Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: 1 [2] 3 4 5  All   Go Down

Author Topic: Virus?  (Read 27132 times)

0 Members and 1 Guest are viewing this topic.

evilfantasy

  • Malware Removal Specialist
  • Moderator


    • Genius
  • Calm like a bomb
    • Thanked: 493
  • Experience: Experienced
  • OS: Windows 11
Re: Virus?
« Reply #15 on: October 01, 2009, 09:11:10 AM »
Let ComboFix run anyway. It won't hurt anything.
Logged

TriciaM

    Topic Starter


    Beginner

    Re: Virus?
    « Reply #16 on: October 01, 2009, 10:06:35 AM »
    ComboFix 09-09-30.06 - Tricia & Roger 10/01/2009 11:38.1.2 - NTFSx86
    Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.1022.451 [GMT -4:00]
    Running from: c:\documents and settings\Tricia & Roger\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Tricia & Roger\Desktop\CFScript.txt
    AV: Authentium Antivirus *On-access scanning enabled* (Updated) {A4E803B3-4E6E-4271-B1CD-56FBC0992D36}
    AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
    FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    FILE ::
    "c:\windows\_delis32.ini"
    .

    (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Tricia & Roger\err.log
    c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
    c:\program files\sks~1
    c:\program files\sks~1\??sks\ctxad-559.0001
    c:\program files\sks~1\??sks\ctxad-559.0002
    c:\program files\sks~1\??sks\ctxad-559.0003
    c:\temp\fse
    c:\windows\_delis32.ini
    c:\windows\Installer\12ae3.msp
    c:\windows\Installer\15cf844.msi
    c:\windows\Installer\fea64.msp
    c:\windows\smante~1
    c:\windows\system32\evhbbweu.ini
    c:\windows\system32\mxrqrqwp.ini
    c:\windows\wpd99.drv

    .
    (((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_IPRIP
    -------\Legacy_SYMANTEC_CORE_LC
    -------\Service_Iprip
    -------\Service_Symantec Core LC


    (((((((((((((((((((((((((   Files Created from 2009-09-01 to 2009-10-01  )))))))))))))))))))))))))))))))
    .

    2009-10-01 15:52 . 2009-10-01 15:52   --------   d-----w-   c:\windows\LastGood
    2009-10-01 02:44 . 2009-10-01 02:44   --------   d-----w-   c:\documents and settings\Tricia & Roger\Local Settings\Application Data\NOS
    2009-10-01 01:57 . 2009-10-01 02:48   --------   d-----w-   c:\documents and settings\All Users\Application Data\NOS
    2009-10-01 01:57 . 2009-10-01 02:40   --------   d-----w-   c:\program files\NOS
    2009-09-30 21:10 . 2009-09-30 21:10   --------   d-----w-   c:\windows\system32\FxsTmp
    2009-09-30 21:08 . 2004-08-04 11:00   41029   ----a-w-   c:\windows\system32\dllcache\zcorem.dll
    2009-09-30 21:08 . 2004-08-04 11:00   1039955   ----a-w-   c:\windows\system32\dllcache\cmnresm.dll
    2009-09-30 21:08 . 2004-08-04 11:00   113222   ----a-w-   c:\windows\system32\dllcache\zoneclim.dll
    2009-09-30 21:08 . 2004-08-04 11:00   217160   ----a-w-   c:\windows\system32\dllcache\cmnclim.dll
    2009-09-30 21:08 . 2004-08-04 11:00   29760   ----a-w-   c:\windows\system32\dllcache\znetm.dll
    2009-09-30 21:08 . 2004-08-04 11:00   36937   ----a-w-   c:\windows\system32\dllcache\zclientm.exe
    2009-09-30 21:07 . 2004-08-04 11:00   13312   ----a-w-   c:\windows\system32\dllcache\htrn_jis.dll
    2009-09-30 21:07 . 2004-08-04 11:00   18944   ----a-w-   c:\windows\system32\simptcp.dll
    2009-09-30 21:07 . 2004-08-04 11:00   18944   ----a-w-   c:\windows\system32\dllcache\simptcp.dll
    2009-09-30 21:07 . 2004-08-04 11:00   5632   ----a-w-   c:\windows\system32\dllcache\smimsgif.dll
    2009-09-30 21:07 . 2004-08-04 11:00   5632   ----a-w-   c:\windows\system32\dllcache\smierrsy.dll
    2009-09-30 21:07 . 2004-08-04 11:00   15872   ----a-w-   c:\windows\system32\dllcache\smierrsm.dll
    2009-09-30 21:07 . 2004-08-04 11:00   10240   ----a-w-   c:\windows\system32\wbem\snmpstup.dll
    2009-09-30 21:07 . 2004-08-04 11:00   10240   ----a-w-   c:\windows\system32\dllcache\snmpstup.dll
    2009-09-30 15:24 . 2009-09-30 15:29   --------   d-----w-   c:\program files\Trend Micro
    2009-09-30 14:54 . 2009-09-30 14:54   --------   d-----w-   c:\program files\SystemRequirementsLab
    2009-09-30 14:54 . 2009-09-30 14:54   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\SystemRequirementsLab
    2009-09-30 14:36 . 2005-02-28 13:49   294912   ----a-w-   c:\windows\system32\FlexEng.dll
    2009-09-30 14:07 . 2009-08-18 17:44   53248   ----a-w-   c:\windows\system32\CSVer.dll
    2009-09-30 13:59 . 2009-09-30 13:59   --------   d-----w-   C:\Intel
    2009-09-30 12:00 . 2009-09-30 12:00   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\Malwarebytes
    2009-09-30 12:00 . 2009-09-10 18:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-30 12:00 . 2009-09-30 12:00   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-09-30 12:00 . 2009-09-10 18:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
    2009-09-30 12:00 . 2009-09-30 12:00   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
    2009-09-30 04:55 . 2009-09-30 04:55   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-09-30 04:54 . 2009-09-30 04:54   --------   d-----w-   c:\program files\SUPERAntiSpyware
    2009-09-30 04:54 . 2009-09-30 04:54   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\SUPERAntiSpyware.com
    2009-09-30 03:41 . 2009-09-30 03:41   --------   d-----w-   c:\program files\CCleaner
    2009-09-10 01:57 . 2009-06-21 21:44   153088   ------w-   c:\windows\system32\dllcache\triedit.dll

    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-01 15:44 . 2009-03-15 12:23   18128084   --sha-w-   c:\windows\system32\drivers\fidbox.idx
    2009-10-01 15:44 . 2007-09-30 02:31   1353854240   --sha-w-   c:\windows\system32\drivers\fidbox.dat
    2009-10-01 05:13 . 2007-02-19 03:16   --------   d-----w-   c:\program files\TaxCut06
    2009-10-01 05:11 . 2006-03-04 15:26   --------   d-----w-   c:\program files\TaxCut05
    2009-10-01 05:10 . 2005-03-22 03:07   --------   d-----w-   c:\program files\TaxCut04
    2009-10-01 05:02 . 2005-10-12 00:23   --------   d-----w-   c:\program files\EarthLink TotalAccess
    2009-10-01 00:42 . 2008-10-25 13:17   --------   d-----w-   c:\documents and settings\All Users\Application Data\Google Updater
    2009-09-30 15:17 . 2006-01-02 23:00   --------   d-----w-   c:\program files\Common Files\Logitech
    2009-09-30 15:11 . 2004-11-23 07:52   --------   d-----w-   c:\program files\Java
    2009-09-30 14:57 . 2004-11-23 07:52   --------   d-----w-   c:\program files\Common Files\InstallShield
    2009-09-30 14:23 . 2004-11-23 07:52   --------   d-----w-   c:\program files\Intel
    2009-09-30 13:59 . 2004-11-23 07:52   --------   d--h--w-   c:\program files\InstallShield Installation Information
    2009-09-30 04:52 . 2007-02-26 02:04   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
    2009-09-30 03:15 . 2007-12-24 19:57   --------   d-----w-   c:\program files\Windows Live
    2009-09-30 03:05 . 2005-05-28 12:19   --------   d-----w-   c:\program files\The Learning Company
    2009-09-30 02:57 . 2008-08-22 20:29   --------   d-----w-   c:\program files\MyPublisher
    2009-09-30 02:50 . 2007-08-29 23:41   --------   d-----w-   c:\program files\Kids Cam Show and Share Creativity Center
    2009-09-30 02:43 . 2005-10-08 12:11   --------   d-----w-   c:\program files\Infogrames Interactive
    2009-09-30 02:43 . 2006-06-04 17:42   --------   d-----w-   c:\program files\Disney Interactive
    2009-09-30 02:33 . 2007-12-26 01:06   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\Amazon
    2009-09-30 02:33 . 2007-12-26 01:04   --------   d-----w-   c:\program files\Amazon
    2009-09-30 02:32 . 2005-11-10 16:30   --------   d-----w-   c:\program files\sz8001
    2009-09-29 22:53 . 2004-11-30 03:32   36412   ----a-w-   c:\documents and settings\Tricia & Roger\Application Data\wklnhst.dat
    2009-09-15 10:49 . 2007-09-30 02:24   4212   ---ha-w-   c:\windows\system32\zllictbl.dat
    2009-09-11 13:23 . 2004-11-30 03:17   80720   ----a-w-   c:\documents and settings\Tricia & Roger\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-09-10 11:02 . 2007-09-23 01:58   --------   d-----w-   c:\program files\Microsoft Silverlight
    2009-08-22 04:24 . 2009-08-22 04:24   --------   d-----w-   c:\program files\MSBuild
    2009-08-22 04:23 . 2009-08-22 04:23   --------   d-----w-   c:\program files\Reference Assemblies
    2009-08-14 17:25 . 2009-08-14 17:25   --------   d-----w-   c:\program files\Disney
    2009-08-05 09:01 . 2004-08-04 11:00   204800   ----a-w-   c:\windows\system32\mswebdvd.dll
    2009-07-31 19:23 . 2008-11-24 02:33   411368   ----a-w-   c:\windows\system32\deploytk.dll
    2009-07-17 19:01 . 2004-08-04 11:00   58880   ----a-w-   c:\windows\system32\atl.dll
    2009-07-14 03:43 . 2004-08-04 11:00   286208   ----a-w-   c:\windows\system32\wmpdxm.dll
    2009-07-03 17:09 . 2004-08-04 11:00   915456   ----a-w-   c:\windows\system32\wininet.dll
    .

