DDS Log
DDS (Ver_09-06-26.01) - NTFSx86
Run by mrichardson at 10:55:36.35 on Fri 07/17/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.277 [GMT -4:00]
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\OPHALDCS.EXE
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\Symantec\WinFax\WFXMOD32.EXE
C:\Program Files\Visioneer\OneTouch 4.0\OtMonEx.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\wfxsnt40.exe
C:\Program Files\OPEN-XCHANGE\OXlook\UpdateTool.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
C:\WINDOWS\system32\mstsc.exe
C:\WINDOWS\system32\HPBPRO.EXE
C:\Documents and Settings\mrichardson\Desktop\dds.scr
============== Pseudo HJT Report ===============
uSearch Page =
hxxp://www.google.comuSearch Bar =
hxxp://www.google.com/iemDefault_Page_URL =
hxxp://www.dell.commDefault_Search_URL =
hxxp://www.google.com/iemSearch Page =
hxxp://www.google.commStart Page =
hxxp://www.google.comuInternet Settings,ProxyOverride = <local>
mSearchAssistant =
hxxp://www.google.comuURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [EasyLinkAdvisor] "c:\program files\linksys easylink advisor\LinksysAgent.exe" /startup
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [<NO NAME>]
mRun: [StatusClient] c:\program files\hewlett-packard\toolbox2.0\apache tomcat 4.0\webapps\toolbox\statusclient\StatusClient.exe /auto
mRun: [TomcatStartup] c:\program files\hewlett-packard\toolbox2.0\hpbpsttp.exe
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe"
mRun: [WinFaxAppPortStarter] wfxsnt40.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Update-Tool] c:\program files\open-xchange\oxlook\UpdateTool.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [SSBkgdUpdate] "c:\program files\common files\scansoft shared\ssbkgdupdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "c:\program files\scansoft\paperport\pptd40nt.exe"
mRun: [IndexSearch] "c:\program files\scansoft\paperport\IndexSearch.exe"
mRun: [PPort10reminder] "c:\program files\scansoft\paperport\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\scansoft\paperport\10\config\ereg\ereg.ini"
mRun: [Opware12] "c:\program files\scansoft\omnipagepro12.0\Opware12.exe"
mRun: [OP12 Reminder] "c:\program files\scansoft\omnipagepro12.0\eregeng\ereg.exe" -r "c:\program files\scansoft\omnipagepro12.0\eregeng\ereg.ini"
dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\news3n~1.lnk - c:\program files\common files\news 3 now\TrueWeather.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{f3c1de9e-5e16-4ba9-b854-7b53a45e3579}\Icon3E5562ED7.ico
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} -
hxxp://support.dell.com/systemprofiler/SysPro.CABDPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -
hxxp://office.microsoft.com/templates/ieawsdc.cabDPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} -
hxxp://go.microsoft.com/fwlink/?linkid=58813DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} -
hxxp://zone.msn.com/binFrameWork/v10/St ... b55579.cabDPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} -
hxxp://upload.facebook.com/controls/200 ... oader5.cabDPF: {166B1BCA-3F9C-11CF-8075-444553540000} -
hxxp://download.macromedia.com/pub/shoc ... tor/sw.cabDPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} -
hxxp://www.symantec.com/techsupp/asa/LSSupCtl.cabDPF: {233C1507-6A77-46A4-9443-F871F945D258} -
hxxp://fpdownload.macromedia.com/pub/sh ... tor/sw.cabDPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} -
hxxps://www-secure.symantec.com/techsup ... mAData.cabDPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} -
hxxp://zone.msn.com/BinFrameWork/v10/ZB ... b55579.cabDPF: {406B5949-7190-4245-91A9-30A17DE16AD0} -
hxxp://www1.snapfish.com/SnapfishActivia.cabDPF: {44990200-3C9D-426D-81DF-AAB636FA4345} -
hxxps://www-secure.symantec.com/techsup ... gctlsi.cabDPF: {44990301-3C9D-426D-81DF-AAB636FA4345} -
