This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Google redirection virus?

76 min read

This thread's last reply is from January 5, 2010, 8:06 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

chickshakes
December 17, 2009, 3:29 AM UTC
I think I have some sort of virus and I can't get rid of it. For a couple of weeks my computer has been redirecting me on occasion when I do a google search for sites or photos. I'm not sure why, but it will redirect me to pages I wasn't searching for. 'Ease of Access Center' now shows up on my computer login screen and in my control panel but it's not something I installed. This may sound minimal, but when I go to my start menu the color of the 'All Programs' menu changed from blue to red. Also, one of my folder icons changed from being just a folder icon to being a folder icon with the 2 heads on it. I'm not sure what any of this means and how to get rid of it, but I read the following post and it sounds like a similar situation: viewtopic.php?f=11&t=47975 I read through it and know now that I should delete all but one of my anti-virus software, but I'm not sure which one and I don't want to mess anything up more than it already is. Pls find below my HijackThis log and my uninstall log. Any help that anyone can offer would be REALLY appreciated. I'm sure we all know what it feels like to have a sick computer and it is anxiety inducing. Thanks in advance.
Tara


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:00:59 PM, on 12/16/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16916)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdSync.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
C:\Program Files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HP Print Clips - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [isCfgWiz] "c:\Program Files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe" -G:{77CCBE0B-A541-49a9-883E-14F8337EC861} -T:Config -REBOOT
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [ParetoLogic Anti-Virus PLUS] "C:\Program Files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.lnk" -NM -hidesplash
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ImpulseNow.lnk = C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe
O4 - Global Startup: Vongo Tray.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O13 - Gopher Prefix:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: plasservice (ZeppelinService) - ParetoLogic Inc. - C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe

--
End of file - 12947 bytes





UNINSTALL LOG
Acrobat.com
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Adobe Shockwave Player
AIM 6
AIM Toolbar 5.0
AppCore
Apple Mobile Device Support
Apple Software Update
Atheros Driver Installation Program
Bonjour
ccCommon
Choice Guard
Comcast High-Speed Internet Install Wizard
Compatibility Pack for the 2007 Office system
Component Framework
Conexant HD Audio
CyberLink YouCam
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
DVD Suite
EA Link
ESU for Microsoft Vista
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Experience Enhancements
HP Doc Viewer
HP Easy Setup - Frontend
HP Help and Support
HP Photosmart Essential 2.5
HP Quick Launch Buttons 6.30 E1
HP QuickPlay 3.6
HP QuickTouch 1.00 C4
HP Smart Web Printing
HP Total Care Advisor
HP Update
HP User Guides 0087
HP Wireless Assistant
HPNetworkAssistant
iTunes
Java(TM) 6 Update 2
Junk Mail filter update
LabelPrint
Last.fm 1.5.0.24910
LimeWire 5.3.6
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Basic Edition 2003
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.5)
MSCU for Microsoft Vista
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.1
My HP Games
Netflix Movie Viewer
NetWaiting
Norton AntiVirus
Norton AntiVirus Help
Norton Confidential Core
Norton Internet Security
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
NVIDIA Drivers
ObjectDock
Paint.NET v3.22
ParetoLogic Anti-Virus PLUS
PhotoPerfect 2.90
Power2Go
PowerDirector
QuickPlay SlingPlayer 0.4.4
QuickTime
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Slingbox Flash Tour
SlingPlayer
SPBBC 32bit
Spybot - Search & Destroy
Stardock Impulse
Stardock Impulse
Symantec Real Time Storage Protection Component
SymNet
Synaptics Pointing Device Driver
The Sims™ Life Stories
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VC80CRTRedist - 8.0.50727.762
Viewpoint Media Player
Vongo
WeatherBug Gadget
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Player Firefox Plugin
Yahoo! Toolbar
peku006
December 22, 2009, 12:43 PM UTC
Hello and welcome to Malware Removal.

My name is peku006 and I will be helping you to remove any infection(s) that you may have.
I will be giving you a series of instructions that need to be followed in the order in which I give them to you.

Please observe these rules while we work:

  • If you don't know or understand something please don't hesitate to ask
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • It is important that you reply to this thread. Do not start a new topic.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Absence of symptoms does not mean that everything is clear.


P2P Software

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

LimeWire

I'd like you to read P2P (Person to Person) File Sharing Programmes where this forum's policy is explained.

If you would like to continue, you must go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
Warning: Any existing remnants of the program may be removed during cleaning.

Make an uninstall list using HijackThis

To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:



5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply

Thanks peku006
chickshakes
December 22, 2009, 3:23 PM UTC
Hello,
I have deleted LimeWire and below is my new uninstall list. I will await your response.
Thanks in advance,
Tara


Acrobat.com
Acrobat.com
Activation Assistant for the 2007 Microsoft Office suites
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Adobe Shockwave Player
AIM 6
AIM Toolbar 5.0
AppCore
Apple Mobile Device Support
Apple Software Update
Atheros Driver Installation Program
Bonjour
ccCommon
Choice Guard
Comcast High-Speed Internet Install Wizard
Compatibility Pack for the 2007 Office system
Component Framework
Conexant HD Audio
CyberLink YouCam
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
DVD Suite
EA Link
ESU for Microsoft Vista
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Experience Enhancements
HP Doc Viewer
HP Easy Setup - Frontend
HP Help and Support
HP Photosmart Essential 2.5
HP Quick Launch Buttons 6.30 E1
HP QuickPlay 3.6
HP QuickTouch 1.00 C4
HP Smart Web Printing
HP Total Care Advisor
HP Update
HP User Guides 0087
HP Wireless Assistant
HPNetworkAssistant
iTunes
Java(TM) 6 Update 2
Junk Mail filter update
LabelPrint
Last.fm 1.5.0.24910
LiveUpdate (Symantec Corporation)
LiveUpdate (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Basic Edition 2003
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.5)
MSCU for Microsoft Vista
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
muvee autoProducer 6.1
My HP Games
Netflix Movie Viewer
NetWaiting
Norton AntiVirus
Norton AntiVirus Help
Norton Confidential Core
Norton Internet Security
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
NVIDIA Drivers
ObjectDock
Paint.NET v3.22
ParetoLogic Anti-Virus PLUS
PhotoPerfect 2.90
Power2Go
PowerDirector
QuickPlay SlingPlayer 0.4.4
QuickTime
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Slingbox Flash Tour
SlingPlayer
SPBBC 32bit
Spybot - Search & Destroy
Stardock Impulse
Stardock Impulse
Symantec Real Time Storage Protection Component
SymNet
Synaptics Pointing Device Driver
The Sims™ Life Stories
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VC80CRTRedist - 8.0.50727.762
Viewpoint Media Player
Vongo
WeatherBug Gadget
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
Windows Media Player Firefox Plugin
Yahoo! Toolbar
peku006
December 22, 2009, 4:29 PM UTC
Hi chickshakes

Have you bought Norton Internet Security ?

1 - download and run RSIT

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt<- (will be maximized) and info.txt<- (will be minimized)


2 - Status Check
Please reply with

the logs from RSIT (log.txt ,info.txt)

Thanks peku006
chickshakes
December 22, 2009, 4:58 PM UTC
Here is the requested information:

Logfile of random's system information tool 1.06 (written by random/random)
Run by [removed] at 2009-12-22 11:48:23
Microsoft® Windows Vista™ Home Premium
System drive C: has 137 GB (61%) free of 226 GB
Total RAM: 1982 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:37 AM, on 12/22/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16916)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdSync.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
C:\Program Files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\chickshakes\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\chickshakes.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: HP Print Clips - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [isCfgWiz] "c:\Program Files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe" -G:{77CCBE0B-A541-49a9-883E-14F8337EC861} -T:Config -REBOOT
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [ParetoLogic Anti-Virus PLUS] "C:\Program Files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.lnk" -NM -hidesplash
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: ImpulseNow.lnk = C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe
O4 - Global Startup: Vongo Tray.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\inethttpfilter.dll
O13 - Gopher Prefix:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: plasservice (ZeppelinService) - ParetoLogic Inc. - C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe

--
End of file - 13097 bytes

======Scheduled tasks folder======

C:\Windows\tasks\ParetoLogic Anti-Virus PLUS.job
C:\Windows\tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job
C:\Windows\tasks\ParetoLogic Registration.job
C:\Windows\tasks\ParetoLogic Update Version2.job
C:\Windows\tasks\User_Feed_Synchronization-{E60CA63E-D9D6-44AA-B631-867EE795316A}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-05-30 808472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll [2007-08-24 316784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Symantec Intrusion Prevention - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [2007-12-05 116088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C554162-8CB7-45A4-B8F4-8EA1C75885F9}]
AOL Toolbar Launcher - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [2007-10-10 1090912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7}]
HP Print Clips - c:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-08-31 177504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Show Norton Toolbar - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-24 316784]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2007-05-30 808472]
{DE9C389F-3316-41A7-809B-AA305ED9D922} - AIM Toolbar - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [2007-10-10 1090912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"=C:\Program Files\Synaptics\SynTP\SynTPStart.exe [2007-09-15 102400]
"QPService"=C:\Program Files\HP\QuickPlay\QPService.exe [2007-09-30 181544]
"QlbCtrl"=C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [2007-09-19 202032]
"OnScreenDisplay"=C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [2007-09-04 554320]
"UCam_Menu"=C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2007-08-17 218408]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-12-05 1006264]
"ccApp"=c:\Program Files\Common Files\Symantec Shared\ccApp.exe [2007-08-24 51048]
"isCfgWiz"=c:\Program Files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe [2007-08-24 607624]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2007-08-22 80896]
"HP Health Check Scheduler"=[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe []
"HP Software Update"=C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [2005-02-17 49152]
"hpWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [2007-09-13 480560]
"WAWifiMessage"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [2007-01-08 311296]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-02-01 385024]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-02-19 267048]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-12-04 13556256]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-12-04 92704]
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdSync.exe [2006-11-02 215552]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-12-03 1394000]
"ParetoLogic Anti-Virus PLUS"=C:\Program Files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.lnk [2009-12-16 1974]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Aim6"= []
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Vongo Tray.lnk - C:\Windows\Installer\{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe

C:\Users\chickshakes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
ImpulseNow.lnk - C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
Stardock ObjectDock.lnk - C:\Program Files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
""=""
"C:\Program Files\Vongo\VongoService.exe"="C:\Program Files\Vongo\VongoService.exe:*:enabled:VongoService"

======List of files/folders created in the last 2 months======

2009-12-22 11:48:23 ----DC---- C:\rsit
2009-12-16 21:55:16 ----DC---- C:\Program Files\Trend Micro
2009-12-16 21:45:55 ----DC---- C:\ProgramData\ParetoLogic Anti-Virus PLUS
2009-12-16 21:45:55 ----DC---- C:\ProgramData\ParetoLogic
2009-12-16 21:45:55 ----DC---- C:\Program Files\ParetoLogic
2009-12-16 21:45:55 ----DC---- C:\Program Files\Common Files\ParetoLogic
2009-12-12 13:24:27 ----DC---- C:\ProgramData\Spybot - Search & Destroy
2009-12-12 13:24:27 ----DC---- C:\Program Files\Spybot - Search & Destroy
2009-11-29 03:03:37 ----AC---- C:\Windows\system32\tzres.dll
2009-11-25 08:44:33 ----AC---- C:\Windows\system32\msxml6.dll
2009-11-25 08:44:32 ----AC---- C:\Windows\system32\msxml6r.dll
2009-11-25 08:44:32 ----AC---- C:\Windows\system32\msxml3r.dll
2009-11-25 08:44:32 ----AC---- C:\Windows\system32\msxml3.dll
2009-11-10 18:12:57 ----AC---- C:\Windows\system32\WSDApi.dll
2009-11-03 19:48:15 ----AC---- C:\Windows\system32\wups2.dll
2009-11-03 19:48:15 ----AC---- C:\Windows\system32\wucltux.dll
2009-11-03 19:48:15 ----AC---- C:\Windows\system32\wuauclt.exe
2009-11-03 19:48:14 ----AC---- C:\Windows\system32\wuaueng.dll
2009-11-03 19:47:21 ----AC---- C:\Windows\system32\wups.dll
2009-11-03 19:47:21 ----AC---- C:\Windows\system32\wudriver.dll
2009-11-03 19:47:21 ----AC---- C:\Windows\system32\wuapi.dll
2009-11-03 19:47:05 ----AC---- C:\Windows\system32\wuwebv.dll
2009-11-03 19:47:05 ----AC---- C:\Windows\system32\wuapp.exe
2009-11-02 19:23:14 ----AC---- C:\Windows\system32\mshtml.dll
2009-10-23 19:21:27 ----DC---- C:\Users\chickshakes\AppData\Roaming\Malwarebytes
2009-10-23 19:21:20 ----DC---- C:\ProgramData\Malwarebytes
2009-10-23 19:21:20 ----DC---- C:\Program Files\Malwarebytes' Anti-Malware