    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-02 68856]
    "TivoTransfer"="c:\program files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2006-07-11 1174528]
    "TivoNotify"="c:\program files\TiVo\Desktop\TiVoNotify.exe" [2006-07-11 341504]
    "TivoServer"="c:\program files\TiVo\Desktop\TiVoServer.exe" [2006-07-11 1313792]
    "Google Update"="c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-24 133104]
    "E6TaskPanel"="c:\program files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 942080]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 1388544]
    "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
    "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
    "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
    "MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592]
    "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
    "Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-12-06 50688]
    "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 11776]
    "LogitechCameraAssistant"="c:\program files\Logitech\Video\CameraAssistant.exe" [2005-07-28 389120]
    "LogitechVideo[inspector]"="c:\program files\Logitech\Video\InstallHelper.exe" [2005-07-28 18:09 73728]
    "LogitechCameraService(E)"="c:\windows\system32\ElkCtrl.exe" [2004-11-01 262144]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-08 282624]
    "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
    "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
    "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
    "SetDefPrt"="c:\program files\Brother\Brmfl04a\BrStDvPt.exe" [2004-05-25 49152]
    "ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
    "AppMgrGui"="c:\program files\AppStream\WindowsClient\bin\exeForService.exe" [2006-09-27 24064]
    "Elmore Music Messenger"="c:\windows\Elmore Music Messenger.exe" [2007-01-29 292658]
    "eligmini"="c:\program files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe" [2009-04-28 491520]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-03-31 982408]
    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "TBInfo"="iexplore.exe" - c:\combofix\iexplore.exe [2009-04-20 31232]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-1-8 196608]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
    Status Monitor.lnk - c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [2007-10-8 819200]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 19:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ASWLNDLL]
    2007-05-14 01:45   6656   ----a-w-   c:\windows\SYSTEM32\ASWLNDLL.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\TiVo\\Desktop\\TiVoServer.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\WINDOWS\\SYSTEM32\\ZoneLabs\\vsmon.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support
    "3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
    "3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R1 APPSTREAM;APPSTREAM;c:\windows\SYSTEM32\DRIVERS\AppStream.sys [5/13/2007 9:33 PM 115284]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/15/2009 11:42 AM 9968]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/15/2009 11:42 AM 74480]
    R2 AppMgrService;AWE 5.1.0 Application Manager;c:\program files\AppStream\WindowsClient\bin\AppMgrService.exe [9/27/2006 7:49 PM 1990656]
    R2 EarthLinkMonitor;EarthLink Monitor Service;c:\program files\EarthLink TotalAccess\WENGINE\wmonitor.exe [1/26/2005 11:47 AM 65604]
    R2 REGHOOK;REGHOOK;c:\windows\SYSTEM32\DRIVERS\RegHook.sys [9/27/2006 7:27 PM 54879]
    R2 TivoBeacon2;TiVo Beacon;c:\program files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe [7/11/2006 8:22 AM 857088]
    R2 VSPD;VSPD;c:\windows\SYSTEM32\DRIVERS\VSPD.sys [9/27/2006 7:27 PM 31321]
    S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows\SYSTEM32\DRIVERS\ADSFilter.sys [8/3/2007 7:35 AM 57456]
    S3 ADSMonitor;ADSMonitor - (EarthLink Monitor Driver);c:\windows\SYSTEM32\DRIVERS\ADSMonitor.sys [8/3/2007 7:35 AM 38384]
    S3 BW2NDIS5;BW2NDIS5;c:\windows\SYSTEM32\DRIVERS\BW2NDIS5.SYS [11/1/2004 2:16 PM 17536]
    S3 EarthLinkSafeConnectDriver;EarthLinkSafeConnectDriver;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys [?]
    S3 EarthLinkSafeConnectFilter;EarthLinkSafeConnectFilter;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys [?]
    S3 EarthLinkSafeConnectShim;EarthLinkSafeConnectShim;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectShim.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectShim.sys [?]
    S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/4/2004 7:00 AM 14336]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/15/2009 11:42 AM 7408]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    p2psvc   REG_MULTI_SZ      p2psvc p2pimsvc p2pgasvc PNRPSvc
    getPlusHelper   REG_MULTI_SZ      getPlusHelper

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-01 c:\windows\Tasks\Google Software Updater.job
    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-02 11:52]

    2009-09-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-186917913-2315771567-692555066-1006Core.job
    - c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-24 11:55]

    2009-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-186917913-2315771567-692555066-1006UA.job
    - c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-24 11:55]
    .
    Logged

    TriciaM

      Topic Starter


      Beginner

      Re: Virus?
      « Reply #17 on: October 01, 2009, 10:08:09 AM »
      ------- Supplementary Scan -------
      .
      uStart Page = hxxp://www.rr.com/
      uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html
      uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex}&startPage={startPage}
      IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
      LSP: c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
      Trusted Zone: broderbund.com\support
      Trusted Zone: mypublisher.com\www
      Trusted Zone: riverdeep.net\smartdownload
      Trusted Zone: uspsoig.gov\portal2003
      Trusted Zone: musicmatch.com\online
      DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
      DPF: {5DA9D8E0-5A57-11CF-9E36-00C0930198C0} - hxxp://www.ansonncrod.org/imw32o40.cab
      DPF: {9841D1AE-9C0B-11D3-9452-00105A098C21} - hxxp://www.ansonncrod.org/prntpro2.CAB
      FF - ProfilePath - c:\documents and settings\Tricia & Roger\Application Data\Mozilla\Firefox\Profiles\10loo8z7.default\
      FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
      FF - plugin: c:\documents and settings\Tricia & Roger\Application Data\Mozilla\Firefox\Profiles\10loo8z7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
      FF - plugin: c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
      FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
      FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
      FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
      FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll
      FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
      FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

      ---- FIREFOX POLICIES ----
      FF - user.js: yahoo.homepage.dontask - true.
      - - - - ORPHANS REMOVED - - - -

      URLSearchHooks-~37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - (no file)
      URLSearchHooks-~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
      HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
      HKCU-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
      AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe
      AddRemove-{0BEDBD4E-2D34-47B5-9973-57E62B29307C} - c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
      AddRemove-{2637C347-9DAD-11D6-9EA2-00055D0CA761} - c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
      AddRemove-{8A367C28-423C-48E2-8C76-EBA1171F932A} - c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
      AddRemove-{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E} - c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll

      Logged

      TriciaM

        Topic Starter


        Beginner

        Re: Virus?
        « Reply #18 on: October 01, 2009, 10:09:16 AM »
        **************************************************************************

        catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2009-10-01 11:48
        Windows 5.1.2600 Service Pack 3 NTFS

        scanning hidden processes ... 

        scanning hidden autostart entries ...

        scanning hidden files ... 

        scan completed successfully
        hidden files: 0

        **************************************************************************

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cd20xrnt]
        "ImagePath"="system32\DRIVERS\cd20xrnt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdaudio]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdfs]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdrom]
        "ImagePath"="system32\DRIVERS\cdrom.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Changer]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvc]
        "ImagePath"="%SystemRoot%\system32\cisvc.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ClipSrv]
        "ImagePath"="%SystemRoot%\system32\clipsrv.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\clr_optimization_v2.0.50727_32]
        "ImagePath"="c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CmdIde]
        "ImagePath"="system32\DRIVERS\cmdide.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\COMSysApp]
        "ImagePath"="c:\windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ContentFilter]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ContentIndex]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cpqarray]
        "ImagePath"="system32\DRIVERS\cpqarray.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CryptSvc]
        "ServiceDll"="%SystemRoot%\System32\cryptsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac2w2k]
        "ImagePath"="system32\DRIVERS\dac2w2k.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac960nt]
        "ImagePath"="system32\DRIVERS\dac960nt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DcomLaunch]
        "ServiceDll"="%SystemRoot%\system32\rpcss.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dhcp]
        "ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Disk]
        "ImagePath"="system32\DRIVERS\disk.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmadmin]
        "ImagePath"="%SystemRoot%\System32\dmadmin.exe /com"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmboot]
        "ImagePath"="System32\drivers\dmboot.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmio]
        "ImagePath"="System32\drivers\dmio.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmload]
        "ImagePath"="System32\drivers\dmload.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmserver]
        "ServiceDll"="%SystemRoot%\System32\dmserver.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DMusic]
        "ImagePath"="system32\drivers\DMusic.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dnscache]
        "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dot3svc]
        "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dpti2o]
        "ImagePath"="system32\DRIVERS\dpti2o.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drmkaud]
        "ImagePath"="system32\drivers\drmkaud.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drvmcdb]
        "ImagePath"="system32\drivers\drvmcdb.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drvncdb]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drvnddm]
        "ImagePath"="system32\drivers\drvnddm.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DSBrokerService]
        "ImagePath"="\"c:\program files\DellSupport\brkrsvc.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DSproct]
        "ImagePath"="\??\c:\program files\DellSupport\GTAction\triggers\DSproct.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dsunidrv]
        "ImagePath"="system32\DRIVERS\dsunidrv.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\E100B]
        "ImagePath"="system32\DRIVERS\e100b325.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EapHost]
        "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkMonitor]
        "ImagePath"="\"c:\program files\EarthLink TotalAccess\WENGINE\wmonitor.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectAgent]
        "ImagePath"="\"c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Bin\SanaAgent.exe\" EarthLinkSafeConnectAgent"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectDriver]
        "ImagePath"="\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectFilter]
        "ImagePath"="\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectShim]
        "ImagePath"="\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectShim.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ERSvc]
        "ServiceDll"="%SystemRoot%\System32\ersvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Eventlog]
        "ImagePath"="%SystemRoot%\system32\services.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EventSystem]
        "ServiceDll"="c:\windows\system32\es.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fastfat]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FastUserSwitchingCompatibility]
        "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fax]
        "ImagePath"="%systemroot%\system32\fxssvc.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fdc]
        "ImagePath"="system32\DRIVERS\fdc.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FilterService]
        "ImagePath"="system32\DRIVERS\lvuvcflt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fips]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Flpydisk]
        "ImagePath"="system32\DRIVERS\flpydisk.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FltMgr]
        "ImagePath"="system32\drivers\fltmgr.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FontCache3.0.0.0]
        "ImagePath"="c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FSLX]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fs_Rec]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ftdisk]
        "ImagePath"="system32\DRIVERS\ftdisk.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GEARAspiWDM]
        "ImagePath"="System32\Drivers\GEARAspiWDM.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\getPlusHelper]
        "ServiceDll"="c:\program files\NOS\bin\getPlus_Helper.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Gpc]
        "ImagePath"="system32\DRIVERS\msgpc.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GRTdiMon]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gusvc]
        "ImagePath"="\"c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\helpsvc]
        "ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HidServ]
        "ServiceDll"="%SystemRoot%\System32\hidserv.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HidUsb]
        "ImagePath"="system32\DRIVERS\hidusb.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hkmsvc]
        "ServiceDll"="%SystemRoot%\System32\kmsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hpn]
        "ImagePath"="system32\DRIVERS\hpn.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HTTP]
        "ImagePath"="System32\Drivers\HTTP.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HTTPFilter]
        "ServiceDll"="%SystemRoot%\System32\w3ssl.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\i2omgmt]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\i2omp]
        "ImagePath"="system32\DRIVERS\i2omp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\i8042prt]
        "ImagePath"="system32\DRIVERS\i8042prt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IAANTMon]
        "ImagePath"="c:\program files\Intel\Intel Application Accelerator\iaantmon.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iaStor]
        "ImagePath"="system32\drivers\iaStor.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IDriverT]
        "ImagePath"="\"c:\program files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\idsvc]
        "ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Imapi]
        "ImagePath"="system32\DRIVERS\imapi.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ImapiService]
        "ImagePath"="%systemroot%\system32\imapi.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\inetaccs]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ini910u]
        "ImagePath"="system32\DRIVERS\ini910u.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Inport]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelC51]
        "ImagePath"="system32\DRIVERS\IntelC51.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelC52]
        "ImagePath"="system32\DRIVERS\IntelC52.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelC53]
        "ImagePath"="system32\DRIVERS\IntelC53.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelIde]
        "ImagePath"="system32\DRIVERS\intelide.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\intelppm]
        "ImagePath"="system32\DRIVERS\intelppm.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ip6Fw]
        "ImagePath"="system32\drivers\ip6fw.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IpFilterDriver]
        "ImagePath"="system32\DRIVERS\ipfltdrv.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IpInIp]
        "ImagePath"="system32\DRIVERS\ipinip.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IpNat]
        "ImagePath"="system32\DRIVERS\ipnat.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IPSec]
        "ImagePath"="system32\DRIVERS\ipsec.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IRENUM]
        "ImagePath"="system32\DRIVERS\irenum.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ISAPISearch]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\isapnp]
        "ImagePath"="system32\DRIVERS\isapnp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\JavaQuickStarterService]
        "ImagePath"="\"c:\program files\Java\jre6\bin\jqs.exe\" -service -config \"c:\program files\Java\jre6\lib\deploy\jqs\jqs.conf\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\JL2005C]
        "ImagePath"="System32\Drivers\jl2005c.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Kbdclass]
        "ImagePath"="system32\DRIVERS\kbdclass.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KLIF]
        "ImagePath"="system32\DRIVERS\klif.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kmixer]
        "ImagePath"="system32\drivers\kmixer.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KSecDD]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lanmanserver]
        "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lanmanworkstation]
        "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lbrtfdc]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ldap]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LicenseService]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LmHosts]
        "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LPDSVC]
        "ImagePath"="%SystemRoot%\system32\tcpsvcs.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Lvckap]
        "ImagePath"="\??\c:\windows\system32\drivers\Lvckap.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lvmvdrv]
        "ImagePath"="\??\c:\windows\system32\drivers\lvmvdrv.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lvpopflt]
        "ImagePath"="system32\DRIVERS\lvpopflt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUSBSta]
        "ImagePath"="system32\drivers\lvusbsta.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUVC]
        "ImagePath"="system32\DRIVERS\lvuvc.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Messenger]
        "ServiceDll"="%SystemRoot%\System32\msgsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mnmdd]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mnmsrvc]
        "ImagePath"="c:\windows\system32\mnmsrvc.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Modem]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MODEMCSA]
        "ImagePath"="system32\drivers\MODEMCSA.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mohfilt]
        "ImagePath"="system32\DRIVERS\mohfilt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Mouclass]
        "ImagePath"="system32\DRIVERS\mouclass.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MountMgr]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MPE]
        "ImagePath"="system32\DRIVERS\MPE.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mraid35x]
        "ImagePath"="system32\DRIVERS\mraid35x.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MRxDAV]
        "ImagePath"="system32\DRIVERS\mrxdav.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MRxSmb]
        "ImagePath"="system32\DRIVERS\mrxsmb.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSDTC]
        "ImagePath"="c:\windows\system32\msdtc.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSDTC Bridge 3.0.0.0]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSDV]
        "ImagePath"="system32\DRIVERS\msdv.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Msfs]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSIServer]
        "ImagePath"="%systemroot%\system32\msiexec.exe /V"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSKSSRV]
        "ImagePath"="system32\drivers\MSKSSRV.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSPCLOCK]
        "ImagePath"="system32\drivers\MSPCLOCK.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSPQM]
        "ImagePath"="system32\drivers\MSPQM.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mssmbios]
        "ImagePath"="system32\DRIVERS\mssmbios.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSTEE]
        "ImagePath"="system32\drivers\MSTEE.sys"
        --