hxxps://www-secure.symantec.com/techsup ... gctlsr.cabDPF: {48DD0448-9209-4F81-9F6D-D83562940134} -
hxxp://lads.myspace.com/upload/MySpaceUploader1006.cabDPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} -
hxxp://gfx1.hotmail.com/mail/w3/pr01/re ... NPUpld.cabDPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} -
hxxp://zone.msn.com/binframework/v10/ZP ... b55579.cabDPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} -
hxxp://zone.msn.com/bingame/zpagames/GA ... b60096.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cabDPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -
hxxp://fpdownload.macromedia.com/get/fl ... rashim.cabDPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} -
hxxp://a19.g.akamai.net/7/19/7125/1450/ ... brkpie.cabDPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
hxxp://cdn2.zone.msn.com/binFramework/v ... b56649.cabDPF: {C4847596-972C-11D0-9567-00A0C9273C2A} -
hxxp://webforce.specializedstaffing.biz ... viewer.cabDPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} -
hxxp://java.sun.com/products/plugin/aut ... s-i586.cabDPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} -
hxxp://java.sun.com/update/1.5.0/jinsta ... s-i586.cabDPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} -
hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cabDPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} -
hxxp://www.symantec.com/techsupp/asa/SymAData.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -
hxxp://fpdownload.macromedia.com/pub/sh ... wflash.cabDPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} -
hxxp://zone.msn.com/binframework/v10/St ... b55579.cabDPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} -
hxxp://l.yimg.com/jh/games/popcap/zuma/ ... der_v6.cabDPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} -
hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
Notify: LMIinit - LMIinit.dll
SEH: WinFax PRO IShellExecuteHook: {a213b520-c6c2-11d0-af9d-008029e1027e} - c:\program files\symantec\winfax\WfxSeh32.Dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-8 327688]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-3-8 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-8 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-5-27 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-5-27 55024]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-4-8 298776]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-4-10 47640]
R2 OneTouch 4.0 Monitor;OneTouch 4.0 Monitor;c:\program files\visioneer\onetouch 4.0\OtService.exe [2006-4-7 122880]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2006-2-16 4096]
R3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-11-14 394952]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-2 32512]
S4 LkWebLink;Inter-Tel Collaboration Remote Client;c:\documents and settings\mrichardson\my documents\inter-tel\collaboration client 2.0\lkWebLink.exe [2007-12-12 32768]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
=============== Created Last 30 ================
2009-07-16 12:21 <DIR> --d----- c:\docume~1\mricha~1\applic~1\Graboid Inc
2009-07-13 16:45 208,744 a------- c:\windows\system32\muweb.dll
2009-07-13 16:45 268,648 a------- c:\windows\system32\mucltui.dll
2009-07-13 16:39 <DIR> --d----- c:\windows\system32\wbem\Repository
2009-07-13 16:34 <DIR> --d----- c:\program files\common files\NEWS 3 NOW
2009-07-13 16:34 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-07-13 11:46 <DIR> --d----- c:\program files\Trend Micro
2009-07-10 14:18 <DIR> --d----- c:\docume~1\mricha~1\applic~1\MozillaControl
2009-07-10 14:03 <DIR> --d----- c:\program files\Mozilla ActiveX Control v1.7.12
2009-07-10 14:02 <DIR> --d----- c:\program files\VideoLAN
2009-07-10 14:00 <DIR> --d----- c:\program files\Graboid