======List of files/folders modified in the last 2 months======

2009-12-22 11:48:33 ----DC---- C:\Windows\Prefetch
2009-12-22 11:48:26 ----DC---- C:\Windows\Temp
2009-12-22 10:12:41 ----SHD---- C:\System Volume Information
2009-12-22 10:03:54 ----RDC---- C:\Program Files
2009-12-16 21:58:03 ----DC---- C:\Program Files\Mozilla Firefox
2009-12-16 21:52:54 ----DC---- C:\Windows\system32\Tasks
2009-12-16 21:52:53 ----DC---- C:\Windows\Tasks
2009-12-16 21:52:52 ----DC---- C:\Windows\system32\drivers
2009-12-16 21:46:59 ----DC---- C:\Windows\System32
2009-12-16 21:46:42 ----SHDC---- C:\Windows\Installer
2009-12-16 21:46:32 ----DC---- C:\Windows\system32\catroot
2009-12-16 21:45:55 ----HDC---- C:\ProgramData
2009-12-16 21:45:55 ----DC---- C:\Program Files\Common Files
2009-12-16 21:44:30 ----DC---- C:\Windows\inf
2009-12-16 21:44:30 ----AC---- C:\Windows\system32\PerfStringBackup.INI
2009-12-08 20:17:41 ----D---- C:\Windows\winsxs
2009-12-08 20:16:22 ----DC---- C:\Windows\system32\catroot2
2009-12-06 14:52:50 ----DC---- C:\ProgramData\Microsoft Help
2009-12-05 12:15:54 ----DC---- C:\Users\chickshakes\AppData\Roaming\Stardock
2009-11-29 18:39:08 ----D---- C:\Windows\rescache
2009-11-29 03:06:05 ----DC---- C:\Windows\system32\en-US
2009-11-29 03:02:16 ----DC---- C:\Windows
2009-11-15 03:04:03 ----AC---- C:\Windows\win.ini
2009-11-08 03:09:08 ----RSDC---- C:\Windows\assembly
2009-11-08 03:07:25 ----RSDC---- C:\Windows\Fonts
2009-11-08 03:07:23 ----DC---- C:\Program Files\Common Files\microsoft shared
2009-11-06 07:35:08 ----DC---- C:\Users\chickshakes\AppData\Roaming\LimeWire
2009-11-02 20:42:06 ----C---- C:\Windows\system32\MpSigStub.exe
2009-10-27 17:21:13 ----AC---- C:\symlcsv1.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2007-09-14 395312]
R1 KLIF;KLIF; C:\Windows\system32\DRIVERS\klif.sys [2009-02-18 127768]
R1 SRTSP;SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [2007-07-30 278576]
R1 SRTSPX;SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [2007-07-30 43696]
R1 SYMTDI;SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [2007-08-13 188464]
R2 CO_Mon;CO_Mon; \??\C:\Windows\system32\drivers\CO_Mon.sys [2007-08-08 36056]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-18 12672]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-02-24 39936]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-01-23 42496]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-03-22 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2007-07-10 8704]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-05-30 735232]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2006-11-02 14208]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-09-14 112688]
R3 GEARAspiWDM;GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664]
R3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDART.sys [2007-09-09 176640]
R3 HpqKbFiltr;HpqKbFilter Driver; C:\Windows\system32\DRIVERS\HpqKbFiltr.sys [2007-06-18 16768]
R3 HpqRemHid;HP Remote Control HID Device; C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 7168]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2007-06-20 984064]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2007-06-20 208896]
R3 NAVENG;NAVENG; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070914.008\NAVENG.SYS [2007-09-14 81232]
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070914.008\NAVEX15.SYS [2007-09-14 865904]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-03-06 1059112]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-12-04 7606688]
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-16 12032]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2007-12-05 82432]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2007-12-05 123952]
R3 SymIMMP;SymIMMP; C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 31280]
R3 SYMREDRV;SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [2007-08-13 22320]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-09-15 191408]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2007-12-06 132864]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2007-06-20 660480]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2006-11-02 11264]
S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-11-02 464384]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 HSFHWAZL;HSFHWAZL; C:\Windows\system32\DRIVERS\VSTAZL3.SYS [2006-11-02 200704]
S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-18 1380864]
S3 IDSvix86;Symantec Intrusion Prevention Driver; \??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\ipsdefs\20070823.002\IDSvix86.sys [2007-08-15 180272]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [2007-08-17 446512]
S3 SRTSPL;SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [2007-07-30 317616]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\Windows\system32\DRIVERS\SymIM.sys [2007-08-09 31280]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-01-15 30464]
S3 usbbus;LGE Mobile Composite USB Device; C:\Windows\system32\DRIVERS\lgusbbus.sys [2005-05-26 21344]
S3 winusb;WinUSB Service; C:\Windows\system32\DRIVERS\winusb.sys [2006-11-02 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-07 611664]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-01-15 110592]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
R2 ccEvtMgr;Symantec Event Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-08-24 149864]
R2 ccSetMgr;Symantec Settings Manager; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-08-24 149864]
R2 CLTNetCnService;Symantec Lic NetConnect service; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-08-24 149864]
R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-09-19 65536]
R2 hpqwmiex;hpqwmiex; C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [2006-05-02 135168]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-08-23 79136]
R2 LiveUpdate Notice;LiveUpdate Notice; c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2007-08-24 149864]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-12-04 203296]
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS); C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [2007-09-30 271760]
R2 QPSched;QuickPlay Task Scheduler (QTS); C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [2007-09-30 112016]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-01-09 272024]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2007-07-10 386560]
R2 ZeppelinService;plasservice; C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe [2009-02-18 587216]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-02-19 504104]
R3 Symantec Core LC;Symantec Core LC; C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe [2007-12-05 1245064]
S3 Com4Qlb;Com4Qlb; C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe [2007-03-05 110592]
S3 comHost;COM Host; c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe [2007-08-22 55640]
S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2007-07-23 181800]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LiveUpdate;LiveUpdate; c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE [2007-08-23 3192184]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Vongo Service;Vongo Service; C:\Program Files\Vongo\VongoService.exe [2007-08-31 176128]
S4 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-08-23 243064]