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Mup]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NABTSFEC]
        "ImagePath"="system32\DRIVERS\NABTSFEC.sys"
        --

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\napagent]
        "ServiceDll"="%SystemRoot%\System32\qagentrt.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NDIS]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NdisIP]
        "ImagePath"="system32\DRIVERS\NdisIP.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NdisTapi]
        "ImagePath"="system32\DRIVERS\ndistapi.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ndisuio]
        "ImagePath"="system32\DRIVERS\ndisuio.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NdisWan]
        "ImagePath"="system32\DRIVERS\ndiswan.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NDProxy]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetBIOS]
        "ImagePath"="system32\DRIVERS\netbios.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetBT]
        "ImagePath"="system32\DRIVERS\netbt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDE]
        "ImagePath"="%SystemRoot%\system32\netdde.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdm]
        "ImagePath"="%SystemRoot%\system32\netdde.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogon]
        "ImagePath"="%SystemRoot%\system32\lsass.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netman]
        "ServiceDll"="%SystemRoot%\System32\netman.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetTcpPortSharing]
        "ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIC1394]
        "ImagePath"="system32\DRIVERS\nic1394.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Nla]
        "ServiceDll"="%SystemRoot%\System32\mswsock.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Npfs]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ntfs]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtLmSsp]
        "ImagePath"="%SystemRoot%\system32\lsass.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtmsSvc]
        "ServiceDll"="%SystemRoot%\system32\ntmssvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Null]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nv]
        "ImagePath"="system32\DRIVERS\nv4_mini.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NwlnkFlt]
        "ImagePath"="system32\DRIVERS\nwlnkflt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NwlnkFwd]
        "ImagePath"="system32\DRIVERS\nwlnkfwd.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ohci1394]
        "ImagePath"="system32\DRIVERS\ohci1394.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\omci]
        "ImagePath"="system32\DRIVERS\omci.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\p2pgasvc]
        "ServiceDll"="%SystemRoot%\system32\p2pgasvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\p2pimsvc]
        "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\p2psvc]
        "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Parport]
        "ImagePath"="system32\DRIVERS\parport.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PartMgr]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ParVdm]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCI]
        "ImagePath"="system32\DRIVERS\pci.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCIDump]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCIIde]
        "ImagePath"="system32\DRIVERS\pciide.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Pcmcia]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDCOMP]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDFRAME]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDRELI]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDRFRAME]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\perc2]
        "ImagePath"="system32\DRIVERS\perc2.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\perc2hib]
        "ImagePath"="system32\DRIVERS\perc2hib.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfDisk]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfNet]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfOS]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfProc]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pfc]
        "ImagePath"="\??\c:\windows\system32\drivers\pfc.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PlugPlay]
        "ImagePath"="%SystemRoot%\system32\services.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PNRPSvc]
        "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgent]
        "ImagePath"="%SystemRoot%\system32\lsass.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PortProxy]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PptpMiniport]
        "ImagePath"="system32\DRIVERS\raspptp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ProtectedStorage]
        "ImagePath"="%SystemRoot%\system32\lsass.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSched]
        "ImagePath"="system32\DRIVERS\psched.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ptilink]
        "ImagePath"="system32\DRIVERS\ptilink.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PxHelp20]
        "ImagePath"="System32\Drivers\PxHelp20.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql1080]
        "ImagePath"="system32\DRIVERS\ql1080.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ql10wnt]
        "ImagePath"="system32\DRIVERS\ql10wnt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql12160]
        "ImagePath"="system32\DRIVERS\ql12160.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql1240]
        "ImagePath"="system32\DRIVERS\ql1240.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql1280]
        "ImagePath"="system32\DRIVERS\ql1280.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAcd]
        "ImagePath"="system32\DRIVERS\rasacd.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAuto]
        "ServiceDll"="%SystemRoot%\System32\rasauto.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Rasl2tp]
        "ImagePath"="system32\DRIVERS\rasl2tp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasMan]
        "ServiceDll"="%SystemRoot%\System32\rasmans.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasPppoe]
        "ImagePath"="system32\DRIVERS\raspppoe.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Raspti]
        "ImagePath"="system32\DRIVERS\raspti.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Rdbss]
        "ImagePath"="system32\DRIVERS\rdbss.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPCDD]
        "ImagePath"="System32\DRIVERS\RDPCDD.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPDD]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\rdpdr]
        "ImagePath"="system32\DRIVERS\rdpdr.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPNP]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPWD]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgr]
        "ImagePath"="c:\windows\system32\sessmgr.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\redbook]
        "ImagePath"="system32\DRIVERS\redbook.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\REGHOOK]
        "ImagePath"="\??\c:\windows\System32\Drivers\REGHOOK.SYS"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RemoteAccess]
        "ServiceDll"="%SystemRoot%\System32\mprdim.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcLocator]
        "ImagePath"="%SystemRoot%\system32\locator.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSs]
        "ServiceDll"="%SystemRoot%\System32\rpcss.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RSVP]
        "ImagePath"="%SystemRoot%\system32\rsvp.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SamSs]
        "ImagePath"="%SystemRoot%\system32\lsass.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SASDIFSV]
        "ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SASENUM]
        "ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SASKUTIL]
        "ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SCardSvr]
        "ImagePath"="%SystemRoot%\System32\SCardSvr.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Schedule]
        "ServiceDll"="%SystemRoot%\system32\schedsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ScsiPort]
        "ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Secdrv]
        "ImagePath"="system32\DRIVERS\secdrv.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogon]
        "ServiceDll"="%SystemRoot%\System32\seclogon.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\senfilt]
        "ImagePath"="system32\drivers\senfilt.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SENS]
        "ServiceDll"="%SystemRoot%\system32\sens.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\serenum]
        "ImagePath"="system32\DRIVERS\serenum.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Serial]
        "ImagePath"="system32\DRIVERS\serial.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ServiceModelOperation 3.0.0.0]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ServiceModelService 3.0.0.0]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sfloppy]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess]
        "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ShellHWDetection]
        "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Simbad]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SimpTcp]
        "ImagePath"="%SystemRoot%\system32\tcpsvcs.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sisagp]
        "ImagePath"="system32\DRIVERS\sisagp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SLIP]
        "ImagePath"="system32\DRIVERS\SLIP.sys"
        --