2009-07-10 11:38 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware(2)
2009-07-10 11:25 <DIR> --d----- c:\docume~1\mricha~1\applic~1\Malwarebytes
2009-07-10 11:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-07-09 13:44 28,288 a------- c:\windows\system32\dllcache\xjis.nls
2009-07-09 13:34 83,748 a------- c:\windows\system32\dllcache\prcp.nls
2009-07-09 13:34 83,748 a------- c:\windows\system32\dllcache\prc.nls
2009-07-09 13:28 47,066 a------- c:\windows\system32\dllcache\ksc.nls
2009-07-09 03:00 <DIR> --d----- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-07-08 20:37 27,496 a------- c:\windows\system32\mucltui.dll.mui
2009-07-08 14:54 <DIR> --d----- c:\documents and settings\mrichardson\IECompatCache
2009-07-08 14:53 <DIR> --d----- c:\documents and settings\mrichardson\PrivacIE
2009-07-08 14:51 <DIR> --d----- c:\documents and settings\mrichardson\IETldCache
2009-07-08 14:48 <DIR> --d----- c:\windows\ie8updates
2009-07-08 14:44 <DIR> -cd----- c:\windows\ie8
2009-06-29 09:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SSScanWizard
2009-06-29 09:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SSScanAppDataDir
2009-06-29 09:31 <DIR> --d----- c:\program files\common files\L&H Shared
2009-06-25 10:10 11,776 a------- c:\windows\system32\drivers\afc.sys
2009-06-25 10:08 1,645,320 a------- c:\windows\system32\gdiplus.dll
2009-06-25 10:08 212,480 a------- c:\windows\PCDLIB32.DLL
2009-06-25 10:07 <DIR> --d----- c:\docume~1\mricha~1\applic~1\LinkManager 4.0
2009-06-25 10:06 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-06-25 10:06 15,104 a------- c:\windows\system32\dllcache\usbscan.sys
2009-06-25 10:06 <DIR> --d----- c:\program files\Visioneer
2009-06-25 10:05 33 a------- c:\windows\BiMonitor.ini
2009-06-25 10:05 29,310 a------- c:\windows\maxlink.ini
2009-06-25 10:04 <DIR> --d----- c:\windows\PIXTRAN
2009-06-25 10:03 <DIR> --d----- c:\program files\common files\Scansoft Shared
2009-06-25 10:03 <DIR> --d----- c:\program files\ScanSoft
==================== Find3M ====================
2009-06-30 14:44 126,032 a------- c:\docume~1\mricha~1\applic~1\GDIPFONTCACHEV1.DAT
2009-06-27 09:14 327,688 a------- c:\windows\system32\drivers\avgldx86.sys
2009-06-27 09:14 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-11 13:13 60,744 a------- c:\documents and settings\mrichardson\g2mdlhlpx.exe
2009-06-03 15:09 1,291,264 a------- c:\windows\system32\quartz.dll
2009-06-03 15:09 1,291,264 -------- c:\windows\system32\dllcache\quartz.dll
2009-05-07 11:32 345,600 a------- c:\windows\system32\localspl.dll
2009-05-07 11:32 345,600 -------- c:\windows\system32\dllcache\localspl.dll
2009-04-29 00:46 3,068,928 -------- c:\windows\system32\dllcache\mshtml.dll
2009-04-29 00:46 666,624 a------- c:\windows\system32\wininet.dll
2009-04-29 00:46 666,624 a------- c:\windows\system32\wininet(3).dll
2009-04-29 00:46 620,032 a------- c:\windows\system32\urlmon(3).dll
2009-04-29 00:46 666,624 -------- c:\windows\system32\dllcache\wininet.dll
2009-04-29 00:46 620,032 -------- c:\windows\system32\dllcache\urlmon.dll
2009-04-29 00:46 1,499,136 -------- c:\windows\system32\dllcache\shdocvw.dll
2009-04-29 00:46 81,920 a------- c:\windows\system32\ieencode.dll
2009-04-29 00:46 81,920 a------- c:\windows\system32\dllcache\ieencode.dll
2008-10-30 13:47 362 ----h--- c:\docume~1\alluse~1\applic~1\emopts.dat
============= FINISH: 10:56:14.39 ===============
Attach.txt
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-06-26.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 6/20/2006 8:51:31 AM
System Uptime: 7/17/2009 9:13:02 AM (1 hours ago)
Motherboard: Dell Inc. | | 0HC918
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2792/800mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 74 GiB total, 55.438 GiB free.