-----------------EOF-----------------


info.txt logfile of random's system information tool 1.06 2009-12-22 11:48:43

======Uninstall list======

-->"C:\Program Files\HP Games\3D Ultra Minigolf Adventures\Uninstall.exe"
-->"C:\Program Files\HP Games\7 Wonders of the Ancient World\Uninstall.exe"
-->"C:\Program Files\HP Games\Bejeweled 2 Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 2 Revolution\Uninstall.exe"
-->"C:\Program Files\HP Games\Blasterball 3\Uninstall.exe"
-->"C:\Program Files\HP Games\Chuzzle Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Crystal Maze\Uninstall.exe"
-->"C:\Program Files\HP Games\Diner Dash\Uninstall.exe"
-->"C:\Program Files\HP Games\FATE\Uninstall.exe"
-->"C:\Program Files\HP Games\Final Drive Nitro\Uninstall.exe"
-->"C:\Program Files\HP Games\Fish Tycoon\Uninstall.exe"
-->"C:\Program Files\HP Games\Insaniquarium Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Jewel Quest Solitaire\Uninstall.exe"
-->"C:\Program Files\HP Games\Jewel Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\Magic Academy\Uninstall.exe"
-->"C:\Program Files\HP Games\Mah Jong Quest\Uninstall.exe"
-->"C:\Program Files\HP Games\My HP Game Console\Uninstall.exe"
-->"C:\Program Files\HP Games\Otto's Magic Blocks\Uninstall.exe"
-->"C:\Program Files\HP Games\Peggle\Uninstall.exe"
-->"C:\Program Files\HP Games\Penguins!\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Bowler\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer Pineapple Cup\Uninstall.exe"
-->"C:\Program Files\HP Games\Polar Golfer\Uninstall.exe"
-->"C:\Program Files\HP Games\Ricochet Lost Worlds\Uninstall.exe"
-->"C:\Program Files\HP Games\Shooting Stars Pool\Uninstall.exe"
-->"C:\Program Files\HP Games\Slingo Deluxe\Uninstall.exe"
-->"C:\Program Files\HP Games\Super Granny\Uninstall.exe"
-->"C:\Program Files\HP Games\Tradewinds\Uninstall.exe"
-->"C:\Program Files\HP Games\Virtual Villagers - A New Home\Uninstall.exe"
-->"C:\Program Files\HP Games\Virtual Villagers - Chapter 2 - The Lost Children\Uninstall.exe"
-->"C:\Program Files\HP Games\Zuma Deluxe\Uninstall.exe"
-->"c:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
-->C:\Program Files\Conexant\SmartAudio\SETUP.EXE -U -ISmartAudio -SM=SMAUDIO.EXE,1801
-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
Acrobat.com-->msiexec /qb /x {6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Acrobat.com-->MsiExec.exe /I{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Adobe Shockwave Player-->MsiExec.exe /X{1BDC9633-895B-4842-BCB6-8FA1EC2A3C5A}
AIM 6-->C:\Program Files\AIM6\uninst.exe
AIM Toolbar 5.0-->"C:\Program Files\AOL\AIM Toolbar 5.0\uninstall.exe"
AppCore-->MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
Apple Mobile Device Support-->MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Atheros Driver Installation Program-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x9 -removeonly
Bonjour-->MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
ccCommon-->MsiExec.exe /I{B24E05CC-46FF-4787-BBB8-5CD516AFB118}
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Comcast High-Speed Internet Install Wizard-->C:\Program Files\support.com\uninstall\chsi_uninstaller.exe
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Component Framework-->MsiExec.exe /I{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}
Conexant HD Audio-->C:\Program Files\CONEXANT\CNXT_AUDIO_HDA\UIU32a.exe -U -IQh30CFza.INF
CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\setup.exe" /z-uninstall
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DVD Suite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
EA Link-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{F5577101-33CC-4711-8235-3A95BCD49DB0} /l1033
ESU for Microsoft Vista-->MsiExec.exe /I{68471BF2-F1F7-4C89-BBBA-400B94996596}
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)-->C:\PROGRA~1\WinTV\UNSftMCE.EXE C:\PROGRA~1\WinTV\softMCE.LOG
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDA_HSF\UIU32m.exe -U -I*.INF
Hewlett-Packard Active Check-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Hewlett-Packard Asset Agent for Health Check-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Experience Enhancements-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BD0E2B92-3814-46F0-893B-4612EA010C7E}\setup.exe" -l0x9 -removeonly
HP Doc Viewer-->MsiExec.exe /I{082702D5-5DD8-4600-BCE5-48B15174687F}
HP Easy Setup - Frontend-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9885A11E-60E4-417C-B58B-8B31B21C0B8A}\setup.exe" -l0x9 -removeonly
HP Help and Support-->MsiExec.exe /I{28EDCE9C-3304-4331-8AB3-F3EBE94C35B4}
HP Photosmart Essential 2.5-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Quick Launch Buttons 6.30 E1-->C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\setup.exe -runfromtemp -l0x0009 uninst
HP QuickPlay 3.6-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP QuickTouch 1.00 C4-->MsiExec.exe /I{7DC4A410-9986-4329-9E5D-687B2C42CA39}
HP Smart Web Printing-->msiexec /i{082F8ABA-84D5-4837-9DFC-F365D91A07D4}
HP Total Care Advisor-->MsiExec.exe /X{b02df929-29a7-4fd2-9a70-81a644b635f7}
HP Update-->MsiExec.exe /X{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}
HP User Guides 0087-->MsiExec.exe /I{4D49757C-367A-4333-BDB3-68966162B14E}
HP Wireless Assistant-->MsiExec.exe /I{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}
HPNetworkAssistant-->MsiExec.exe /I{228C6B46-64E2-404E-898A-EF0830603EF4}
iTunes-->MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.exe" -uninstall
Last.fm 1.5.0.24910-->"C:\Program Files\Last.fm\unins000.exe"
LiveUpdate (Symantec Corporation)-->MsiExec.exe /x {E80F62FF-5D3C-4A19-8409-9721F2928206} /l*v "c:\ProgramData\LuUninstall.LiveUpdate"
LiveUpdate (Symantec Corporation)-->MsiExec.exe /X{E80F62FF-5D3C-4A19-8409-9721F2928206}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office Basic Edition 2003-->MsiExec.exe /I{91130409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Home and Student 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall HOMESTUDENTR /dll OSETUP.DLL
Microsoft Office Home and Student 2007-->MsiExec.exe /X{91120000-002F-0000-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0120-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint Viewer 2007 (English)-->MsiExec.exe /X{95120000-00AF-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}
Mozilla Firefox (3.5.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSCU for Microsoft Vista-->MsiExec.exe /I{F7F3B252-E772-48AA-93EB-7964BC326067}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
muvee autoProducer 6.1-->C:\Program Files\InstallShield Installation Information\{250E9609-E830-43EB-B379-DAB7546A2422}\muveesetup.exe -removeonly -runfromtemp
My HP Games-->"C:\Program Files\HP Games\Uninstall.exe"
Netflix Movie Viewer-->MsiExec.exe /X{BCE72AED-3332-4863-9567-C5DCB9052CA2}
NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
Norton AntiVirus Help-->MsiExec.exe /I{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}
Norton AntiVirus-->MsiExec.exe /X{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}
Norton Confidential Core-->MsiExec.exe /I{55A6283C-638A-4EE0-B491-51118554BDA2}
Norton Internet Security (Symantec Corporation)-->"C:\Program Files\Common Files\Symantec Shared\SymSetup\{C1C185CA-C531-49F5-A6FA-B838405A049D}_15_0_0_60\Setup.exe" /X
Norton Internet Security-->MsiExec.exe /I{3672B097-EA69-4BFE-B92F-29AE6D9D2B34}
Norton Internet Security-->MsiExec.exe /I{C1C185CA-C531-49F5-A6FA-B838405A049D}
Norton Protection Center-->MsiExec.exe /I{62120008-8E1E-4807-860D-A8B48F8552DB}
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
ObjectDock-->"C:\Program Files\Stardock\Object Desktop\ObjectDock\UninstHelper.exe" /autouninstall odk
Paint.NET v3.22-->MsiExec.exe /X{96C267DA-0926-4C11-B4E7-4D3EF85130D0}
ParetoLogic Anti-Virus PLUS-->MsiExec.exe /I{80B744FE-8712-4D44-A239-EBB7B8979F7E}
PhotoPerfect 2.90-->"C:\Program Files\PhotoPerfect\unins000.exe"
Power2Go-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe" -uninstall
PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall
QuickPlay SlingPlayer 0.4.4-->"C:\Program Files\HP\QuickPlay\unins000.exe"
QuickTime-->MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\setup.exe" -l0x9 anything
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Slingbox Flash Tour-->MsiExec.exe /I{38EAC694-0D90-445F-8C17-8B50ADFE3162}
SlingPlayer-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe /M{004B0DCB-4C60-465B-8F01-44B0A4111187} /l1033
SPBBC 32bit-->MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Stardock Impulse-->"C:\ProgramData\{62902F53-D725-44F9-B385-979CC0E00E8A}\shareware.exe" REMOVE=TRUE MODIFY=FALSE
Stardock Impulse-->C:\ProgramData\{62902F53-D725-44F9-B385-979CC0E00E8A}\shareware.exe
Symantec Real Time Storage Protection Component-->MsiExec.exe /I{D6E6FA4A-5445-4850-8365-CF216C1CBB7A}
SymNet-->MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
The Sims™ Life Stories-->MsiExec.exe /I{2284D904-C138-4B58-93EC-5C362AB5130A}
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Vongo-->MsiExec.exe /X{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}
WeatherBug Gadget-->MsiExec.exe /I{209CDA54-D390-46A2-A97C-7BF61734418D}
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{C6CA8874-5F22-4AF0-9BE3-016BF299C536}
Windows Live Mail-->MsiExec.exe /I{63C1109E-D977-49ED-BCE3-D00D0BF187D6}
Windows Live Messenger-->MsiExec.exe /X{0AAA9C97-74D4-47CE-B089-0B147EF3553C}
Windows Live Sign-in Assistant-->MsiExec.exe /I{9422C8EA-B0C6-4197-B8FC-DC797658CA00}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\unyt.exe

======Security center information======

AV: Norton Internet Security (outdated)
FW: Norton Internet Security (disabled)
AS: Spybot - Search and Destroy (outdated)
AS: Windows Defender
AS: Norton Internet Security (outdated)

======System event log======

Computer Name: chickshakes-PC
Event Code: 51
Message: An error was detected on device \Device\CdRom0 during a paging operation.
Record Number: 196475
Source Name: cdrom
Time Written: 20091222151849.533000-000
Event Type: Warning
User:

Computer Name: chickshakes-PC
Event Code: 31004
Message: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
Record Number: 196481
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20091222152145.000000-000
Event Type: Error
User:

Computer Name: chickshakes-PC
Event Code: 31004
Message: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
Record Number: 196483
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20091222164103.000000-000
Event Type: Error
User:

Computer Name: chickshakes-PC
Event Code: 1003
Message: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001F3A002624. The following error occurred:
The operation was canceled by the user.. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Record Number: 196484
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20091222164105.000000-000
Event Type: Warning
User:

Computer Name: chickshakes-PC
Event Code: 31004
Message: The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
Record Number: 196485
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20091222164105.000000-000
Event Type: Error
User:

=====Application event log=====

Computer Name: chickshakes-PC
Event Code: 1008
Message: The Open Procedure for service "DFSR" in DLL "C:\Windows\System32\DfsrPerf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
Record Number: 18038
Source Name: Microsoft-Windows-Perflib
Time Written: 20091217024541.000000-000
Event Type: Error
User:

Computer Name: chickshakes-PC
Event Code: 1010
Message: The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.
Record Number: 18039
Source Name: Microsoft-Windows-Perflib
Time Written: 20091217024542.000000-000
Event Type: Error
User:

Computer Name: chickshakes-PC
Event Code: 1005
Message: Unable to locate the open procedure "OpenIPSecPerformanceData" in DLL "C:\Windows\System32\ipsecsvc.dll" for the "PolicyAgent" service. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
Record Number: 18040
Source Name: Microsoft-Windows-Perflib
Time Written: 20091217024543.000000-000
Event Type: Error
User:

Computer Name: chickshakes-PC
Event Code: 1017
Message: Disabled performance counter data collection from the "PolicyAgent" service because the performance counter library for that service has generated one or more errors. The errors that forced this action have been written to the application event log. Correct the errors before enabling the performance counters for this service.
Record Number: 18041
Source Name: Microsoft-Windows-Perflib
Time Written: 20091217024543.000000-000
Event Type: Error
User:

Computer Name: chickshakes-PC
Event Code: 1000
Message: Faulting application symlcsvc.exe, version 1.9.1.1249, time stamp 0x46ca75f3, faulting module symlcnet.dll, version 1.9.1.1249, time stamp 0x46ca75b7, exception code 0xc0000005, fault offset 0x00010d44, process id 0x1370, application start time 0x01ca7ebd340eae37.
Record Number: 18062
Source Name: Application Error
Time Written: 20091221015652.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: chickshakes-PC
Event Code: 4904
Message: An attempt was made to register a security event source.

Subject :
Security ID: S-1-5-18
Account Name: CHICKSHAKES-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Process:
Process ID: 0x1558
Process Name: C:\Windows\System32\VSSVC.exe

Event Source:
Source Name: VSSAudit
Event Source ID: 0x269f600
Record Number: 20857
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091222151406.458000-000
Event Type: Audit Success
User:

Computer Name: chickshakes-PC
Event Code: 4905
Message: An attempt was made to unregister a security event source.

Subject
Security ID: S-1-5-18
Account Name: CHICKSHAKES-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Process:
Process ID: 0x1558
Process Name: C:\Windows\System32\VSSVC.exe

Event Source:
Source Name: VSSAudit
Event Source ID: 0x269f600
Record Number: 20858
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091222151406.458000-000
Event Type: Audit Success
User:

Computer Name: chickshakes-PC
Event Code: 5032
Message: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Error Code: 2
Record Number: 20859
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091222164106.081000-000
Event Type: Audit Failure
User:

Computer Name: chickshakes-PC
Event Code: 5032
Message: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Error Code: 2
Record Number: 20860
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091222164106.081000-000
Event Type: Audit Failure
User:

Computer Name: chickshakes-PC
Event Code: 5032
Message: Windows Firewall was unable to notify the user that it blocked an application from accepting incoming connections on the network.

Error Code: 2
Record Number: 20861
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091222164106.081000-000
Event Type: Audit Failure
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\CyberLink\Power2Go\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 104 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6802
"NUMBER_OF_PROCESSORS"=2
"PLATFORM"=MCD
"PCBRAND"=Pavilion
"OnlineServices"=Online Services
"USERPART"=E:
"CLASSPATH"=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip

-----------------EOF-----------------






Also, I just realized that my e-mail sent out the below message last night to all of my contacts without my knowledge. I will await your reply.
Thanks,
T



The Christmas is coming!
    looking for some crazy gifts for your family,For your friends and your customer,all products of our company;Computers, Televisions,Cell Phones,MP3/MP4 Players,Digital Cameras,
Camcorders,Video Games Consoles,GPS and Motorcycles,most items are sold at wholesale prices, you will find lots of great bargains here. And we have a sales promotion from now on,buy more, save more and get more!Please contact we.
The website is: _www.egouc.com_
I hope you can enjoy it for shopping!
E-mail:[removed]
MSN   :[removed]
  Happy your family and your business.
peku006
December 22, 2009, 5:51 PM UTC
Hi chickshakes

1 - Disable Spybot's TeaTimer. This is a two step process.
First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For Either Version :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go To the bottom of the Vertical Panel on the Left, Click Tools
  • then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.


2 - Remove bad HijackThis entries
  • Run HijackThis
  • Click on the Scan button
  • Put a check beside all of the items listed below (if present):

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

  • Close all open windows and browsers/email, etc...

    3- Run Malwarebytes' Anti-Malware

    • Open Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Check for Updates
    • After the update have been completed, Select the Scanner tab.
    • On the Scanner tab:
      • Make sure the "Perform Full Scan" option is selected.
      • Then click on the Scan button.
    • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
    • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
    • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
    • Click OK to close the message box and continue with the removal process.
    • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
    • Make sure that everything is checked, and click Remove Selected.
    • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
    • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
    • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

4 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

5 - Status Check
Please reply with

1. the Malwarebytes' Anti-Malware Log
2. a fresh HijackThis log
description of any problems you are having with your PC

Thanks peku006
chickshakes
December 22, 2009, 7:02 PM UTC
Steps one and two are complete. During the scan in step 3, Malwarebytes popped up with a message that says it has stopped working. It gave me an option to either search the internet for a reason or to close. I closed it and restarted the scan. This happened again and it was in the middle of scanning the following item when it stopped:
C:\Program Files\AIM6\services\boxely Toolkit\ver2_5_5_1\content\core

Pls advise how to proceed.
Ty
peku006
December 22, 2009, 7:27 PM UTC
Hi chickshakes

1 - Download and Run ComboFix

We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here.

