          Ralph12

                                            Topic Starter


                                            Rookie

                                            Re: At9
                                            « Reply #32 on: March 01, 2009, 06:41:48 AM »
                                            Sorry about taking so long to get back with you. Widows defender is the  one that wants to run when the computer is off I tried to change the time but it keeps going back to it any suggestions?
                                            Logged

                                            evilfantasy

                                            • Malware Removal Specialist
                                            • Moderator


                                              • Genius
                                            • Calm like a bomb
                                              • Thanked: 493
                                            • Experience: Experienced
                                            • OS: Windows 11
                                            Re: At9
                                            « Reply #33 on: March 01, 2009, 11:09:43 AM »
                                            Widows defender is meant to run all of the time. The only way to stop it is to uninstall it.
                                            Logged
                                            Pages: 1 2 3 [All]   Go Up
                                            « previous next »