D: is CDROM ()
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP967: 4/19/2009 10:28:10 AM - System Checkpoint
RP968: 4/20/2009 11:53:03 AM - System Checkpoint
RP969: 4/21/2009 1:35:54 PM - System Checkpoint
RP970: 4/21/2009 5:05:12 PM - Installed Cisco Systems VPN Client 5.0.05.0290
RP971: 4/22/2009 5:40:16 PM - System Checkpoint
RP972: 4/23/2009 6:12:12 PM - System Checkpoint
RP973: 4/24/2009 7:12:12 PM - System Checkpoint
RP974: 4/25/2009 8:12:12 PM - System Checkpoint
RP975: 4/26/2009 9:12:12 PM - System Checkpoint
RP976: 4/27/2009 10:12:35 PM - System Checkpoint
RP977: 4/28/2009 11:11:19 PM - System Checkpoint
RP978: 4/30/2009 12:11:19 AM - System Checkpoint
RP979: 5/1/2009 1:11:20 AM - System Checkpoint
RP980: 5/2/2009 2:11:20 AM - System Checkpoint
RP981: 5/3/2009 3:11:20 AM - System Checkpoint
RP982: 5/4/2009 4:11:20 AM - System Checkpoint
RP983: 5/5/2009 5:04:27 AM - System Checkpoint
RP984: 5/5/2009 8:32:59 AM - Restore Operation
RP985: 5/6/2009 10:29:36 AM - System Checkpoint
RP986: 5/7/2009 11:58:02 AM - System Checkpoint
RP987: 5/7/2009 3:55:44 PM - Installed Router
RP988: 5/8/2009 5:12:28 PM - System Checkpoint
RP989: 5/9/2009 5:59:04 PM - System Checkpoint
RP990: 5/10/2009 6:58:28 PM - System Checkpoint
RP991: 5/11/2009 9:36:23 AM - Avg8 Update
RP992: 5/11/2009 9:39:05 AM - Avg8 Update
RP993: 5/12/2009 9:58:42 AM - System Checkpoint
RP994: 5/13/2009 3:00:15 AM - Software Distribution Service 3.0
RP995: 5/14/2009 3:58:43 AM - System Checkpoint
RP996: 5/15/2009 4:58:43 AM - System Checkpoint
RP997: 5/16/2009 5:58:34 AM - System Checkpoint
RP998: 5/17/2009 7:14:48 AM - System Checkpoint
RP999: 5/18/2009 7:15:09 AM - System Checkpoint
RP1000: 5/19/2009 7:22:10 AM - System Checkpoint
RP1001: 5/19/2009 9:50:25 AM - Avg8 Update
RP1002: 5/19/2009 9:51:46 AM - Avg8 Update
RP1003: 5/20/2009 2:12:52 PM - System Checkpoint
RP1004: 5/21/2009 2:21:51 PM - System Checkpoint
RP1005: 5/22/2009 2:42:54 PM - System Checkpoint
RP1006: 5/23/2009 3:21:51 PM - System Checkpoint
RP1007: 5/24/2009 4:21:51 PM - System Checkpoint
RP1008: 5/25/2009 5:21:40 PM - System Checkpoint
RP1009: 5/26/2009 5:36:53 PM - System Checkpoint
RP1010: 5/27/2009 6:36:53 PM - System Checkpoint
RP1011: 5/28/2009 7:36:53 PM - System Checkpoint
RP1012: 5/29/2009 8:36:54 PM - System Checkpoint
RP1013: 5/30/2009 9:36:54 PM - System Checkpoint
RP1014: 5/31/2009 10:36:53 PM - System Checkpoint
RP1015: 6/1/2009 11:36:54 PM - System Checkpoint
RP1016: 6/3/2009 12:36:06 AM - System Checkpoint
RP1017: 6/4/2009 1:36:06 AM - System Checkpoint
RP1018: 6/5/2009 2:36:06 AM - System Checkpoint
RP1019: 6/6/2009 3:36:06 AM - System Checkpoint
RP1020: 6/7/2009 4:33:30 AM - System Checkpoint
RP1021: 6/8/2009 4:36:06 AM - System Checkpoint
RP1022: 6/9/2009 5:36:07 AM - System Checkpoint
RP1023: 6/10/2009 3:00:16 AM - Software Distribution Service 3.0
RP1024: 6/11/2009 3:33:44 AM - System Checkpoint
RP1025: 6/12/2009 3:35:38 AM - System Checkpoint
RP1026: 6/13/2009 4:35:39 AM - System Checkpoint
RP1027: 6/14/2009 5:35:38 AM - System Checkpoint
RP1028: 6/15/2009 6:35:39 AM - System Checkpoint
RP1029: 6/16/2009 7:34:47 AM - System Checkpoint
RP1030: 6/17/2009 10:04:51 AM - System Checkpoint
RP1031: 6/18/2009 1:08:40 PM - System Checkpoint
RP1032: 6/19/2009 1:56:53 PM - System Checkpoint
RP1033: 6/22/2009 9:09:00 AM - System Checkpoint
RP1034: 6/23/2009 4:46:18 PM - System Checkpoint
RP1035: 6/25/2009 8:37:35 AM - System Checkpoint
RP1036: 6/25/2009 10:03:51 AM - Installed ScanSoft PaperPort 10