When finished, it will produce a log for you
Please include the C:\ComboFix.txt in your next reply for further review.

2 - Status Check
Please reply with

1. the ComboFix log(C:\ComboFix.txt)

Thanks peku006
chickshakes
December 22, 2009, 8:56 PM UTC
Pls find below.
Ty

ComboFix 09-12-21.08 - chickshakes 12/22/2009 15:18:54.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1982.858 [GMT -5:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2580806079-989220257-3569232-500
c:\$recycle.bin\S-1-5-21-747642811-3982433225-4087218088-500
c:\users\chickshakes\AppData\Local\{04F7F5BB-6C00-4A56-A3BE-712B51F1DEAD}
c:\users\chickshakes\AppData\Local\{04F7F5BB-6C00-4A56-A3BE-712B51F1DEAD}\chrome.manifest
c:\users\chickshakes\AppData\Local\{04F7F5BB-6C00-4A56-A3BE-712B51F1DEAD}\chrome\content\_cfg.js
c:\users\chickshakes\AppData\Local\{04F7F5BB-6C00-4A56-A3BE-712B51F1DEAD}\chrome\content\overlay.xul
c:\users\chickshakes\AppData\Local\{04F7F5BB-6C00-4A56-A3BE-712B51F1DEAD}\install.rdf
c:\windows\system32\KBL.LOG

.
((((((((((((((((((((((((( Files Created from 2009-11-22 to 2009-12-22 )))))))))))))))))))))))))))))))
.

2009-12-22 20:32 . 2009-12-22 20:34 -------- dc----w- c:\users\chickshakes\AppData\Local\temp
2009-12-22 20:32 . 2009-12-22 20:32 -------- dc----w- c:\users\Default\AppData\Local\temp
2009-12-22 16:48 . 2009-12-22 16:48 -------- dc----w- C:\rsit
2009-12-17 02:55 . 2009-12-17 02:55 -------- dc----w- c:\program files\Trend Micro
2009-12-17 02:52 . 2009-12-22 20:22 874528 -csha-w- c:\windows\system32\drivers\fidbox.dat
2009-12-17 02:45 . 2009-12-17 02:45 -------- dc----w- c:\programdata\ParetoLogic Anti-Virus PLUS
2009-12-17 02:45 . 2009-12-17 02:45 -------- dc----w- c:\programdata\ParetoLogic
2009-12-17 02:45 . 2009-12-17 02:45 -------- dc----w- c:\program files\ParetoLogic
2009-12-17 02:45 . 2009-12-17 02:45 -------- dc----w- c:\program files\Common Files\ParetoLogic
2009-12-12 18:24 . 2009-12-12 21:35 -------- dc----w- c:\programdata\Spybot - Search & Destroy
2009-12-12 18:24 . 2009-12-12 18:24 -------- dc----w- c:\program files\Spybot - Search & Destroy
2009-12-06 19:52 . 2009-12-06 19:52 -------- dc----w- c:\users\chickshakes\AppData\Local\Microsoft Help
2009-11-29 08:03 . 2009-10-29 07:59 2048 -c--a-w- c:\windows\system32\tzres.dll
2009-11-25 13:44 . 2009-08-10 13:05 1406464 -c--a-w- c:\windows\system32\msxml6.dll
2009-11-25 13:44 . 2009-08-10 13:05 2048 -c--a-w- c:\windows\system32\msxml6r.dll
2009-11-25 13:44 . 2009-08-10 13:05 2048 -c--a-w- c:\windows\system32\msxml3r.dll
2009-11-25 13:44 . 2009-08-10 13:05 1260032 -c--a-w- c:\windows\system32\msxml3.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-22 20:07 . 2009-12-22 20:07 125952 -c--a-w- c:\programdata\ParetoLogic\UUS2\Temp\Update.exe
2009-12-22 19:33 . 2009-12-17 02:52 10040 -csha-w- c:\windows\system32\drivers\fidbox.idx
2009-12-22 19:25 . 2009-02-15 18:27 28409 -c--a-w- c:\programdata\nvModes.dat
2009-12-22 18:21 . 2009-10-24 00:21 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-17 01:36 . 2009-12-17 01:36 4844296 -c--a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-16 04:59 . 2008-02-15 00:53 6944 -c--a-w- c:\users\chickshakes\AppData\Local\d3d9caps.dat
2009-12-08 00:25 . 2008-02-13 14:05 76960 -c--a-w- c:\users\chickshakes\AppData\Local\GDIPFONTCACHEV1.DAT
2009-12-06 19:52 . 2007-12-06 04:46 -------- dc----w- c:\programdata\Microsoft Help
2009-12-05 17:15 . 2009-05-07 03:02 -------- dc----w- c:\users\chickshakes\AppData\Roaming\Stardock
2009-12-03 21:14 . 2009-10-24 00:21 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 21:13 . 2009-10-24 00:21 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-11-06 12:35 . 2008-02-14 02:46 -------- dc----w- c:\users\chickshakes\AppData\Roaming\LimeWire
2009-11-03 01:42 . 2009-10-02 23:48 195456 -c----w- c:\windows\system32\MpSigStub.exe
2009-10-27 22:21 . 2008-04-30 00:56 58736 -c--a-w- C:\symlcsv1.exe
2009-10-24 00:21 . 2009-10-24 00:21 -------- dc----w- c:\users\chickshakes\AppData\Roaming\Malwarebytes
2009-10-24 00:21 . 2009-10-24 00:21 -------- dc----w- c:\programdata\Malwarebytes
2009-10-23 23:50 . 2009-10-22 00:37 0 -c--a-w- c:\users\chickshakes\AppData\Local\Isajazukohoma.bin
2009-10-23 23:50 . 2009-10-22 00:37 120 -c--a-w- c:\users\chickshakes\AppData\Local\Etidacupodovuje.dat
2009-10-08 03:00 . 2009-10-08 03:00 86016 -c--a-w- c:\programdata\NOS\Adobe_Downloads\arh.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-10-01 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-12-06 1006264]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-08-25 51048]
"isCfgWiz"="c:\program files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe" [2007-08-24 607624]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-23 80896]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-02-01 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-12-03 1394000]
"ParetoLogic Anti-Virus PLUS"="c:\program files\ParetoLogic\Anti-Virus PLUS\Pareto_AV.lnk" [2009-12-17 1974]

c:\users\chickshakes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ImpulseNow.lnk - c:\program files\Stardock\Impulse\Now\ImpulseNow.exe [2009-4-7 323584]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]
Stardock ObjectDock.lnk - c:\program files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe [2009-5-6 3446512]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Vongo Tray.lnk - c:\windows\Installer\{8C3AE2D1-854D-4650-A73D-C7CC7EE36B80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe [2007-12-6 53248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [8/24/2007 10:07 PM 149864]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [12/12/2009 1:24 PM 1153368]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2/24/2008 11:33 PM 24652]
R2 ZeppelinService;plasservice;c:\program files\Common Files\ParetoLogic\PLAS\plasservice.exe [2/18/2009 2:40 PM 587216]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/5/2007 11:04 PM 112688]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [10/23/2009 7:21 PM 38224]
S3 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20070823.002\IDSvix86.sys [12/5/2007 10:15 PM 180272]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
*NewlyCreated* - MBAMSWISSARMY

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-24 01:34 451872 -c--a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
------- Supplementary Scan -------
.
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\INetHTTPFilter.dll
FF - ProfilePath - c:\users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/defaulta.aspx
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-22 15:33
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-12-22 15:41:23
ComboFix-quarantined-files.txt 2009-12-22 20:41

Pre-Run: 140,779,249,664 bytes free
Post-Run: 140,745,285,632 bytes free

- - End Of File - - 9465FBF478B372A2F16270F4C7336F37
peku006
December 23, 2009, 8:19 AM UTC
Hi chickshakes

1 - Run Malwarebytes' Anti-Malware

  • Open Malwarebytes' Anti-Malware
  • Select the Update tab
  • Click Check for Updates
  • After the update have been completed, Select the Scanner tab.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

3 - Run Hijackthis
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad

4 - Status Check
Please reply with


1. the Malwarebytes' Anti-Malware Log
2. a fresh HijackThis log

Thanks peku006
chickshakes
December 24, 2009, 9:53 PM UTC
Unfortunately when trying to run Malwarebytes my computer keeps stopping the program.
Here is the message I get:
Malwarebytes' Anti-Malware has stoppe dworking
Windows can check online for a solution to the problem.
Check online for a solution adn close the program
Cloe the program

Problem Signature:
Proplem Even Name: APPCRASH
App Name: mbam.exe
App Version: 1.42.0.0
App Timestamp 4b18370a
Fault Module Name: USP10.dll
Fault Module Version: 1.626.6000.16386
Fault module Timestamp: 4549bde3
Exception Code: c00000006
Exception offset: 0000c503
OS Version: 6.0.6000.2.0.0.768.3
Locale ID: 1033
Additional Info 1: 70b7
Additional Info 2: 3483ee7121a16207a349322c091b709d
Additional Info 3: 9b15
Additional Info 4: a84d6f6a62e77c02cbab662937e0d8b5

After scanning it several times, it always stops while scanning the following item:
C:\Program Files\AIM6|services|boxelyToolkit\ver2_5_5_1\content|core

Will be away from my computer until 12/26 but will await your reply until then.
Thank you and happy holidays.
Tara
peku006
December 26, 2009, 8:50 AM UTC
Hi Tara

  • Download RootRepeal from the following location and save it to your desktop.
    • Link 1
    • Link 2
    • Link 3
  • Unzip it to your Desktop
  • Double click RootRepeal.exe to start the program
  • Click on the Report tab at the bottom of the program window
  • Click the Scan button
  • In the Select Scan dialog, check:
    • Drivers
    • Files
    • Processes
    • SSDT
    • Stealth Objects
    • Hidden Services
    • Shadow SSDT
  • Click the OK button
  • Check the box for your main system drive (Usually C:), and Click OK to start the scan

    The scan can take some time. DO NOT run any other programs while the scan is running
  • When the scan is complete, the Save Report button will become available
  • Click this and save the report to your Desktop as RootRepeal.txt
  • Go to File, then Exit to close the program


Thanks peku006
chickshakes
December 27, 2009, 3:36 AM UTC
Hey Peku006,
Unfortunately, this didn't work either.
Upon opening the file, I get this error:
22:25:25: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000dc)
22:25:26: DeviceIoControl Error! Error Code = 0x1e7
22:25:26: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000dc)