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SMSvcHost 3.0.0.0]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\smwdm]
        "ImagePath"="system32\drivers\smwdm.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNMP]
        "ImagePath"="%SystemRoot%\System32\snmp.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNMPTRAP]
        "ImagePath"="%SystemRoot%\System32\snmptrap.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sparrow]
        "ImagePath"="system32\DRIVERS\sparrow.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\splitter]
        "ImagePath"="system32\drivers\splitter.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Spooler]
        "ImagePath"="%SystemRoot%\system32\spoolsv.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sr]
        "ImagePath"="system32\DRIVERS\sr.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\srescan]
        "ImagePath"="system32\ZoneLabs\srescan.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\srservice]
        "ServiceDll"="%SystemRoot%\system32\srsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Srv]
        "ImagePath"="system32\DRIVERS\srv.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sscdbhk5]
        "ImagePath"="system32\drivers\sscdbhk5.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SSDPSRV]
        "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ssrtln]
        "ImagePath"="system32\drivers\ssrtln.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\stisvc]
        "ServiceDll"="%SystemRoot%\system32\wiaservc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\streamip]
        "ImagePath"="system32\DRIVERS\StreamIP.sys"
        --

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\swenum]
        "ImagePath"="system32\DRIVERS\swenum.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\swmidi]
        "ImagePath"="system32\drivers\swmidi.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SwPrv]
        "ImagePath"="c:\windows\system32\dllhost.exe /Processid:{A445BD1E-49EE-4607-B370-5CCA447377C4}"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\swwd]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\symc810]
        "ImagePath"="system32\DRIVERS\symc810.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\symc8xx]
        "ImagePath"="system32\DRIVERS\symc8xx.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sym_hi]
        "ImagePath"="system32\DRIVERS\sym_hi.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sym_u3]
        "ImagePath"="system32\DRIVERS\sym_u3.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sysaudio]
        "ImagePath"="system32\drivers\sysaudio.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SysmonLog]
        "ImagePath"="%SystemRoot%\system32\smlogsvc.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TapiSrv]
        "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip]
        "ImagePath"="system32\DRIVERS\tcpip.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip6]
        "ImagePath"="system32\DRIVERS\tcpip6.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDPIPE]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDTCP]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TermDD]
        "ImagePath"="system32\DRIVERS\termdd.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TermService]
        "ServiceDll"="%SystemRoot%\System32\termsrv.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnboio]
        "ImagePath"="system32\dla\tfsnboio.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsncofs]
        "ImagePath"="system32\dla\tfsncofs.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsndrct]
        "ImagePath"="system32\dla\tfsndrct.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsndres]
        "ImagePath"="system32\dla\tfsndres.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnifs]
        "ImagePath"="system32\dla\tfsnifs.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnopio]
        "ImagePath"="system32\dla\tfsnopio.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnpool]
        "ImagePath"="system32\dla\tfsnpool.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnudf]
        "ImagePath"="system32\dla\tfsnudf.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnudfa]
        "ImagePath"="system32\dla\tfsnudfa.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Themes]
        "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TivoBeacon2]
        "ImagePath"="\"c:\program files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe\" /service"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TosIde]
        "ImagePath"="system32\DRIVERS\toside.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWks]
        "ServiceDll"="%SystemRoot%\system32\trkwks.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TSDDD]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tunmp]
        "ImagePath"="system32\DRIVERS\tunmp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Udfs]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ultra]
        "ImagePath"="system32\DRIVERS\ultra.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Update]
        "ImagePath"="system32\DRIVERS\update.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphost]
        "ServiceDll"="%SystemRoot%\System32\upnphost.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPS]
        "ImagePath"="%SystemRoot%\System32\ups.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbaudio]
        "ImagePath"="system32\drivers\usbaudio.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbccgp]
        "ImagePath"="system32\DRIVERS\usbccgp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbehci]
        "ImagePath"="system32\DRIVERS\usbehci.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbhub]
        "ImagePath"="system32\DRIVERS\usbhub.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbprint]
        "ImagePath"="system32\DRIVERS\usbprint.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbscan]
        "ImagePath"="system32\DRIVERS\usbscan.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\USBSTOR]
        "ImagePath"="system32\DRIVERS\USBSTOR.SYS"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbuhci]
        "ImagePath"="system32\DRIVERS\usbuhci.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VgaSave]
        "ImagePath"="\SystemRoot\System32\drivers\vga.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\viaagp]
        "ImagePath"="system32\DRIVERS\viaagp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ViaIde]
        "ImagePath"="system32\DRIVERS\viaide.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VolSnap]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
        "ImagePath"="System32\vsdatant.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsmon]
        "ImagePath"="c:\windows\SYSTEM32\ZoneLabs\vsmon.exe -service"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VSPD]
        "ImagePath"="\??\c:\windows\System32\Drivers\VSPD.SYS"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VSS]
        "ImagePath"="%SystemRoot%\System32\vssvc.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\w32time]
        "ServiceDll"="%systemroot%\system32\w32time.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\W3SVC]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Wanarp]
        "ImagePath"="system32\DRIVERS\wanarp.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wanatw]
        "ImagePath"="system32\DRIVERS\wanatw4.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WDICA]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wdmaud]
        "ImagePath"="system32\drivers\wdmaud.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WebClient]
        "ServiceDll"="%SystemRoot%\System32\webclnt.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\winmgmt]
        "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Winsock]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinSock2]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinTrust]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSN]
        "ServiceDll"="c:\windows\system32\MsPMSNSv.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Wmi]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApRpl]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrv]
        "ImagePath"="c:\windows\system32\wbem\wmiapsrv.exe"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WMPNetworkSvc]
        "ImagePath"="\"c:\program files\Windows Media Player\WMPNetwk.exe\""

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WpdUsb]
        "ImagePath"="system32\DRIVERS\wpdusb.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WS2IFSL]
        "ImagePath"="\SystemRoot\System32\drivers\ws2ifsl.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wscsvc]
        "ServiceDll"="%SYSTEMROOT%\system32\wscsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WSTCODEC]
        "ImagePath"="system32\DRIVERS\WSTCODEC.SYS"
        --

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauserv]
        "ServiceDll"="c:\windows\system32\wuauserv.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfPf]
        "ImagePath"="system32\DRIVERS\WudfPf.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfRd]
        "ImagePath"="system32\DRIVERS\wudfrd.sys"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvc]
        "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WZCSVC]
        "ServiceDll"="%SystemRoot%\System32\wzcsvc.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xmlprov]
        "ServiceDll"="%SystemRoot%\System32\xmlprov.dll"

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{9F308F8A-7C99-4907-AE93-02A349C53899}]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{AEA69CD6-BEF8-4F41-8F9F-E3364390A66B}]

        [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{D847D4EC-2128-4DCA-BEB1-8E73F1CC5BE3}]
        .
        --------------------- DLLs Loaded Under Running Processes ---------------------

        - - - - - - - > 'winlogon.exe'(792)
        c:\program files\SUPERAntiSpyware\SASWINLO.dll
        c:\windows\system32\WININET.dll
        c:\windows\system32\ASWLNDLL.dll

        - - - - - - - > 'lsass.exe'(856)
        c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll

        - - - - - - - > 'explorer.exe'(3572)
        c:\windows\system32\WININET.dll
        c:\windows\system32\ieframe.dll
        c:\windows\system32\webcheck.dll
        c:\windows\system32\WPDShServiceObj.dll
        c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
        c:\windows\system32\PortableDeviceTypes.dll
        c:\windows\system32\PortableDeviceApi.dll
        .
        ------------------------ Other Running Processes ------------------------
        .
        c:\windows\SYSTEM32\ati2evxx.exe
        c:\windows\SYSTEM32\Brmfrmps.exe
        c:\program files\Java\jre6\bin\jqs.exe
        c:\windows\SYSTEM32\TCPSVCS.EXE
        c:\windows\SYSTEM32\snmp.exe
        c:\program files\Canon\CAL\CALMAIN.exe
        c:\windows\SYSTEM32\brss01a.exe
        c:\progra~1\MUSICM~1\MUSICM~2\MMDiag.exe
        c:\program files\MUSICMATCH\Musicmatch Jukebox\mim.exe
        c:\program files\AppStream\WindowsClient\bin\AppMgrGui.exe
        c:\windows\SYSTEM32\msiexec.exe
        c:\windows\SYSTEM32\msiexec.exe
        c:\windows\SYSTEM32\wscntfy.exe
        .
        **************************************************************************
        .
        Completion time: 2009-10-01 12:01 - machine was rebooted
        ComboFix-quarantined-files.txt  2009-10-01 16:01

        Pre-Run: 8,066,433,024 bytes free
        Post-Run: 7,995,674,624 bytes free

        WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
        [boot loader]
        timeout=2
        default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
        [operating systems]
        c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
        multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

        919   --- E O F ---   2009-09-30 17:45
        Logged

        TriciaM

          Topic Starter


          Beginner

          Re: Virus?
          « Reply #19 on: October 01, 2009, 10:14:28 AM »
          I need to add that : TotalAccess Core applications keeps trying to run and then is giving me an error message.  TACORE.MSI

          I also get an error message like this:  Cannot export APISVC:Error writing the file. Disk/file system error.

          True Vector kept coming up last night (before comboscan) and telling me that it needs to shut down.

          I also kept getting Logitech desktop messenger messages and a shut down window with "Shellcon Hidden Window" at the top. 

          Logged

          harry 48



            Egghead

          • lay back , relax and chill out
            • Thanked: 129
            • Yes
            • Yes
            • Yes
            • Dribbling Pensioner
          • Certifications: List
          • Experience: Familiar
          • OS: Windows 7
          Re: Virus?
          « Reply #20 on: October 01, 2009, 01:53:14 PM »
          why would you give up , listen and try to do as evil says
          Logged

          evilfantasy

          • Malware Removal Specialist
          • Moderator


            • Genius
          • Calm like a bomb
            • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: Virus?
          « Reply #21 on: October 01, 2009, 05:18:20 PM »
          Download Registry Search by Bobbi Flekman
          (see the link titled RegSearch Download Link)

          * Extract the files from Regsearch.zip into a folder.
          * Doubleclick regsearch.exe to start the program.
          * Enter Authentium in the top area of the form and then click OK
          * Notepad will be opened with text in it (the file named RegSearch.txt will be saved in the program's folder as well).
          * Add the contents of the Notepad file to your next reply.
          Logged

          TriciaM

            Topic Starter


            Beginner

            Re: Virus?
            « Reply #22 on: October 01, 2009, 08:43:16 PM »
            Windows Registry Editor Version 5.00

            ; Registry Search 2.0 by Bobbi Flekman © 2005
            ; Version: 2.0.6.0

            ; Results at 10/1/2009 10:41:18 PM for strings:
            ;  'authentium'
            ; Strings excluded from search:
            ;  (None)
            ; Search in:
            ; Registry Keys  Registry Values  Registry Data 
            ; HKEY_LOCAL_MACHINE  HKEY_USERS 


            ; End Of The Log...
            Logged

            evilfantasy

            • Malware Removal Specialist
            • Moderator


              • Genius
            • Calm like a bomb
              • Thanked: 493
            • Experience: Experienced
            • OS: Windows 11
            Re: Virus?
            « Reply #23 on: October 01, 2009, 09:04:30 PM »
            Run Registry Search again and this time search for the following. (include the brackets { } in the search term)

            {A4E803B3-4E6E-4271-B1CD-56FBC0992D36}
            Logged

            TriciaM

              Topic Starter


              Beginner

              Re: Virus?
              « Reply #24 on: October 01, 2009, 09:57:26 PM »
              Windows Registry Editor Version 5.00

              ; Registry Search 2.0 by Bobbi Flekman © 2005
              ; Version: 2.0.6.0

              ; Results at 10/1/2009 11:51:48 PM for strings:
              ;  '{a4e803b3-4e6e-4271-b1cd-56fbc0992d36}'
              ; Strings excluded from search:
              ;  (None)
              ; Search in:
              ; Registry Keys  Registry Values  Registry Data 
              ; HKEY_LOCAL_MACHINE  HKEY_USERS 


              ; End Of The Log...
              Logged

              evilfantasy

              • Malware Removal Specialist
              • Moderator


                • Genius
              • Calm like a bomb
                • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: Virus?
              « Reply #25 on: October 02, 2009, 01:42:20 PM »
              It appears that the entry is "stuck" in the security center so we need to reset it.