RP1037: 6/25/2009 10:05:19 AM - Printer Driver Black Ice Color Driver Installed
RP1038: 6/25/2009 10:05:31 AM - Printer Driver Black Ice TIFF Driver Installed
RP1039: 6/25/2009 10:06:31 AM - Installed OneTouch 4.0
RP1040: 6/25/2009 10:08:37 AM - Installed Scrapbook Suite
RP1041: 6/26/2009 1:32:40 PM - System Checkpoint
RP1042: 6/27/2009 9:11:36 AM - Avg8 Update
RP1043: 6/27/2009 9:15:00 AM - Avg8 Update
RP1044: 6/28/2009 9:16:42 AM - System Checkpoint
RP1045: 6/29/2009 9:30:37 AM - Installed OmniPage Pro 12.0
RP1046: 6/30/2009 1:26:22 PM - System Checkpoint
RP1047: 7/1/2009 1:39:47 PM - System Checkpoint
RP1048: 7/2/2009 3:04:29 PM - System Checkpoint
RP1049: 7/3/2009 5:16:17 PM - System Checkpoint
RP1050: 7/4/2009 5:30:18 PM - System Checkpoint
RP1051: 7/6/2009 10:09:07 AM - System Checkpoint
RP1052: 7/7/2009 10:45:16 AM - System Checkpoint
RP1053: 7/8/2009 11:25:39 AM - System Checkpoint
RP1054: 7/8/2009 2:44:26 PM - Installed MSN Toolbar
RP1055: 7/8/2009 2:46:01 PM - Installed Windows Internet Explorer 8.
RP1056: 7/8/2009 2:46:55 PM - Software Distribution Service 3.0
RP1057: 7/9/2009 3:00:20 AM - Software Distribution Service 3.0
RP1058: 7/10/2009 3:15:35 AM - System Checkpoint
RP1059: 7/10/2009 1:06:51 PM - Installed Java(TM) 6 Update 14
RP1060: 7/11/2009 2:01:26 PM - System Checkpoint
RP1061: 7/12/2009 3:01:33 PM - System Checkpoint
RP1062: 7/13/2009 9:49:29 AM - Removed SUPERAntiSpyware Free Edition
RP1063: 7/13/2009 1:06:36 PM - Software Distribution Service 3.0
RP1064: 7/13/2009 4:34:11 PM - Restore Operation
RP1065: 7/13/2009 4:57:36 PM - Software Distribution Service 3.0
RP1066: 7/14/2009 5:20:04 PM - System Checkpoint
RP1067: 7/15/2009 5:06:00 PM - Software Distribution Service 3.0
RP1068: 7/16/2009 1:29:54 PM - Software Distribution Service 3.0
==== Installed Programs ======================
Ad-Aware SE Personal
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Media Player
Adobe Reader 7.0.5 Language Support
Adobe Reader 7.0.9
Adobe Shockwave Player
Adobe SVG Viewer 3.0
Adobe® Photoshop® Album Starter Edition 3.0
Adobe® Photoshop® Album Starter Edition 3.0.1
ArcSoft Scrapbook Suite
Avery Wizard 3.0
AVG 8.5
Cisco Systems VPN Client 5.0.05.0290
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
Drivers Install For Linksys Easylink Advisor
Google Updater
GoToMeeting 4.0.0.320
Graboid Video 1.5
High Definition Audio Driver Package - KB835221
Hotfix for Windows XP (KB952287)
hp LaserJet 1150 / 1300
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet for Wired Connections
Inter-Tel Collaboration Client 2.0
J2SE Runtime Environment 5.0 Update 6
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 11
Lexmark Software Uninstall
Linksys EasyLink Advisor 1.6 (0032)
LiveAdvisor (Symantec Corporation)
LiveUpdate
LogMeIn
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Office Live Meeting 2005
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office XP Professional with FrontPage
Microsoft Software Update for Web Folders (English) 12
Microsoft Visual C++ 2005 Redistributable
Move Networks Media Player for Internet Explorer
Mozilla ActiveX Control v1.7.12
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
NEWS 3 NOW
OmniPage Pro 12.0
OneTouch 4.0
Outlook OXtender 4.2.25
ScanSoft PaperPort 10
ScanSoft RealSpeak
ScrewDrivers Client v3
ScrewDrivers Client v4
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
Spybot - Search & Destroy 1.4
SUPERAntiSpyware Free Edition