After opening up and going to the Report tab and clicking Scan and selecting the scan dialogue, I get the following error:
22:31:40: DeviceIoControl Error! Error Code = 0x0
22:31:40: DeviceIoControl Error! Error Code = 0x0
22:31:40: DeviceIoControl Error! Error Code = 0x0
22:31:40: DeviceIoControl Error! Error Code = 0x0
22:31:40: DeviceIoControl Error! Error Code = 0x0
22:31:40: DeviceIoControl Error! Error Code = 0x0
22:31:40: Could not scan drive C (error 0xc0000024)
22:31:43: Could not get the name for PID 4.
22:31:43: Could not get the name for PID 480.
22:31:43: Could not get the name for PID 556.
22:31:43: Could not get the name for PID 608.
22:31:43: Could not get the name for PID 616.
22:31:43: Could not get the name for PID 652.
22:31:43: Could not get the name for PID 668.
22:31:43: Could not get the name for PID 676.
22:31:43: Could not get the name for PID 720.
22:31:43: Could not get the name for PID 860.
22:31:43: Could not get the name for PID 900.
22:31:43: Could not get the name for PID 928.
22:31:43: Could not get the name for PID 964.
22:31:43: Could not get the name for PID 1020.
22:31:43: Could not get the name for PID 1048.
22:31:43: Could not get the name for PID 1060.
22:31:43: Could not get the name for PID 1148.
22:31:43: Could not get the name for PID 1172.
22:31:43: Could not get the name for PID 1224.
22:31:43: Could not get the name for PID 1372.
22:31:43: Could not get the name for PID 1476.
22:31:43: Could not get the name for PID 1856.
22:31:43: Could not get the name for PID 2036.
22:31:43: Could not get the name for PID 2044.
22:31:43: Could not get the name for PID 364.
22:31:43: Could not get the name for PID 1364.
22:31:43: Could not get the name for PID 1736.
22:31:43: Could not get the name for PID 1300.
22:31:43: Could not get the name for PID 1580.
22:31:43: Could not get the name for PID 1948.
22:31:43: Could not get the name for PID 2068.
22:31:43: Could not get the name for PID 2384.
22:31:43: Could not get the name for PID 2408.
22:31:43: Could not get the name for PID 2444.
22:31:43: Could not get the name for PID 2476.
22:31:43: Could not get the name for PID 2504.
22:31:43: Could not get the name for PID 2644.
22:31:43: Could not get the name for PID 2676.
22:31:43: Could not get the name for PID 3036.
22:31:43: Could not get the name for PID 3152.
22:31:43: Could not get the name for PID 3232.
22:31:43: Could not get the name for PID 3476.
22:31:43: Could not get the name for PID 3484.
22:31:43: Could not get the name for PID 3492.
22:31:43: Could not get the name for PID 3500.
22:31:43: Could not get the name for PID 3516.
22:31:43: Could not get the name for PID 3604.
22:31:43: Could not get the name for PID 3652.
22:31:43: Could not get the name for PID 3668.
22:31:43: Could not get the name for PID 3676.
22:31:43: Could not get the name for PID 3684.
22:31:43: Could not get the name for PID 3700.
22:31:43: Could not get the name for PID 3740.
22:31:43: Could not get the name for PID 3768.
22:31:43: Could not get the name for PID 3936.
22:31:43: Could not get the name for PID 3948.
22:31:43: Could not get the name for PID 3996.
22:31:43: Could not get the name for PID 2276.
22:31:43: Could not get the name for PID 2332.
22:31:43: Could not get the name for PID 3784.
22:31:43: Could not get the name for PID 4172.
22:31:43: Could not get the name for PID 5224.
22:31:43: Could not get the name for PID 1668.
22:31:43: Could not get the name for PID 4280.
22:31:43: Could not get the name for PID 5760.
22:31:43: Could not get the name for PID 1692.
22:31:43: Could not get the name for PID 3368.
22:31:43: Could not get the name for PID 5852.
22:31:43: Could not get the name for PID 5932.
22:31:43: DeviceIoControl Error! Error Code = 0xc0000024
22:31:43: DeviceIoControl Error! Error Code = 0xc0000024
22:31:45: Warning - the number of SSDT entries from the kernel and the number on-disk are different (0 and 398).
22:31:45: DeviceIoControl Error! Error Code = 0x0
22:31:45: WARNING: The SSDT in our driver has been faked (0x00000250)!
22:31:45: DeviceIoControl Error! Error Code = 0x0
22:31:45: Could not get loaded modules!
22:31:45: DeviceIoControl Error! Error Code = 0x0
22:31:45: FOPS - DeviceIoControl Error! Error Code = 0xc0000024 Extended Info (0x000000dc)
22:31:45: Could not read system registry! Please contact the author!
22:31:45: DeviceIoControl Error! Error Code = 0x0

Pls advise the next step in the process.
Thank you,
tara
peku006
December 27, 2009, 12:27 PM UTC
Hi tara

I hope this works :)

Download and run OTS

  • Download OTS by Oldtimer to your Desktop and double-click on it to extract the files.

      NOTE: You must be logged on to the system with an account that has Administrator privileges to run this program.

  • Close ALL OTHER PROGRAMS.
  • Double-click on OTS.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
  • Click the Scan All Users checkbox on the toolbar.
  • Do not change any other settings.
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
  • Close Notepad (saving the change if necessry).

Thanks peku006
chickshakes
December 27, 2009, 5:34 PM UTC
Finally! This report ran and is pasted below.
Will await your reply and hope for good news.
Thanks,
T



OTS logfile created on: 12/27/2009 12:27:24 PM - Run 1

OTS by OldTimer - Version 3.1.14.1     Folder = C:\Users\chickshakes\Downloads

Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6000.16916)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 68.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 220.95 Gb Total Space | 162.76 Gb Free Space | 73.66% Space Free | Partition Type: NTFS

Drive D: | 11.93 Gb Total Space | 1.41 Gb Free Space | 11.83% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: CHICKSHAKES-PC

Current User Name: chickshakes

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

 

[Processes - Safe List]

ots.exe -> C:\Users\chickshakes\Downloads\OTS.exe -> [2009/12/27 12:19:28 | 00,599,040 | ---- | M] (OldTimer Tools)

firefox.exe -> C:\Program Files\Mozilla Firefox\firefox.exe -> [2009/12/22 21:30:24 | 00,908,248 | ---- | M] (Mozilla Corporation)

impulsenow.exe -> C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe -> [2009/04/07 16:09:40 | 00,323,584 | ---- | M] (Stardock Corporation)

sdwinsec.exe -> C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -> [2009/01/26 15:31:10 | 01,153,368 | ---- | M] (Safer Networking Ltd.)

nvvsvc.exe -> C:\Windows\System32\nvvsvc.exe -> [2008/12/04 02:42:00 | 00,203,296 | ---- | M] (NVIDIA Corporation)

explorer.exe -> C:\Windows\explorer.exe -> [2008/10/29 01:20:29 | 02,923,520 | ---- | M] (Microsoft Corporation)

aawservice.exe -> C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -> [2008/07/07 07:15:18 | 00,611,664 | ---- | M] (Lavasoft)

ituneshelper.exe -> C:\Program Files\iTunes\iTunesHelper.exe -> [2008/02/19 13:10:32 | 00,267,048 | ---- | M] (Apple Inc.)

ipodservice.exe -> C:\Program Files\iPod\bin\iPodService.exe -> [2008/02/19 13:10:24 | 00,504,104 | ---- | M] (Apple Inc.)

applemobiledeviceservice.exe -> C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2008/01/15 05:40:04 | 00,110,592 | ---- | M] (Apple, Inc.)

msascui.exe -> C:\Program Files\Windows Defender\MSASCui.exe -> [2007/12/05 22:31:26 | 01,006,264 | ---- | M] (Microsoft Corporation)

symlcsvc.exe -> C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -> [2007/12/05 22:12:55 | 01,245,064 | ---- | M] ()

qpcapsvc.exe -> C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe -> [2007/09/30 22:34:54 | 00,271,760 | ---- | M] ()

qpsched.exe -> C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe -> [2007/09/30 22:34:54 | 00,112,016 | ---- | M] ()

qpservice.exe -> C:\Program Files\HP\QuickPlay\QPService.exe -> [2007/09/30 22:34:14 | 00,181,544 | ---- | M] (CyberLink Corp.)

hphc_service.exe -> c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe -> [2007/09/19 20:30:52 | 00,065,536 | ---- | M] (Hewlett-Packard)

qlbctrl.exe -> C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe -> [2007/09/19 17:31:34 | 00,202,032 | ---- | M] ( Hewlett-Packard Development Company, L.P.)

syntpenh.exe -> C:\Program Files\Synaptics\SynTP\SynTPEnh.exe -> [2007/09/15 03:50:54 | 01,021,224 | ---- | M] (Synaptics, Inc.)

syntpstart.exe -> C:\Program Files\Synaptics\SynTP\SynTPStart.exe -> [2007/09/15 03:29:10 | 00,102,400 | ---- | M] (Synaptics, Inc.)

hpwamain.exe -> C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe -> [2007/09/13 11:47:52 | 00,480,560 | ---- | M] (Hewlett-Packard Development Company, L.P.)

hpkbdapp.exe -> C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe -> [2007/09/04 16:54:20 | 00,554,320 | ---- | M] ( Hewlett-Packard Development Company, L.P.)

ccsvchst.exe -> c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -> [2007/08/24 22:07:00 | 00,149,864 | ---- | M] (Symantec Corporation)

lssrvc.exe -> C:\Program Files\Common Files\LightScribe\LSSrvc.exe -> [2007/08/23 20:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company)

hpqsrmon.exe -> C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe -> [2007/08/22 19:31:16 | 00,080,896 | ---- | M] (Hewlett-Packard)

mdnsresponder.exe -> C:\Program Files\Bonjour\mDNSResponder.exe -> [2007/07/24 18:17:08 | 00,229,376 | ---- | M] (Apple Inc.)

jusched.exe -> C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe -> [2007/07/12 07:00:36 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.)

hpqtoaster.exe -> C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe -> [2007/05/16 13:43:06 | 00,677,432 | R--- | M] ()

objectdock.exe -> C:\Program Files\Stardock\Object Desktop\ObjectDock\ObjectDock.exe -> [2007/04/24 17:45:32 | 03,446,512 | ---- | M] (Stardock)

richvideo.exe -> C:\Program Files\CyberLink\Shared Files\RichVideo.exe -> [2007/01/09 05:25:30 | 00,272,024 | ---- | M] ()

wifimsg.exe -> C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe -> [2007/01/08 18:53:06 | 00,311,296 | ---- | M] (Hewlett-Packard Development Company, L.P.)

viewpointservice.exe -> C:\Program Files\Viewpoint\Common\ViewpointService.exe -> [2007/01/04 16:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation)

wmdsync.exe -> C:\Windows\WindowsMobile\wmdSync.exe -> [2006/11/02 04:45:59 | 00,215,552 | ---- | M] (Microsoft Corporation)

hpqwmiex.exe -> C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe -> [2006/05/02 18:41:28 | 00,135,168 | ---- | M] (Hewlett-Packard Development Company, L.P.)

hpwuschd2.exe -> C:\Program Files\HP\HP Software Update\hpwuSchd2.exe -> [2005/02/17 02:11:42 | 00,049,152 | ---- | M] (Hewlett-Packard Co.)

 

[Modules - Safe List]

ots.exe -> C:\Users\chickshakes\Downloads\OTS.exe -> [2009/12/27 12:19:28 | 00,599,040 | ---- | M] (OldTimer Tools)

comctl32.dll -> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll -> [2006/11/02 04:38:57 | 01,648,128 | ---- | M] (Microsoft Corporation)

 

[Win32 Services - Safe List]

(ZeppelinService) plasservice [Auto | Stopped] -> C:\Program Files\Common Files\ParetoLogic\PLAS\plasservice.exe -> [2009/02/18 14:40:36 | 00,587,216 | ---- | M] (ParetoLogic Inc.)

(SBSDWSCService) SBSD Security Center Service [Auto | Running] -> C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -> [2009/01/26 15:31:10 | 01,153,368 | ---- | M] (Safer Networking Ltd.)

(nvsvc) NVIDIA Display Driver Service [Auto | Running] -> C:\Windows\System32\nvvsvc.exe -> [2008/12/04 02:42:00 | 00,203,296 | ---- | M] (NVIDIA Corporation)

(odserv) Microsoft Office Diagnostics Service [On_Demand | Stopped] -> C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -> [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation)

(aawservice) Lavasoft Ad-Aware Service [Auto | Running] -> C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -> [2008/07/07 07:15:18 | 00,611,664 | ---- | M] (Lavasoft)

(iPod Service) iPod Service [On_Demand | Running] -> C:\Program Files\iPod\bin\iPodService.exe -> [2008/02/19 13:10:24 | 00,504,104 | ---- | M] (Apple Inc.)

(Apple Mobile Device) Apple Mobile Device [Auto | Running] -> C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -> [2008/01/15 05:40:04 | 00,110,592 | ---- | M] (Apple, Inc.)