              But first let's finish with ComboFix.

              Delete these files/folders, as follows:

              1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
              It must be Notepad, not Wordpad.
              2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

              Code: [Select]
              KillAll::

              FixCSet::

              File::
              c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

              Registry::
              [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
              "LogitechSoftwareUpdate"=-

              [-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

              [-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

              [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
              "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=-


              3. Go to the Notepad window and click Edit > Paste
              4. Then click File > Save
              5. Name the file CFScript.txt - Save the file to your Desktop
              6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



              ComboFix will begin to execute, just follow the prompts.
              After reboot (in case it asks to reboot), it will produce a log for you.
              Post that log (Combofix.txt) in your next reply.

              Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze
              Logged

              TriciaM

                Topic Starter


                Beginner

                Re: Virus?
                « Reply #26 on: October 02, 2009, 04:03:24 PM »
                ComboFix 09-10-01.05 - Tricia & Roger 10/02/2009 17:42.3.2 - NTFSx86
                Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.1022.597 [GMT -4:00]
                Running from: c:\documents and settings\Tricia & Roger\Desktop\ComboFix.exe
                AV: Authentium Antivirus *On-access scanning enabled* (Updated) {A4E803B3-4E6E-4271-B1CD-56FBC0992D36}
                AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Updated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
                FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
                .

                (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                ---- Previous Run -------
                .
                c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

                .
                (((((((((((((((((((((((((   Files Created from 2009-09-02 to 2009-10-02  )))))))))))))))))))))))))))))))
                .

                2009-10-01 02:44 . 2009-10-01 02:44   --------   d-----w-   c:\documents and settings\Tricia & Roger\Local Settings\Application Data\NOS
                2009-10-01 01:57 . 2009-10-01 02:48   --------   d-----w-   c:\documents and settings\All Users\Application Data\NOS
                2009-10-01 01:57 . 2009-10-01 02:40   --------   d-----w-   c:\program files\NOS
                2009-09-30 21:10 . 2009-09-30 21:10   --------   d-----w-   c:\windows\system32\FxsTmp
                2009-09-30 21:08 . 2004-08-04 11:00   41029   ----a-w-   c:\windows\system32\dllcache\zcorem.dll
                2009-09-30 21:08 . 2004-08-04 11:00   1039955   ----a-w-   c:\windows\system32\dllcache\cmnresm.dll
                2009-09-30 21:08 . 2004-08-04 11:00   113222   ----a-w-   c:\windows\system32\dllcache\zoneclim.dll
                2009-09-30 21:08 . 2004-08-04 11:00   217160   ----a-w-   c:\windows\system32\dllcache\cmnclim.dll
                2009-09-30 21:08 . 2004-08-04 11:00   29760   ----a-w-   c:\windows\system32\dllcache\znetm.dll
                2009-09-30 21:08 . 2004-08-04 11:00   36937   ----a-w-   c:\windows\system32\dllcache\zclientm.exe
                2009-09-30 21:07 . 2004-08-04 11:00   13312   ----a-w-   c:\windows\system32\dllcache\htrn_jis.dll
                2009-09-30 21:07 . 2004-08-04 11:00   18944   ----a-w-   c:\windows\system32\simptcp.dll
                2009-09-30 21:07 . 2004-08-04 11:00   18944   ----a-w-   c:\windows\system32\dllcache\simptcp.dll
                2009-09-30 21:07 . 2004-08-04 11:00   5632   ----a-w-   c:\windows\system32\dllcache\smimsgif.dll
                2009-09-30 21:07 . 2004-08-04 11:00   5632   ----a-w-   c:\windows\system32\dllcache\smierrsy.dll
                2009-09-30 21:07 . 2004-08-04 11:00   15872   ----a-w-   c:\windows\system32\dllcache\smierrsm.dll
                2009-09-30 21:07 . 2004-08-04 11:00   10240   ----a-w-   c:\windows\system32\wbem\snmpstup.dll
                2009-09-30 21:07 . 2004-08-04 11:00   10240   ----a-w-   c:\windows\system32\dllcache\snmpstup.dll
                2009-09-30 15:24 . 2009-09-30 15:29   --------   d-----w-   c:\program files\Trend Micro
                2009-09-30 14:54 . 2009-09-30 14:54   --------   d-----w-   c:\program files\SystemRequirementsLab
                2009-09-30 14:54 . 2009-09-30 14:54   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\SystemRequirementsLab
                2009-09-30 14:36 . 2005-02-28 13:49   294912   ----a-w-   c:\windows\system32\FlexEng.dll
                2009-09-30 14:07 . 2009-08-18 17:44   53248   ----a-w-   c:\windows\system32\CSVer.dll
                2009-09-30 13:59 . 2009-09-30 13:59   --------   d-----w-   C:\Intel
                2009-09-30 12:00 . 2009-09-30 12:00   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\Malwarebytes
                2009-09-30 12:00 . 2009-09-10 18:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
                2009-09-30 12:00 . 2009-09-30 12:00   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
                2009-09-30 12:00 . 2009-09-10 18:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
                2009-09-30 12:00 . 2009-09-30 12:00   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
                2009-09-30 04:55 . 2009-09-30 04:55   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
                2009-09-30 04:54 . 2009-09-30 04:54   --------   d-----w-   c:\program files\SUPERAntiSpyware
                2009-09-30 04:54 . 2009-09-30 04:54   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\SUPERAntiSpyware.com
                2009-09-30 03:41 . 2009-09-30 03:41   --------   d-----w-   c:\program files\CCleaner
                2009-09-10 01:57 . 2009-06-21 21:44   153088   ------w-   c:\windows\system32\dllcache\triedit.dll

                .
                ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2009-10-02 21:48 . 2007-09-30 02:31   1361832224   --sha-w-   c:\windows\system32\drivers\fidbox.dat
                2009-10-02 20:35 . 2009-03-15 12:23   18223820   --sha-w-   c:\windows\system32\drivers\fidbox.idx
                2009-10-02 01:43 . 2008-10-25 13:17   --------   d-----w-   c:\documents and settings\All Users\Application Data\Google Updater
                2009-10-01 05:13 . 2007-02-19 03:16   --------   d-----w-   c:\program files\TaxCut06
                2009-10-01 05:11 . 2006-03-04 15:26   --------   d-----w-   c:\program files\TaxCut05
                2009-10-01 05:10 . 2005-03-22 03:07   --------   d-----w-   c:\program files\TaxCut04
                2009-10-01 05:02 . 2005-10-12 00:23   --------   d-----w-   c:\program files\EarthLink TotalAccess
                2009-09-30 15:17 . 2006-01-02 23:00   --------   d-----w-   c:\program files\Common Files\Logitech
                2009-09-30 15:11 . 2004-11-23 07:52   --------   d-----w-   c:\program files\Java
                2009-09-30 14:57 . 2004-11-23 07:52   --------   d-----w-   c:\program files\Common Files\InstallShield
                2009-09-30 14:23 . 2004-11-23 07:52   --------   d-----w-   c:\program files\Intel
                2009-09-30 13:59 . 2004-11-23 07:52   --------   d--h--w-   c:\program files\InstallShield Installation Information
                2009-09-30 04:52 . 2007-02-26 02:04   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
                2009-09-30 03:15 . 2007-12-24 19:57   --------   d-----w-   c:\program files\Windows Live
                2009-09-30 03:05 . 2005-05-28 12:19   --------   d-----w-   c:\program files\The Learning Company
                2009-09-30 02:57 . 2008-08-22 20:29   --------   d-----w-   c:\program files\MyPublisher
                2009-09-30 02:50 . 2007-08-29 23:41   --------   d-----w-   c:\program files\Kids Cam Show and Share Creativity Center
                2009-09-30 02:43 . 2005-10-08 12:11   --------   d-----w-   c:\program files\Infogrames Interactive
                2009-09-30 02:43 . 2006-06-04 17:42   --------   d-----w-   c:\program files\Disney Interactive
                2009-09-30 02:33 . 2007-12-26 01:06   --------   d-----w-   c:\documents and settings\Tricia & Roger\Application Data\Amazon
                2009-09-30 02:33 . 2007-12-26 01:04   --------   d-----w-   c:\program files\Amazon
                2009-09-30 02:32 . 2005-11-10 16:30   --------   d-----w-   c:\program files\sz8001
                2009-09-29 22:53 . 2004-11-30 03:32   36412   ----a-w-   c:\documents and settings\Tricia & Roger\Application Data\wklnhst.dat
                2009-09-15 10:49 . 2007-09-30 02:24   4212   ---ha-w-   c:\windows\system32\zllictbl.dat
                2009-09-11 13:23 . 2004-11-30 03:17   80720   ----a-w-   c:\documents and settings\Tricia & Roger\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                2009-09-10 11:02 . 2007-09-23 01:58   --------   d-----w-   c:\program files\Microsoft Silverlight
                2009-08-22 04:24 . 2009-08-22 04:24   --------   d-----w-   c:\program files\MSBuild
                2009-08-22 04:23 . 2009-08-22 04:23   --------   d-----w-   c:\program files\Reference Assemblies
                2009-08-14 17:25 . 2009-08-14 17:25   --------   d-----w-   c:\program files\Disney
                2009-08-05 09:01 . 2004-08-04 11:00   204800   ----a-w-   c:\windows\system32\mswebdvd.dll
                2009-07-31 19:23 . 2008-11-24 02:33   411368   ----a-w-   c:\windows\system32\deploytk.dll
                2009-07-17 19:01 . 2004-08-04 11:00   58880   ----a-w-   c:\windows\system32\atl.dll
                2009-07-14 03:43 . 2004-08-04 11:00   286208   ----a-w-   c:\windows\system32\wmpdxm.dll
                .