Symantec WinFax PRO 10.0
Transcender Test Engine
Transcender: Exam Cert-220-601
Transcender: Exam Cert-220-602
Transcender: Exam Cert-220-603
Transcender: Exam Cert-70-271
Transcender: Exam Cert-70-272
Tweak UI
Update for 2007 Microsoft Office System (KB967642)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VideoLAN VLC media player 0.8.6d
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows XP Service Pack 3
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Zoom V.90 PCI Voice Faxmodem
==== Event Viewer Messages From Past Week ========
7/16/2009 12:21:55 PM, error: Service Control Manager [7034] - The LogMeIn service terminated unexpectedly. It has done this 1 time(s).
7/16/2009 1:33:50 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Internet Explorer 8 for Windows XP.
7/16/2009 1:32:34 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x8024002d: Office XP Service Pack 3.
7/16/2009 1:11:49 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 Fips intelppm SASDIFSV SASKUTIL
7/14/2009 12:50:29 PM, error: DCOM [10009] - DCOM was unable to communicate with the computer KZOO6 using any of the configured protocols.
7/13/2009 9:45:20 AM, error: System Error [1003] - Error code 1000000a, parameter1 ffffff94, parameter2 00000002, parameter3 00000000, parameter4 805340d5.
7/13/2009 12:59:13 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/13/2009 12:57:26 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
7/13/2009 12:38:12 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 Fips intelppm
7/10/2009 12:08:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde
7/10/2009 12:08:19 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
==== End Of File ===========================
Gmer Log
GMER 1.0.15.14972 -
http://www.gmer.netRootkit scan 2009-07-17 12:27:44
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.15 ----
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0xA78E9930]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateKey [0xA78F4A80]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0xA78E9F20]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0xA78F56E0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteValueKey [0xA78F5440]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0xA78F58B0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0xA78E9D70]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0xA78F6250]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0xA78F5CB0]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRestoreKey [0xA78F6080]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0xA78EA120]
SSDT \??\C:\WINDOWS\system32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetValueKey [0xA78F5140]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xA9086F20]
---- Devices - GMER 1.0.15 ----
Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 862A8190
Device \Driver\atapi \Device\Ide\IdePort0 862A8190
Device \Driver\atapi \Device\Ide\IdePort1 862A8190
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e 862A8190
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device \FileSystem\Fastfat \Fat A785ED20
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Threads - GMER 1.0.15 ----
Thread System [4:3288] 862DE170
Thread System [4:3424] 862C8F6F
Thread System [4:3228] 862FC4E7
Thread System [4:3296] 862CBBE1
Thread System [4:708] 862DE170
Thread System [4:2384] 862C8F6F
Thread System [4:3796] 862FC4E7
Thread System [4:3848] 862CBBE1
---- EOF - GMER 1.0.15 ----