(WinDefend) Windows Defender [Auto | Running] -> C:\Program Files\Windows Defender\MpSvc.dll -> [2007/12/05 22:31:26 | 00,265,912 | ---- | M] (Microsoft Corporation)

(Symantec Core LC) Symantec Core LC [On_Demand | Running] -> C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -> [2007/12/05 22:12:55 | 01,245,064 | ---- | M] ()

(QPCapSvc) QuickPlay Background Capture Service (QBCS) [Auto | Running] -> C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe -> [2007/09/30 22:34:54 | 00,271,760 | ---- | M] ()

(QPSched) QuickPlay Task Scheduler (QTS) [Auto | Running] -> C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe -> [2007/09/30 22:34:54 | 00,112,016 | ---- | M] ()

(HP Health Check Service) HP Health Check Service [Auto | Running] -> c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe -> [2007/09/19 20:30:52 | 00,065,536 | ---- | M] (Hewlett-Packard)

(Vongo Service) Vongo Service [On_Demand | Stopped] -> C:\Program Files\Vongo\VongoService.exe -> [2007/08/31 14:15:06 | 00,176,128 | ---- | M] (Starz Entertainment Group LLC)

(LiveUpdate Notice) LiveUpdate Notice [Auto | Running] -> c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -> [2007/08/24 22:07:00 | 00,149,864 | ---- | M] (Symantec Corporation)

(CLTNetCnService) Symantec Lic NetConnect service [Auto | Running] -> c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -> [2007/08/24 22:07:00 | 00,149,864 | ---- | M] (Symantec Corporation)

(ccSetMgr) Symantec Settings Manager [Auto | Running] -> c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -> [2007/08/24 22:07:00 | 00,149,864 | ---- | M] (Symantec Corporation)

(ccEvtMgr) Symantec Event Manager [Auto | Running] -> c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -> [2007/08/24 22:07:00 | 00,149,864 | ---- | M] (Symantec Corporation)

(LightScribeService) LightScribeService Direct Disc Labeling Service [Auto | Running] -> C:\Program Files\Common Files\LightScribe\LSSrvc.exe -> [2007/08/23 20:40:48 | 00,079,136 | ---- | M] (Hewlett-Packard Company)

(LiveUpdate) LiveUpdate [On_Demand | Stopped] -> c:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE -> [2007/08/23 13:35:00 | 03,192,184 | ---- | M] (Symantec Corporation)

(Automatic LiveUpdate Scheduler) Automatic LiveUpdate Scheduler [Disabled | Stopped] -> c:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe -> [2007/08/23 13:35:00 | 00,243,064 | ---- | M] (Symantec Corporation)

(comHost) COM Host [On_Demand | Stopped] -> c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe -> [2007/08/22 00:21:00 | 00,055,640 | ---- | M] (Symantec Corporation)

(Bonjour Service) Bonjour Service [Auto | Running] -> C:\Program Files\Bonjour\mDNSResponder.exe -> [2007/07/24 18:17:08 | 00,229,376 | ---- | M] (Apple Inc.)

(GameConsoleService) GameConsoleService [On_Demand | Stopped] -> C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe -> [2007/07/23 18:33:06 | 00,181,800 | ---- | M] (WildTangent, Inc.)

(XAudioService) XAudioService [Auto | Stopped] -> C:\Windows\System32\drivers\XAudio.exe -> [2007/07/10 09:28:08 | 00,386,560 | ---- | M] (Conexant Systems, Inc.)

(Com4Qlb) Com4Qlb [On_Demand | Stopped] -> C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -> [2007/03/05 13:30:06 | 00,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.)

(RichVideo) Cyberlink RichVideo Service(CRVS) [Auto | Running] -> C:\Program Files\CyberLink\Shared Files\RichVideo.exe -> [2007/01/09 05:25:30 | 00,272,024 | ---- | M] ()

(Viewpoint Manager Service) Viewpoint Manager Service [Auto | Running] -> C:\Program Files\Viewpoint\Common\ViewpointService.exe -> [2007/01/04 16:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation)

(ehstart) Windows Media Center Service Launcher [Auto | Stopped] -> C:\Windows\ehome\ehstart.dll -> [2006/11/02 07:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation)

(WcesComm) Windows Mobile 2003-based device connectivity [Auto | Running] -> C:\Windows\WindowsMobile\wcescomm.dll -> [2006/11/02 04:46:13 | 00,365,568 | ---- | M] (Microsoft Corporation)

(RapiMgr) Windows Mobile-based device connectivity [Auto | Running] -> C:\Windows\WindowsMobile\rapimgr.dll -> [2006/11/02 04:46:12 | 00,167,424 | ---- | M] (Microsoft Corporation)

(ose) Office Source Engine [On_Demand | Stopped] -> C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -> [2006/10/26 17:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation)

(hpqwmiex) hpqwmiex [Auto | Running] -> C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe -> [2006/05/02 18:41:28 | 00,135,168 | ---- | M] (Hewlett-Packard Development Company, L.P.)

(IDriverT) InstallDriver Table Manager [On_Demand | Stopped] -> C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -> [2005/04/04 03:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation)

 

[Driver Services - Safe List]

(MBAMSwissArmy) MBAMSwissArmy [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\mbamswissarmy.sys -> [2009/12/03 16:14:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation)

(KLIF) KLIF [File_System | System | Running] -> C:\Windows\System32\drivers\klif.sys -> [2009/02/18 14:41:10 | 00,127,768 | ---- | M] (Kaspersky Lab)

(nvlddmkm) nvlddmkm [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\nvlddmkm.sys -> [2008/12/04 02:42:00 | 07,606,688 | ---- | M] (NVIDIA Corporation)

(USBAAPL) Apple Mobile USB Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\usbaapl.sys -> [2008/01/15 05:39:58 | 00,030,464 | ---- | M] (Apple, Inc.)

(SymEvent) SymEvent [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\SYMEVENT.SYS -> [2007/12/05 22:15:03 | 00,123,952 | ---- | M] (Symantec Corporation)

(SynTP) Synaptics TouchPad Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\SynTP.sys -> [2007/09/15 03:50:56 | 00,191,408 | ---- | M] (Synaptics, Inc.)

(NAVEX15) NAVEX15 [Kernel | On_Demand | Running] -> C:\ProgramData\Symantec\Definitions\VirusDefs\20070914.008\NAVEX15.SYS -> [2007/09/14 04:00:00 | 00,865,904 | ---- | M] (Symantec Corporation)

(eeCtrl) Symantec Eraser Control driver [Kernel | System | Running] -> C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -> [2007/09/14 04:00:00 | 00,395,312 | ---- | M] (Symantec Corporation)

(EraserUtilRebootDrv) EraserUtilRebootDrv [Kernel | On_Demand | Running] -> C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -> [2007/09/14 04:00:00 | 00,112,688 | ---- | M] (Symantec Corporation)

(NAVENG) NAVENG [Kernel | On_Demand | Running] -> C:\ProgramData\Symantec\Definitions\VirusDefs\20070914.008\NAVENG.SYS -> [2007/09/14 04:00:00 | 00,081,232 | ---- | M] (Symantec Corporation)

(HdAudAddService) Microsoft UAA Function Driver for High Definition Audio Service [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\CHDART.sys -> [2007/09/09 17:12:28 | 00,176,640 | ---- | M] (Conexant Systems Inc.)

(SPBBCDrv) SPBBCDrv [Kernel | On_Demand | Stopped] -> C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -> [2007/08/17 14:23:00 | 00,446,512 | ---- | M] (Symantec Corporation)

(IDSvix86) Symantec Intrusion Prevention Driver [Kernel | On_Demand | Stopped] -> C:\ProgramData\Symantec\Definitions\SymcData\ipsdefs\20070823.002\IDSvix86.sys -> [2007/08/15 14:27:00 | 00,180,272 | ---- | M] (Symantec Corporation)

(SYMTDI) SYMTDI [Kernel | System | Running] -> C:\Windows\System32\Drivers\SYMTDI.SYS -> [2007/08/13 13:50:00 | 00,188,464 | ---- | M] (Symantec Corporation)

(SYMREDRV) SYMREDRV [Kernel | On_Demand | Running] -> C:\Windows\System32\Drivers\SYMREDRV.SYS -> [2007/08/13 13:50:00 | 00,022,320 | ---- | M] (Symantec Corporation)

(SymIMMP) SymIMMP [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\SymIM.sys -> [2007/08/09 17:27:00 | 00,031,280 | ---- | M] (Symantec Corporation)

(SymIM) Symantec Network Security Intermediate Filter Service [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\SymIM.sys -> [2007/08/09 17:27:00 | 00,031,280 | ---- | M] (Symantec Corporation)

(CO_Mon) CO_Mon [Kernel | Auto | Running] -> C:\Windows\System32\drivers\CO_Mon.sys -> [2007/08/08 16:39:00 | 00,036,056 | ---- | M] (Symantec Corporation)

(SRTSPL) SRTSPL [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\srtspl.sys -> [2007/07/30 23:43:00 | 00,317,616 | ---- | M] (Symantec Corporation)

(SRTSP) SRTSP [File_System | System | Running] -> C:\Windows\System32\drivers\srtsp.sys -> [2007/07/30 23:43:00 | 00,278,576 | ---- | M] (Symantec Corporation)

(SRTSPX) SRTSPX [Kernel | System | Running] -> C:\Windows\System32\drivers\srtspx.sys -> [2007/07/30 23:43:00 | 00,043,696 | ---- | M] (Symantec Corporation)

(HpqRemHid) HP Remote Control HID Device [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\HpqRemHid.sys -> [2007/07/11 13:30:22 | 00,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.)

(XAudio) XAudio [Kernel | Auto | Running] -> C:\Windows\System32\drivers\XAudio.sys -> [2007/07/10 09:27:56 | 00,008,704 | ---- | M] (Conexant Systems, Inc.)

(HSF_DPV) HSF_DPV [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\HSX_DPV.sys -> [2007/06/20 06:29:56 | 00,984,064 | ---- | M] (Conexant Systems, Inc.)

(HSXHWAZL) HSXHWAZL [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\HSXHWAZL.sys -> [2007/06/20 06:28:34 | 00,208,896 | ---- | M] (Conexant Systems, Inc.)

(winachsf) winachsf [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\HSX_CNXT.sys -> [2007/06/20 06:28:22 | 00,660,480 | ---- | M] (Conexant Systems, Inc.)

(HpqKbFiltr) HpqKbFilter Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\HpqKbFiltr.sys -> [2007/06/18 20:12:04 | 00,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.)

(athr) Atheros Extensible Wireless LAN device driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\athr.sys -> [2007/05/30 18:40:42 | 00,735,232 | ---- | M] (Atheros Communications, Inc.)

(rismxdp) Ricoh xD-Picture Card Driver [Kernel | Auto | Running] -> C:\Windows\System32\drivers\rixdptsk.sys -> [2007/03/22 01:02:04 | 00,037,376 | ---- | M] (REDC)

(NVENETFD) NVIDIA nForce Networking Controller Driver [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\nvmfdx32.sys -> [2007/03/06 21:15:58 | 01,059,112 | ---- | M] (NVIDIA Corporation)

(rimmptsk) rimmptsk [Kernel | Auto | Running] -> C:\Windows\System32\drivers\rimmptsk.sys -> [2007/02/24 17:42:22 | 00,039,936 | ---- | M] (REDC)

(nvsmu) nvsmu [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\nvsmu.sys -> [2007/02/16 16:50:32 | 00,012,032 | ---- | M] (NVIDIA Corporation)

(rimsptsk) rimsptsk [Kernel | Auto | Running] -> C:\Windows\System32\drivers\rimsptsk.sys -> [2007/01/23 19:40:20 | 00,042,496 | ---- | M] (REDC)

(ql2300) QLogic Fibre Channel Miniport Driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ql2300.sys -> [2006/11/02 04:51:45 | 00,900,712 | ---- | M] (QLogic Corporation)

(adp94xx) adp94xx [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adp94xx.sys -> [2006/11/02 04:51:38 | 00,420,968 | ---- | M] (Adaptec, Inc.)

(elxstor) elxstor [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\elxstor.sys -> [2006/11/02 04:51:34 | 00,316,520 | ---- | M] (Emulex)

(adpahci) adpahci [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adpahci.sys -> [2006/11/02 04:51:32 | 00,297,576 | ---- | M] (Adaptec, Inc.)