                (((((((((((((((((((((((((((((   SnapShot@2009-10-01_15.49.07   )))))))))))))))))))))))))))))))))))))))))
                .
                + 2009-10-02 20:36 . 2009-10-02 20:36   16384              c:\windows\temp\Perflib_Perfdata_754.dat
                + 2009-10-02 20:36 . 2009-10-02 20:36   16384              c:\windows\temp\Perflib_Perfdata_270.dat
                + 2009-04-15 02:11 . 2009-10-02 21:38   636480              c:\windows\SYSTEM32\ZoneLabs\avsys\bases\sfdb.dat
                + 2008-08-18 23:44 . 2008-04-21 12:08   215552              c:\windows\SYSTEM32\DLLCACHE\wordpad.exe
                + 2009-04-15 02:07 . 2009-10-01 16:43   13828992              c:\windows\SYSTEM32\ZoneLabs\spyware.dat
                .
                (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* empty entries & legit default entries are not shown
                REGEDIT4

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-02 68856]
                "TivoTransfer"="c:\program files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe" [2006-07-11 1174528]
                "TivoNotify"="c:\program files\TiVo\Desktop\TiVoNotify.exe" [2006-07-11 341504]
                "TivoServer"="c:\program files\TiVo\Desktop\TiVoServer.exe" [2006-07-11 1313792]
                "Google Update"="c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-03-24 133104]
                "E6TaskPanel"="c:\program files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 942080]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-06-30 1388544]
                "IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
                "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
                "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
                "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
                "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
                "MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592]
                "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
                "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
                "Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-12-06 50688]
                "MimBoot"="c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe" [2006-01-19 11776]
                "LogitechCameraAssistant"="c:\program files\Logitech\Video\CameraAssistant.exe" [2005-07-28 389120]
                "LogitechVideo[inspector]"="c:\program files\Logitech\Video\InstallHelper.exe" [2005-07-28 18:09 73728]
                "LogitechCameraService(E)"="c:\windows\system32\ElkCtrl.exe" [2004-11-01 262144]
                "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-08 282624]
                "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
                "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
                "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
                "SetDefPrt"="c:\program files\Brother\Brmfl04a\BrStDvPt.exe" [2004-05-25 49152]
                "ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 851968]
                "AppMgrGui"="c:\program files\AppStream\WindowsClient\bin\exeForService.exe" [2006-09-27 24064]
                "Elmore Music Messenger"="c:\windows\Elmore Music Messenger.exe" [2007-01-29 292658]
                "eligmini"="c:\program files\Fisher-Price\Easy-Link internet launch pad\Easy-Link internet launch pad.exe" [2009-04-28 491520]
                "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-03-31 982408]
                "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
                "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]

                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
                "TBInfo"="iexplore.exe" - c:\combofix\iexplore.exe [2009-04-20 31232]

                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
                2009-09-03 19:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.dll

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ASWLNDLL]
                2007-05-14 01:45   6656   ----a-w-   c:\windows\SYSTEM32\ASWLNDLL.dll

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                "DisableMonitoring"=dword:00000001

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
                "DisableMonitoring"=dword:00000001

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                "EnableFirewall"= 0 (0x0)

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                "%windir%\\system32\\sessmgr.exe"=
                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                "c:\\Program Files\\TiVo\\Desktop\\TiVoServer.exe"=
                "c:\\WINDOWS\\SYSTEM32\\ZoneLabs\\vsmon.exe"=

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support
                "3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
                "3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
                "AllowInboundEchoRequest"= 1 (0x1)

                R1 APPSTREAM;APPSTREAM;c:\windows\SYSTEM32\DRIVERS\AppStream.sys [5/13/2007 9:33 PM 115284]
                R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/15/2009 11:42 AM 9968]
                R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/15/2009 11:42 AM 74480]
                R2 AppMgrService;AWE 5.1.0 Application Manager;c:\program files\AppStream\WindowsClient\bin\AppMgrService.exe [9/27/2006 7:49 PM 1990656]
                R2 EarthLinkMonitor;EarthLink Monitor Service;c:\program files\EarthLink TotalAccess\WENGINE\wmonitor.exe [1/26/2005 11:47 AM 65604]
                R2 REGHOOK;REGHOOK;c:\windows\SYSTEM32\DRIVERS\RegHook.sys [9/27/2006 7:27 PM 54879]
                R2 TivoBeacon2;TiVo Beacon;c:\program files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe [7/11/2006 8:22 AM 857088]
                R2 VSPD;VSPD;c:\windows\SYSTEM32\DRIVERS\VSPD.sys [9/27/2006 7:27 PM 31321]
                S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\windows\SYSTEM32\DRIVERS\ADSFilter.sys [8/3/2007 7:35 AM 57456]
                S3 ADSMonitor;ADSMonitor - (EarthLink Monitor Driver);c:\windows\SYSTEM32\DRIVERS\ADSMonitor.sys [8/3/2007 7:35 AM 38384]
                S3 BW2NDIS5;BW2NDIS5;c:\windows\SYSTEM32\DRIVERS\BW2NDIS5.SYS [11/1/2004 2:16 PM 17536]
                S3 EarthLinkSafeConnectDriver;EarthLinkSafeConnectDriver;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys [?]
                S3 EarthLinkSafeConnectFilter;EarthLinkSafeConnectFilter;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys [?]
                S3 EarthLinkSafeConnectShim;EarthLinkSafeConnectShim;\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectShim.sys --> c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectShim.sys [?]
                S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/4/2004 7:00 AM 14336]
                S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/15/2009 11:42 AM 7408]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                p2psvc   REG_MULTI_SZ      p2psvc p2pimsvc p2pgasvc PNRPSvc
                getPlusHelper   REG_MULTI_SZ      getPlusHelper

                [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
                "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                .
                Contents of the 'Scheduled Tasks' folder

                2009-10-02 c:\windows\Tasks\Google Software Updater.job
                - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-02 11:52]

                2009-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-186917913-2315771567-692555066-1006Core.job
                - c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-24 11:55]

                2009-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-186917913-2315771567-692555066-1006UA.job
                - c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-03-24 11:55]
                .
                Logged

                TriciaM

                  Topic Starter


                  Beginner

                  Re: Virus?
                  « Reply #27 on: October 02, 2009, 04:04:55 PM »
                  ------- Supplementary Scan -------
                  .
                  uStart Page = hxxp://www.rr.com/
                  uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html
                  uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex}&startPage={startPage}
                  IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
                  LSP: c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
                  Trusted Zone: broderbund.com\support
                  Trusted Zone: mypublisher.com\www
                  Trusted Zone: riverdeep.net\smartdownload
                  Trusted Zone: uspsoig.gov\portal2003
                  Trusted Zone: musicmatch.com\online
                  DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
                  DPF: {5DA9D8E0-5A57-11CF-9E36-00C0930198C0} - hxxp://www.ansonncrod.org/imw32o40.cab
                  DPF: {9841D1AE-9C0B-11D3-9452-00105A098C21} - hxxp://www.ansonncrod.org/prntpro2.CAB
                  FF - ProfilePath - c:\documents and settings\Tricia & Roger\Application Data\Mozilla\Firefox\Profiles\10loo8z7.default\
                  FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
                  FF - plugin: c:\documents and settings\Tricia & Roger\Application Data\Mozilla\Firefox\Profiles\10loo8z7.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
                  FF - plugin: c:\documents and settings\Tricia & Roger\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
                  FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
                  FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
                  FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
                  FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll
                  FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
                  FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

                  ---- FIREFOX POLICIES ----
                  FF - user.js: yahoo.homepage.dontask - true.

                  **************************************************************************

                  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2009-10-02 17:48
                  Windows 5.1.2600 Service Pack 3 NTFS

                  scanning hidden processes ... 

                  scanning hidden autostart entries ...

                  scanning hidden files ... 

                  scan completed successfully
                  hidden files: 0

                  **************************************************************************

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cd20xrnt]
                  "ImagePath"="system32\DRIVERS\cd20xrnt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdaudio]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdfs]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cdrom]
                  "ImagePath"="system32\DRIVERS\cdrom.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Changer]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CiSvc]
                  "ImagePath"="%SystemRoot%\system32\cisvc.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ClipSrv]
                  "ImagePath"="%SystemRoot%\system32\clipsrv.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\clr_optimization_v2.0.50727_32]
                  "ImagePath"="c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CmdIde]
                  "ImagePath"="system32\DRIVERS\cmdide.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\COMSysApp]
                  "ImagePath"="c:\windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ContentFilter]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ContentIndex]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Cpqarray]
                  "ImagePath"="system32\DRIVERS\cpqarray.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CryptSvc]
                  "ServiceDll"="%SystemRoot%\System32\cryptsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac2w2k]
                  "ImagePath"="system32\DRIVERS\dac2w2k.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac960nt]
                  "ImagePath"="system32\DRIVERS\dac960nt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DcomLaunch]
                  "ServiceDll"="%SystemRoot%\system32\rpcss.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dhcp]
                  "ServiceDll"="%SystemRoot%\System32\dhcpcsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Disk]
                  "ImagePath"="system32\DRIVERS\disk.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmadmin]
                  "ImagePath"="%SystemRoot%\System32\dmadmin.exe /com"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmboot]
                  "ImagePath"="System32\drivers\dmboot.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmio]
                  "ImagePath"="System32\drivers\dmio.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmload]
                  "ImagePath"="System32\drivers\dmload.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmserver]
                  "ServiceDll"="%SystemRoot%\System32\dmserver.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DMusic]
                  "ImagePath"="system32\drivers\DMusic.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dnscache]
                  "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dot3svc]
                  "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dpti2o]
                  "ImagePath"="system32\DRIVERS\dpti2o.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drmkaud]
                  "ImagePath"="system32\drivers\drmkaud.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drvmcdb]
                  "ImagePath"="system32\drivers\drvmcdb.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drvncdb]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\drvnddm]
                  "ImagePath"="system32\drivers\drvnddm.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DSBrokerService]
                  "ImagePath"="\"c:\program files\DellSupport\brkrsvc.exe\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DSproct]
                  "ImagePath"="\??\c:\program files\DellSupport\GTAction\triggers\DSproct.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dsunidrv]
                  "ImagePath"="system32\DRIVERS\dsunidrv.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\E100B]
                  "ImagePath"="system32\DRIVERS\e100b325.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EapHost]
                  "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkMonitor]
                  "ImagePath"="\"c:\program files\EarthLink TotalAccess\WENGINE\wmonitor.exe\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectAgent]
                  "ImagePath"="\"c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Bin\SanaAgent.exe\" EarthLinkSafeConnectAgent"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectDriver]
                  "ImagePath"="\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectDriver.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectFilter]
                  "ImagePath"="\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectFilter.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EarthLinkSafeConnectShim]
                  "ImagePath"="\??\c:\program files\EarthLink\EarthLink Protection Control Center\Sana\Driver\platform_XP\SafeConnectShim.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ERSvc]
                  "ServiceDll"="%SystemRoot%\System32\ersvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Eventlog]
                  "ImagePath"="%SystemRoot%\system32\services.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EventSystem]
                  "ServiceDll"="c:\windows\system32\es.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fastfat]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FastUserSwitchingCompatibility]
                  "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fax]
                  "ImagePath"="%systemroot%\system32\fxssvc.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fdc]
                  "ImagePath"="system32\DRIVERS\fdc.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FilterService]
                  "ImagePath"="system32\DRIVERS\lvuvcflt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fips]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Flpydisk]
                  "ImagePath"="system32\DRIVERS\flpydisk.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FltMgr]
                  "ImagePath"="system32\drivers\fltmgr.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FontCache3.0.0.0]
                  "ImagePath"="c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FSLX]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Fs_Rec]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ftdisk]
                  "ImagePath"="system32\DRIVERS\ftdisk.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GEARAspiWDM]
                  "ImagePath"="System32\Drivers\GEARAspiWDM.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\getPlusHelper]
                  "ServiceDll"="c:\program files\NOS\bin\getPlus_Helper.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Gpc]
                  "ImagePath"="system32\DRIVERS\msgpc.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GRTdiMon]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gusvc]
                  "ImagePath"="\"c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\helpsvc]
                  "ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HidServ]
                  "ServiceDll"="%SystemRoot%\System32\hidserv.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HidUsb]
                  "ImagePath"="system32\DRIVERS\hidusb.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hkmsvc]
                  "ServiceDll"="%SystemRoot%\System32\kmsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\hpn]
                  "ImagePath"="system32\DRIVERS\hpn.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HTTP]
                  "ImagePath"="System32\Drivers\HTTP.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\HTTPFilter]
                  "ServiceDll"="%SystemRoot%\System32\w3ssl.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\i2omgmt]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\i2omp]
                  "ImagePath"="system32\DRIVERS\i2omp.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\i8042prt]
                  "ImagePath"="system32\DRIVERS\i8042prt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IAANTMon]
                  "ImagePath"="c:\program files\Intel\Intel Application Accelerator\iaantmon.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iaStor]
                  "ImagePath"="system32\drivers\iaStor.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IDriverT]
                  "ImagePath"="\"c:\program files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\idsvc]
                  "ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Imapi]
                  "ImagePath"="system32\DRIVERS\imapi.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ImapiService]
                  "ImagePath"="%systemroot%\system32\imapi.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\inetaccs]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ini910u]
                  "ImagePath"="system32\DRIVERS\ini910u.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Inport]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelC51]
                  "ImagePath"="system32\DRIVERS\IntelC51.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelC52]
                  "ImagePath"="system32\DRIVERS\IntelC52.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelC53]
                  "ImagePath"="system32\DRIVERS\IntelC53.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IntelIde]
                  "ImagePath"="system32\DRIVERS\intelide.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\intelppm]
                  "ImagePath"="system32\DRIVERS\intelppm.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ip6Fw]
                  "ImagePath"="system32\drivers\ip6fw.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IpFilterDriver]
                  "ImagePath"="system32\DRIVERS\ipfltdrv.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IpInIp]
                  "ImagePath"="system32\DRIVERS\ipinip.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IpNat]
                  "ImagePath"="system32\DRIVERS\ipnat.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IPSec]
                  "ImagePath"="system32\DRIVERS\ipsec.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IRENUM]
                  "ImagePath"="system32\DRIVERS\irenum.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ISAPISearch]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\isapnp]
                  "ImagePath"="system32\DRIVERS\isapnp.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\JavaQuickStarterService]
                  "ImagePath"="\"c:\program files\Java\jre6\bin\jqs.exe\" -service -config \"c:\program files\Java\jre6\lib\deploy\jqs\jqs.conf\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\JL2005C]
                  "ImagePath"="System32\Drivers\jl2005c.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Kbdclass]
                  "ImagePath"="system32\DRIVERS\kbdclass.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KLIF]
                  "ImagePath"="system32\DRIVERS\klif.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\kmixer]
                  "ImagePath"="system32\drivers\kmixer.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KSecDD]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lanmanserver]
                  "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lanmanworkstation]
                  "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lbrtfdc]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ldap]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LicenseService]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LmHosts]
                  "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LPDSVC]
                  "ImagePath"="%SystemRoot%\system32\tcpsvcs.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Lvckap]
                  "ImagePath"="\??\c:\windows\system32\drivers\Lvckap.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lvmvdrv]
                  "ImagePath"="\??\c:\windows\system32\drivers\lvmvdrv.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lvpopflt]
                  "ImagePath"="system32\DRIVERS\lvpopflt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUSBSta]
                  "ImagePath"="system32\drivers\lvusbsta.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LVUVC]
                  "ImagePath"="system32\DRIVERS\lvuvc.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Messenger]
                  "ServiceDll"="%SystemRoot%\System32\msgsvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mnmdd]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mnmsrvc]
                  "ImagePath"="c:\windows\system32\mnmsrvc.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Modem]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MODEMCSA]
                  "ImagePath"="system32\drivers\MODEMCSA.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mohfilt]
                  "ImagePath"="system32\DRIVERS\mohfilt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Mouclass]
                  "ImagePath"="system32\DRIVERS\mouclass.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MountMgr]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MPE]
                  "ImagePath"="system32\DRIVERS\MPE.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mraid35x]
                  "ImagePath"="system32\DRIVERS\mraid35x.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MRxDAV]
                  "ImagePath"="system32\DRIVERS\mrxdav.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MRxSmb]
                  "ImagePath"="system32\DRIVERS\mrxsmb.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSDTC]
                  "ImagePath"="c:\windows\system32\msdtc.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSDTC Bridge 3.0.0.0]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSDV]
                  "ImagePath"="system32\DRIVERS\msdv.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Msfs]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSIServer]
                  "ImagePath"="%systemroot%\system32\msiexec.exe /V"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSKSSRV]
                  "ImagePath"="system32\drivers\MSKSSRV.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSPCLOCK]
                  "ImagePath"="system32\drivers\MSPCLOCK.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSPQM]
                  "ImagePath"="system32\drivers\MSPQM.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mssmbios]
                  "ImagePath"="system32\DRIVERS\mssmbios.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MSTEE]
                  "ImagePath"="system32\drivers\MSTEE.sys"
                  --

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Mup]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NABTSFEC]
                  "ImagePath"="system32\DRIVERS\NABTSFEC.sys"
                  --

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\napagent]
                  "ServiceDll"="%SystemRoot%\System32\qagentrt.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NDIS]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NdisIP]
                  "ImagePath"="system32\DRIVERS\NdisIP.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NdisTapi]
                  "ImagePath"="system32\DRIVERS\ndistapi.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ndisuio]
                  "ImagePath"="system32\DRIVERS\ndisuio.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NdisWan]
                  "ImagePath"="system32\DRIVERS\ndiswan.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NDProxy]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetBIOS]
                  "ImagePath"="system32\DRIVERS\netbios.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetBT]
                  "ImagePath"="system32\DRIVERS\netbt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDE]
                  "ImagePath"="%SystemRoot%\system32\netdde.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdm]
                  "ImagePath"="%SystemRoot%\system32\netdde.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netlogon]
                  "ImagePath"="%SystemRoot%\system32\lsass.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Netman]
                  "ServiceDll"="%SystemRoot%\System32\netman.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetTcpPortSharing]
                  "ImagePath"="\"c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe\""

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIC1394]
                  "ImagePath"="system32\DRIVERS\nic1394.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Nla]
                  "ServiceDll"="%SystemRoot%\System32\mswsock.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Npfs]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ntfs]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtLmSsp]
                  "ImagePath"="%SystemRoot%\system32\lsass.exe"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtmsSvc]
                  "ServiceDll"="%SystemRoot%\system32\ntmssvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Null]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nv]
                  "ImagePath"="system32\DRIVERS\nv4_mini.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NwlnkFlt]
                  "ImagePath"="system32\DRIVERS\nwlnkflt.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NwlnkFwd]
                  "ImagePath"="system32\DRIVERS\nwlnkfwd.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ohci1394]
                  "ImagePath"="system32\DRIVERS\ohci1394.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\omci]
                  "ImagePath"="system32\DRIVERS\omci.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\p2pgasvc]
                  "ServiceDll"="%SystemRoot%\system32\p2pgasvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\p2pimsvc]
                  "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\p2psvc]
                  "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Parport]
                  "ImagePath"="system32\DRIVERS\parport.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PartMgr]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ParVdm]

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCI]
                  "ImagePath"="system32\DRIVERS\pci.sys"

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCIDump]
                  Logged