(uliahci) uliahci [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\uliahci.sys -> [2006/11/02 04:51:25 | 00,235,112 | ---- | M] (ULi Electronics Inc.)

(iaStorV) Intel RAID Controller Vista [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iastorv.sys -> [2006/11/02 04:51:25 | 00,232,040 | ---- | M] (Intel Corporation)

(adpu320) adpu320 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adpu320.sys -> [2006/11/02 04:51:00 | 00,147,048 | ---- | M] (Adaptec, Inc.)

(ulsata2) ulsata2 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ulsata2.sys -> [2006/11/02 04:50:45 | 00,115,816 | ---- | M] (Promise Technology, Inc.)

(vsmraid) vsmraid [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\vsmraid.sys -> [2006/11/02 04:50:41 | 00,112,232 | ---- | M] (VIA Technologies Inc.,Ltd)

(ql40xx) QLogic iSCSI Miniport Driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ql40xx.sys -> [2006/11/02 04:50:35 | 00,106,088 | ---- | M] (QLogic Corporation)

(UlSata) UlSata [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ulsata.sys -> [2006/11/02 04:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.)

(adpu160m) adpu160m [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\adpu160m.sys -> [2006/11/02 04:50:35 | 00,098,408 | ---- | M] (Adaptec, Inc.)

(nvraid) nvraid [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\nvraid.sys -> [2006/11/02 04:50:24 | 00,088,680 | ---- | M] (NVIDIA Corporation)

(nfrd960) nfrd960 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\nfrd960.sys -> [2006/11/02 04:50:19 | 00,045,160 | ---- | M] (IBM Corporation)

(iirsp) iirsp [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iirsp.sys -> [2006/11/02 04:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH)

(SiSRaid4) SiSRaid4 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sisraid4.sys -> [2006/11/02 04:50:16 | 00,071,784 | ---- | M] (Silicon Integrated Systems)

(nvstor) nvstor [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\nvstor.sys -> [2006/11/02 04:50:13 | 00,040,040 | ---- | M] (NVIDIA Corporation)

(aic78xx) aic78xx [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\djsvs.sys -> [2006/11/02 04:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.)

(arcsas) arcsas [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\arcsas.sys -> [2006/11/02 04:50:10 | 00,067,688 | ---- | M] (Adaptec, Inc.)

(LSI_SCSI) LSI_SCSI [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\lsi_scsi.sys -> [2006/11/02 04:50:10 | 00,065,640 | ---- | M] (LSI Logic)

(SiSRaid2) SiSRaid2 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sisraid2.sys -> [2006/11/02 04:50:10 | 00,038,504 | ---- | M] (Silicon Integrated Systems Corp.)

(HpCISSs) HpCISSs [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\hpcisss.sys -> [2006/11/02 04:50:10 | 00,037,480 | ---- | M] (Hewlett-Packard Company)

(arc) arc [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\arc.sys -> [2006/11/02 04:50:09 | 00,067,688 | ---- | M] (Adaptec, Inc.)

(iteraid) ITERAID_Service_Install [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iteraid.sys -> [2006/11/02 04:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.)

(iteatapi) ITEATAPI_Service_Install [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\iteatapi.sys -> [2006/11/02 04:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.)

(LSI_SAS) LSI_SAS [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\lsi_sas.sys -> [2006/11/02 04:50:05 | 00,065,640 | ---- | M] (LSI Logic)

(Symc8xx) Symc8xx [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\symc8xx.sys -> [2006/11/02 04:50:05 | 00,035,944 | ---- | M] (LSI Logic)

(LSI_FC) LSI_FC [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\lsi_fc.sys -> [2006/11/02 04:50:04 | 00,065,640 | ---- | M] (LSI Logic)

(Sym_u3) Sym_u3 [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sym_u3.sys -> [2006/11/02 04:50:03 | 00,034,920 | ---- | M] (LSI Logic)

(Mraid35x) Mraid35x [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\mraid35x.sys -> [2006/11/02 04:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation)

(Sym_hi) Sym_hi [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\sym_hi.sys -> [2006/11/02 04:49:56 | 00,031,848 | ---- | M] (LSI Logic)

(megasas) megasas [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\megasas.sys -> [2006/11/02 04:49:53 | 00,028,776 | ---- | M] (LSI Logic Corporation)

(viaide) viaide [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\viaide.sys -> [2006/11/02 04:49:30 | 00,017,512 | ---- | M] (VIA Technologies, Inc.)

(cmdide) cmdide [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\cmdide.sys -> [2006/11/02 04:49:28 | 00,016,488 | ---- | M] (CMD Technology, Inc.)

(aliide) aliide [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\aliide.sys -> [2006/11/02 04:49:20 | 00,014,952 | ---- | M] (Acer Laboratories Inc.)

(winusb) WinUSB Service [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\winusb.sys -> [2006/11/02 03:55:05 | 00,031,616 | ---- | M] (Microsoft Corporation)

(Brserid) Brother MFC Serial Port Interface Driver (WDM) [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\brserid.sys -> [2006/11/02 03:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.)

(BrUsbSer) Brother MFC USB Serial WDM Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\drivers\brusbser.sys -> [2006/11/02 03:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.)

(BrFiltUp) Brother USB Mass-Storage Upper Filter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\drivers\brfiltup.sys -> [2006/11/02 03:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.)

(BrFiltLo) Brother USB Mass-Storage Lower Filter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\system32\drivers\brfiltlo.sys -> [2006/11/02 03:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.)

(BrSerWdm) Brother WDM Serial driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\brserwdm.sys -> [2006/11/02 03:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.)

(BrUsbMdm) Brother MFC USB Fax Only Modem [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\brusbmdm.sys -> [2006/11/02 03:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.)

(HSFHWAZL) HSFHWAZL [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\VSTAZL3.SYS -> [2006/11/02 02:41:49 | 00,200,704 | ---- | M] (Conexant Systems, Inc.)

(ntrigdigi) N-trig HID Tablet Driver [Kernel | Disabled | Stopped] -> C:\Windows\system32\drivers\ntrigdigi.sys -> [2006/11/02 02:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies)

(E100B) Intel(R) PRO Adapter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\e100b325.sys -> [2006/11/02 02:30:54 | 00,163,328 | ---- | M] (Intel Corporation)

(E1G60) Intel(R) PRO/1000 NDIS 6 Adapter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\E1G60I32.sys -> [2006/11/02 02:30:54 | 00,117,760 | ---- | M] (Intel Corporation)

(BCM43XV) Broadcom Extensible 802.11 Network Adapter Driver [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\BCMWL6.SYS -> [2006/11/02 02:30:53 | 00,464,384 | ---- | M] (Broadcom Corporation)

(secdrv) Security Driver [Kernel | Auto | Running] -> C:\Windows\System32\drivers\secdrv.sys -> [2006/11/02 01:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

(ialm) ialm [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\igdkmd32.sys -> [2006/10/18 21:10:57 | 01,380,864 | ---- | M] (Intel Corporation)

(GEARAspiWDM) GEARAspiWDM [Kernel | On_Demand | Running] -> C:\Windows\System32\drivers\GEARAspiWDM.sys -> [2006/09/19 14:44:04 | 00,015,664 | ---- | M] (GEAR Software Inc.)

(mdmxsdk) mdmxsdk [Kernel | Auto | Running] -> C:\Windows\System32\drivers\mdmxsdk.sys -> [2006/06/18 18:26:58 | 00,012,672 | ---- | M] (Conexant)

(usbbus) LGE Mobile Composite USB Device [Kernel | On_Demand | Stopped] -> C:\Windows\System32\drivers\lgusbbus.sys -> [2005/05/26 09:01:18 | 00,021,344 | ---- | M] (LG Electronics Inc.)

 

[Registry - Safe List]

< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> -> 

HKEY_LOCAL_MACHINE\: Main\\"Local Page" -> %SystemRoot%\system32\blank.htm -> 

HKEY_LOCAL_MACHINE\: Main\\"Start Page" -> http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop -> 

HKEY_LOCAL_MACHINE\: URLSearchHooks\\"{EA756889-2338-43DB-8F07-D1CA6FB9C90D}" [HKLM] -> C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [AOLTBSearch Class] -> [2007/10/10 09:56:58 | 01,090,912 | ---- | M] (AOL LLC)

< Internet Explorer Settings [HKEY_USERS\.DEFAULT\] > -> -> 

HKEY_USERS\.DEFAULT\: "ProxyEnable" -> 0 -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-18\] > -> -> 

HKEY_USERS\S-1-5-18\: "ProxyEnable" -> 0 -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-19\] > -> -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-20\] > -> -> 

< Internet Explorer Settings [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\] > -> -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\: Main\\"Start Page" -> http://www.msn.com/ -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\: Main\\"StartPageCache" -> 1 -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\: URLSearchHooks\\"{EA756889-2338-43DB-8F07-D1CA6FB9C90D}" [HKLM] -> C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [AOLTBSearch Class] -> [2007/10/10 09:56:58 | 01,090,912 | ---- | M] (AOL LLC)

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\: URLSearchHooks\\"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2007/05/30 16:18:26 | 00,808,472 | ---- | M] (Yahoo! Inc.)

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\: "ProxyEnable" -> 0 -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\: "ProxyOverride" -> *.local -> 

< FireFox Settings [Prefs.js] > -> C:\Users\chickshakes\AppData\Roaming\Mozilla\FireFox\Profiles\rlby778t.default\prefs.js -> 

browser.startup.homepage -> "http://www.msn.com/defaulta.aspx" ->

extensions.enabledItems -> {77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F}:1.3.3 ->

extensions.enabledItems -> pirates-of-the-amazon@work:0.6.1 ->

extensions.enabledItems -> {3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}:0.9.6 ->

extensions.enabledItems -> {ada4b710-8346-4b82-8199-5de2b400a6ae}:1.9.1 ->

network.proxy.no_proxies_on -> "*.local" ->

< FireFox Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla

HKLM\software\mozilla\Firefox\Extensions ->  -> 

HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions ->  -> 

HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components -> C:\Program Files\Mozilla Firefox\components [C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2009/12/22 21:30:40 | 00,000,000 | ---D | M]

HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins -> C:\Program Files\Mozilla Firefox\plugins [C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2009/12/22 21:30:40 | 00,000,000 | ---D | M]

< FireFox Extensions [User Folders] > -> 

  -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Extensions -> [2009/04/25 16:30:37 | 00,000,000 | ---D | M]

  -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Extensions\[removed] -> [2009/04/25 16:30:37 | 00,000,000 | ---D | M]

  -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\extensions -> [2009/12/23 19:49:40 | 00,000,000 | ---D | M]

Forecastbar Enhanced   -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8} -> [2008/12/01 19:00:11 | 00,000,000 | ---D | M]

Calorie Count Toolbar   -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\extensions\{77FBF9B8-1D37-4FF2-9CED-192D8E3ABA6F} -> [2009/08/26 21:27:10 | 00,000,000 | ---D | M]

ReminderFox   -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae} -> [2009/08/05 21:02:48 | 00,000,000 | ---D | M]

  -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\extensions\[removed] -> [2008/12/03 22:39:25 | 00,000,000 | ---D | M]

  -> C:\Users\chickshakes\AppData\Roaming\Mozilla\Firefox\Profiles\rlby778t.default\extensions\pirates-of-the-amazon@work -> [2009/01/16 22:44:38 | 00,000,000 | ---D | M]

< FireFox Extensions [Program Folders] > -> 

  -> C:\Program Files\Mozilla Firefox\extensions -> [2008/08/09 18:26:41 | 00,000,000 | ---D | M]

< HOSTS File > (761 bytes and 20 lines) -> C:\Windows\System32\drivers\etc\hosts -> 

Reset Hosts

127.0.0.1       localhost

::1             localhost

< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ -> 

{02478D38-C3F9-4efb-9B51-7695ECA05670} [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [&Yahoo! Toolbar Helper] -> [2007/05/30 16:18:26 | 00,808,472 | ---- | M] (Yahoo! Inc.)