                  TriciaM

                    Topic Starter


                    Beginner

                    Re: Virus?
                    « Reply #28 on: October 02, 2009, 04:06:50 PM »
                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCIIde]
                    "ImagePath"="system32\DRIVERS\pciide.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Pcmcia]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDCOMP]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDFRAME]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDRELI]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PDRFRAME]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\perc2]
                    "ImagePath"="system32\DRIVERS\perc2.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\perc2hib]
                    "ImagePath"="system32\DRIVERS\perc2hib.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfDisk]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfNet]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfOS]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PerfProc]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pfc]
                    "ImagePath"="\??\c:\windows\system32\drivers\pfc.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PlugPlay]
                    "ImagePath"="%SystemRoot%\system32\services.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PNRPSvc]
                    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgent]
                    "ImagePath"="%SystemRoot%\system32\lsass.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PortProxy]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PptpMiniport]
                    "ImagePath"="system32\DRIVERS\raspptp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ProtectedStorage]
                    "ImagePath"="%SystemRoot%\system32\lsass.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSched]
                    "ImagePath"="system32\DRIVERS\psched.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ptilink]
                    "ImagePath"="system32\DRIVERS\ptilink.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PxHelp20]
                    "ImagePath"="System32\Drivers\PxHelp20.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql1080]
                    "ImagePath"="system32\DRIVERS\ql1080.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Ql10wnt]
                    "ImagePath"="system32\DRIVERS\ql10wnt.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql12160]
                    "ImagePath"="system32\DRIVERS\ql12160.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql1240]
                    "ImagePath"="system32\DRIVERS\ql1240.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ql1280]
                    "ImagePath"="system32\DRIVERS\ql1280.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAcd]
                    "ImagePath"="system32\DRIVERS\rasacd.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasAuto]
                    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Rasl2tp]
                    "ImagePath"="system32\DRIVERS\rasl2tp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasMan]
                    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasPppoe]
                    "ImagePath"="system32\DRIVERS\raspppoe.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Raspti]
                    "ImagePath"="system32\DRIVERS\raspti.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Rdbss]
                    "ImagePath"="system32\DRIVERS\rdbss.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPCDD]
                    "ImagePath"="System32\DRIVERS\RDPCDD.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPDD]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\rdpdr]
                    "ImagePath"="system32\DRIVERS\rdpdr.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPNP]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDPWD]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RDSessMgr]
                    "ImagePath"="c:\windows\system32\sessmgr.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\redbook]
                    "ImagePath"="system32\DRIVERS\redbook.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\REGHOOK]
                    "ImagePath"="\??\c:\windows\System32\Drivers\REGHOOK.SYS"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RemoteAccess]
                    "ServiceDll"="%SystemRoot%\System32\mprdim.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcLocator]
                    "ImagePath"="%SystemRoot%\system32\locator.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSs]
                    "ServiceDll"="%SystemRoot%\System32\rpcss.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RSVP]
                    "ImagePath"="%SystemRoot%\system32\rsvp.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SamSs]
                    "ImagePath"="%SystemRoot%\system32\lsass.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SASDIFSV]
                    "ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SASENUM]
                    "ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SASKUTIL]
                    "ImagePath"="\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SCardSvr]
                    "ImagePath"="%SystemRoot%\System32\SCardSvr.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Schedule]
                    "ServiceDll"="%SystemRoot%\system32\schedsvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ScsiPort]
                    "ImagePath"="%SystemRoot%\system32\drivers\scsiport.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Secdrv]
                    "ImagePath"="system32\DRIVERS\secdrv.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\seclogon]
                    "ServiceDll"="%SystemRoot%\System32\seclogon.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\senfilt]
                    "ImagePath"="system32\drivers\senfilt.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SENS]
                    "ServiceDll"="%SystemRoot%\system32\sens.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\serenum]
                    "ImagePath"="system32\DRIVERS\serenum.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Serial]
                    "ImagePath"="system32\DRIVERS\serial.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ServiceModelOperation 3.0.0.0]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ServiceModelService 3.0.0.0]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sfloppy]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess]
                    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ShellHWDetection]
                    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Simbad]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SimpTcp]
                    "ImagePath"="%SystemRoot%\system32\tcpsvcs.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sisagp]
                    "ImagePath"="system32\DRIVERS\sisagp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SLIP]
                    "ImagePath"="system32\DRIVERS\SLIP.sys"
                    --

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SMSvcHost 3.0.0.0]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\smwdm]
                    "ImagePath"="system32\drivers\smwdm.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNMP]
                    "ImagePath"="%SystemRoot%\System32\snmp.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNMPTRAP]
                    "ImagePath"="%SystemRoot%\System32\snmptrap.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sparrow]
                    "ImagePath"="system32\DRIVERS\sparrow.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\splitter]
                    "ImagePath"="system32\drivers\splitter.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Spooler]
                    "ImagePath"="%SystemRoot%\system32\spoolsv.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sr]
                    "ImagePath"="system32\DRIVERS\sr.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\srescan]
                    "ImagePath"="system32\ZoneLabs\srescan.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\srservice]
                    "ServiceDll"="%SystemRoot%\system32\srsvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Srv]
                    "ImagePath"="system32\DRIVERS\srv.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sscdbhk5]
                    "ImagePath"="system32\drivers\sscdbhk5.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SSDPSRV]
                    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ssrtln]
                    "ImagePath"="system32\drivers\ssrtln.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\stisvc]
                    "ServiceDll"="%SystemRoot%\system32\wiaservc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\streamip]
                    "ImagePath"="system32\DRIVERS\StreamIP.sys"
                    --

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\swenum]
                    "ImagePath"="system32\DRIVERS\swenum.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\swmidi]
                    "ImagePath"="system32\drivers\swmidi.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SwPrv]
                    "ImagePath"="c:\windows\system32\dllhost.exe /Processid:{A445BD1E-49EE-4607-B370-5CCA447377C4}"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\swwd]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\symc810]
                    "ImagePath"="system32\DRIVERS\symc810.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\symc8xx]
                    "ImagePath"="system32\DRIVERS\symc8xx.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sym_hi]
                    "ImagePath"="system32\DRIVERS\sym_hi.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sym_u3]
                    "ImagePath"="system32\DRIVERS\sym_u3.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\sysaudio]
                    "ImagePath"="system32\drivers\sysaudio.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SysmonLog]
                    "ImagePath"="%SystemRoot%\system32\smlogsvc.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TapiSrv]
                    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip]
                    "ImagePath"="system32\DRIVERS\tcpip.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip6]
                    "ImagePath"="system32\DRIVERS\tcpip6.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDPIPE]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDTCP]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TermDD]
                    "ImagePath"="system32\DRIVERS\termdd.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TermService]
                    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnboio]
                    "ImagePath"="system32\dla\tfsnboio.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsncofs]
                    "ImagePath"="system32\dla\tfsncofs.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsndrct]
                    "ImagePath"="system32\dla\tfsndrct.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsndres]
                    "ImagePath"="system32\dla\tfsndres.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnifs]
                    "ImagePath"="system32\dla\tfsnifs.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnopio]
                    "ImagePath"="system32\dla\tfsnopio.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnpool]
                    "ImagePath"="system32\dla\tfsnpool.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnudf]
                    "ImagePath"="system32\dla\tfsnudf.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tfsnudfa]
                    "ImagePath"="system32\dla\tfsnudfa.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Themes]
                    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TivoBeacon2]
                    "ImagePath"="\"c:\program files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe\" /service"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TosIde]
                    "ImagePath"="system32\DRIVERS\toside.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TrkWks]
                    "ServiceDll"="%SystemRoot%\system32\trkwks.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TSDDD]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tunmp]
                    "ImagePath"="system32\DRIVERS\tunmp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Udfs]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ultra]
                    "ImagePath"="system32\DRIVERS\ultra.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Update]
                    "ImagePath"="system32\DRIVERS\update.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\upnphost]
                    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\UPS]
                    "ImagePath"="%SystemRoot%\System32\ups.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbaudio]
                    "ImagePath"="system32\drivers\usbaudio.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbccgp]
                    "ImagePath"="system32\DRIVERS\usbccgp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbehci]
                    "ImagePath"="system32\DRIVERS\usbehci.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbhub]
                    "ImagePath"="system32\DRIVERS\usbhub.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbprint]
                    "ImagePath"="system32\DRIVERS\usbprint.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbscan]
                    "ImagePath"="system32\DRIVERS\usbscan.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\USBSTOR]
                    "ImagePath"="system32\DRIVERS\USBSTOR.SYS"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\usbuhci]
                    "ImagePath"="system32\DRIVERS\usbuhci.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VgaSave]
                    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\viaagp]
                    "ImagePath"="system32\DRIVERS\viaagp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ViaIde]
                    "ImagePath"="system32\DRIVERS\viaide.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VolSnap]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
                    "ImagePath"="System32\vsdatant.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsmon]
                    "ImagePath"="c:\windows\SYSTEM32\ZoneLabs\vsmon.exe -service"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VSPD]
                    "ImagePath"="\??\c:\windows\System32\Drivers\VSPD.SYS"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\VSS]
                    "ImagePath"="%SystemRoot%\System32\vssvc.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\w32time]
                    "ServiceDll"="%systemroot%\system32\w32time.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\W3SVC]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Wanarp]
                    "ImagePath"="system32\DRIVERS\wanarp.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wanatw]
                    "ImagePath"="system32\DRIVERS\wanatw4.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WDICA]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wdmaud]
                    "ImagePath"="system32\drivers\wdmaud.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WebClient]
                    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\winmgmt]
                    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Winsock]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinSock2]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinTrust]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmdmPmSN]
                    "ServiceDll"="c:\windows\system32\MsPMSNSv.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Wmi]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApRpl]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrv]
                    "ImagePath"="c:\windows\system32\wbem\wmiapsrv.exe"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WMPNetworkSvc]
                    "ImagePath"="\"c:\program files\Windows Media Player\WMPNetwk.exe\""

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WpdUsb]
                    "ImagePath"="system32\DRIVERS\wpdusb.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WS2IFSL]
                    "ImagePath"="\SystemRoot\System32\drivers\ws2ifsl.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wscsvc]
                    "ServiceDll"="%SYSTEMROOT%\system32\wscsvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WSTCODEC]
                    "ImagePath"="system32\DRIVERS\WSTCODEC.SYS"
                    --

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\wuauserv]
                    "ServiceDll"="c:\windows\system32\wuauserv.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfPf]
                    "ImagePath"="system32\DRIVERS\WudfPf.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfRd]
                    "ImagePath"="system32\DRIVERS\wudfrd.sys"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WudfSvc]
                    "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WZCSVC]
                    "ServiceDll"="%SystemRoot%\System32\wzcsvc.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xmlprov]
                    "ServiceDll"="%SystemRoot%\System32\xmlprov.dll"

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{9F308F8A-7C99-4907-AE93-02A349C53899}]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{AEA69CD6-BEF8-4F41-8F9F-E3364390A66B}]

                    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{D847D4EC-2128-4DCA-BEB1-8E73F1CC5BE3}]
                    .
                    --------------------- DLLs Loaded Under Running Processes ---------------------

                    - - - - - - - > 'winlogon.exe'(792)
                    c:\program files\SUPERAntiSpyware\SASWINLO.dll
                    c:\windows\system32\WININET.dll
                    c:\windows\system32\ASWLNDLL.dll

                    - - - - - - - > 'lsass.exe'(856)
                    c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll

                    - - - - - - - > 'explorer.exe'(3220)
                    c:\windows\system32\WININET.dll
                    c:\windows\system32\ieframe.dll
                    c:\windows\system32\webcheck.dll
                    c:\windows\system32\WPDShServiceObj.dll
                    c:\windows\system32\PortableDeviceTypes.dll
                    c:\windows\system32\PortableDeviceApi.dll
                    c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
                    .
                    Completion time: 2009-10-02 17:51
                    ComboFix-quarantined-files.txt  2009-10-02 21:51
                    ComboFix2.txt  2009-10-01 16:01

                    Pre-Run: 7,621,898,240 bytes free
                    Post-Run: 7,607,095,296 bytes free
                    Logged

                    TriciaM

                      Topic Starter


                      Beginner

                      Re: Virus?
                      « Reply #29 on: October 02, 2009, 04:10:25 PM »
                      I could not find the Combofix.exe log after the scan was done. Not sure if I closed it out or not....searched for it......I did another Combofix scan, which, I am hoping, was not a no-no. I posted that log above.
                      Logged
                      Pages: 1 [2] 3 4 5  All   Go Up
                      « previous next »