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} [HKLM] -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [Adobe PDF Link Helper] -> [2009/02/27 11:07:26 | 00,075,128 | ---- | M] (Adobe Systems Incorporated)

{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Spybot-S&D IE Protection] -> [2009/01/26 15:31:02 | 01,879,896 | ---- | M] (Safer Networking Limited)

{5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.] -> File not found

{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} [HKLM] -> c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [Reg Error: Value error.] -> [2007/08/24 20:51:00 | 00,316,784 | ---- | M] (Symantec Corporation)

{6D53EC84-6AAE-4787-AEEE-F4628F01010C} [HKLM] -> C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll [Symantec Intrusion Prevention] -> [2007/12/05 22:13:38 | 00,116,088 | ---- | M] (Symantec Corporation)

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [SSVHelper Class] -> [2007/07/12 07:00:35 | 00,501,136 | ---- | M] (Sun Microsystems, Inc.)

{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} [HKLM] -> C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [AOL Toolbar Launcher] -> [2007/10/10 09:56:58 | 01,090,912 | ---- | M] (AOL LLC)

{FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} [HKLM] -> c:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [HP Print Clips] -> [2007/08/31 14:32:24 | 00,177,504 | ---- | M] (Hewlett-Packard Co.)

< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar -> 

"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" [HKLM] -> c:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [Show Norton Toolbar] -> [2007/08/24 20:51:00 | 00,316,784 | ---- | M] (Symantec Corporation)

"{DE9C389F-3316-41A7-809B-AA305ED9D922}" [HKLM] -> C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [AIM Toolbar] -> [2007/10/10 09:56:58 | 01,090,912 | ---- | M] (AOL LLC)

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" [HKLM] -> C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [Yahoo! Toolbar] -> [2007/05/30 16:18:26 | 00,808,472 | ---- | M] (Yahoo! Inc.)

< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\Software\Microsoft\Internet Explorer\Toolbar\ -> 

WebBrowser\\"{DE9C389F-3316-41A7-809B-AA305ED9D922}" [HKLM] -> C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [AIM Toolbar] -> [2007/10/10 09:56:58 | 01,090,912 | ---- | M] (AOL LLC)

< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run -> 

"Adobe Reader Speed Launcher" -> C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe ["C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"] -> [2009/02/27 16:10:28 | 00,035,696 | ---- | M] (Adobe Systems Incorporated)

"ccApp" -> c:\Program Files\Common Files\Symantec Shared\ccApp.exe ["c:\Program Files\Common Files\Symantec Shared\ccApp.exe"] -> [2007/08/24 22:07:00 | 00,051,048 | ---- | M] (Symantec Corporation)

"HP Software Update" -> C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe] -> [2005/02/17 02:11:42 | 00,049,152 | ---- | M] (Hewlett-Packard Co.)

"hpqSRMon" -> C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe [C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe] -> [2007/08/22 19:31:16 | 00,080,896 | ---- | M] (Hewlett-Packard)

"hpWirelessAssistant" -> C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe] -> [2007/09/13 11:47:52 | 00,480,560 | ---- | M] (Hewlett-Packard Development Company, L.P.)

"isCfgWiz" -> c:\Program Files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe ["c:\Program Files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe" -G:{77CCBE0B-A541-49a9-883E-14F8337EC861} -T:Config -REBOOT] -> [2007/08/24 02:49:00 | 00,607,624 | ---- | M] (Symantec Corporation)

"iTunesHelper" -> C:\Program Files\iTunes\iTunesHelper.exe ["C:\Program Files\iTunes\iTunesHelper.exe"] -> [2008/02/19 13:10:32 | 00,267,048 | ---- | M] (Apple Inc.)

"Malwarebytes Anti-Malware (reboot)" -> C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe ["C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript] -> [2009/12/03 16:14:00 | 01,394,000 | ---- | M] (Malwarebytes Corporation)

"NvCplDaemon" -> C:\Windows\System32\NvCpl.DLL [RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup] -> [2008/12/04 02:42:00 | 13,556,256 | ---- | M] (NVIDIA Corporation)

"NvMediaCenter" -> C:\Windows\System32\NvMcTray.DLL [RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit] -> [2008/12/04 02:42:00 | 00,092,704 | ---- | M] (NVIDIA Corporation)

"OnScreenDisplay" -> C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe [C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe] -> [2007/09/04 16:54:20 | 00,554,320 | ---- | M] ( Hewlett-Packard Development Company, L.P.)

"QlbCtrl" -> C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start] -> [2007/09/19 17:31:34 | 00,202,032 | ---- | M] ( Hewlett-Packard Development Company, L.P.)

"QPService" -> C:\Program Files\HP\QuickPlay\QPService.exe ["C:\Program Files\HP\QuickPlay\QPService.exe"] -> [2007/09/30 22:34:14 | 00,181,544 | ---- | M] (CyberLink Corp.)

"QuickTime Task" -> C:\Program Files\QuickTime\QTTask.exe ["C:\Program Files\QuickTime\QTTask.exe" -atboottime] -> [2008/02/01 02:13:08 | 00,385,024 | ---- | M] (Apple Inc.)

"SunJavaUpdateSched" -> C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe ["C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"] -> [2007/07/12 07:00:36 | 00,132,496 | ---- | M] (Sun Microsystems, Inc.)

"SynTPStart" -> C:\Program Files\Synaptics\SynTP\SynTPStart.exe [C:\Program Files\Synaptics\SynTP\SynTPStart.exe] -> [2007/09/15 03:29:10 | 00,102,400 | ---- | M] (Synaptics, Inc.)

"UCam_Menu" -> C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe ["C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"] -> [2007/08/17 02:13:28 | 00,218,408 | ---- | M] (CyberLink Corp.)

"WAWifiMessage" -> C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe] -> [2007/01/08 18:53:06 | 00,311,296 | ---- | M] (Hewlett-Packard Development Company, L.P.)

"Windows Defender" -> C:\Program Files\Windows Defender\MSASCui.exe [%ProgramFiles%\Windows Defender\MSASCui.exe -hide] -> [2007/12/05 22:31:26 | 01,006,264 | ---- | M] (Microsoft Corporation)

"Windows Mobile-based device management" -> C:\Windows\WindowsMobile\wmdSync.exe [%windir%\WindowsMobile\wmdSync.exe] -> [2006/11/02 04:45:59 | 00,215,552 | ---- | M] (Microsoft Corporation)

< Software Policy Settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer -> 

< Software Policy Settings [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Policies\Microsoft\Internet Explorer -> 

< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDrives" ->  [0] -> File not found

< CurrentVersion Policy Settings - System [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats

< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

\\"NoDrives" ->  [0] -> File not found

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System -> 

< Internet Explorer Menu Extensions [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\Software\Microsoft\Internet Explorer\MenuExt\ -> 

&AOL Toolbar Search -> c:\Program Files\AOL\AIM Toolbar 5.0\resources\en-us\local\search.html [c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html] -> [2006/09/07 15:59:50 | 00,000,747 | ---- | M] ()

< Internet Explorer Extensions [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ -> 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}:{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} [HKLM] -> C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [Menu: Sun Java Console] -> [2007/07/12 07:00:35 | 00,501,136 | ---- | M] (Sun Microsystems, Inc.)

{2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll [Button: Send to OneNote] -> [2008/10/25 07:52:00 | 00,604,056 | ---- | M] (Microsoft Corporation)

{2670000A-7350-4f3c-8081-5663EE0C6C49}:{48E73304-E1D6-4330-914C-F5F514E3486C} [HKLM] -> C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll [Menu: S&end to OneNote] -> [2008/10/25 07:52:00 | 00,604,056 | ---- | M] (Microsoft Corporation)

{3369AF0D-62E9-4bda-8103-B4C75499B578}:{DE9C389F-3316-41A7-809B-AA305ED9D922} [HKLM] -> C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll [Button: AIM Toolbar] -> [2007/10/10 09:56:58 | 01,090,912 | ---- | M] (AOL LLC)

{58ECB495-38F0-49cb-A538-10282ABF65E7}:{A93C41D8-01F8-4F8B-B14C-DE20B117E636} [HKLM] -> c:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll [Button: HP Smart Select] -> [2007/08/31 14:34:58 | 00,152,928 | ---- | M] (Hewlett-Packard Co.)

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}:{53707962-6F74-2D53-2644-206D7942484F} [HKLM] -> C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Menu: Spybot - Search && Destroy Configuration] -> [2009/01/26 15:31:02 | 01,879,896 | ---- | M] (Safer Networking Limited)

< Internet Explorer Plugins [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Plugins\ -> 

< Default Prefix > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix

"" -> http://

< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 1 range(s) found. -> 

Range1 [:Range = 127.0.0.1] -> http = Local intranet |  -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 1 range(s) found. -> 

Range1 [:Range = 127.0.0.1] -> http = Local intranet |  -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-19\] > -> HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-20\] > -> HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 0 range(s) found. -> 

< Trusted Sites Domains [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 0 domain(s) found. -> 

< Trusted Sites Ranges [HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\] > -> HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> 

HKEY_USERS\S-1-5-21-2580806079-989220257-3569232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\ -> [Key] 1 range(s) found. -> 

Range1 [:Range = 127.0.0.1] -> http = Local intranet |  -> 

< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ -> 

DhcpNameServer -> 192.168.1.1 -> 

< Name Servers [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ -> 

{7E85BAFE-5A5C-409B-8A9C-05857CD040A3}\\DhcpNameServer -> 192.168.1.1   (Atheros AR5007 802.11b/g WiFi Adapter) -> 

< Winlogon settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon -> 

*Shell* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell -> 

Explorer.exe -> C:\Windows\explorer.exe -> [2008/10/29 01:20:29 | 02,923,520 | ---- | M] (Microsoft Corporation)

*MultiFile Done* -> -> 

< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks -> 

"{AEB6717E-7E19-11d0-97EE-00C04FD91972}" [HKLM] -> Reg Error: Key error. [] -> File not found

< Domain Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List -> 

"" ->  [] -> File not found

"C:\Program Files\Vongo\VongoService.exe" -> C:\Program Files\Vongo\VongoService.exe [C:\Program Files\Vongo\VongoService.exe:*:enabled:VongoService] -> [2007/08/31 14:15:06 | 00,176,128 | ---- | M] (Starz Entertainment Group LLC)

< Standard Profile Authorized Applications List > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List -> 

"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -> C:\Program Files\EarthLink TotalAccess\TaskPanl.exe [C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink] -> [2006/08/30 15:35:12 | 00,952,088 | ---- | M] (EarthLink, Inc.)

< SafeBoot AlternateShell [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot -> 

< CDROM Autorun Setting [HKEY_LOCAL_MACHINE]> -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom ->

"AutoRun" -> 1 -> 

"DisplayName" -> CD-ROM Driver -> 

"ImagePath" ->  [system32\DRIVERS\cdrom.sys] -> File not found

< Drives with AutoRun files > ->  -> 

C:\autoexec.bat [REM Dummy file for NTVDMPATH=%PATH%;C:\PROGRA~1\COMMON~1\MUVEET~1\030625 | ] -> C:\autoexec.bat [ NTFS ] -> [2007/12/05 23:36:21 | 00,000,074 | ---- | M] ()

D:\AUTOMODE [@echo off | IF EXIST C:\ST_RP\MANUALMODE ECHO MANUAL BATCH MODE ALREADY SET ! | IF NOT EXIST C:\ST_RP\MANUALMODE ECHO SET TO MANUAL BATCH EXECUTION ! | IF NOT EXIST C:\ST_RP\MANUALMODE IF EXIST C:\ST_RP\AUTOMODE DEL C:\ST_RP\AUTOMODE /F > NUL | IF NOT EXIST C:\ST_RP\MANUALMODE COPY C:\ST_RP\SET_AUTO_MODE.CMD C:\ST_RP\MANUALMODE > NUL | ECHO. | ] -> D:\AUTOMODE [ NTFS ] -> [2005/09/11 10:18:54 | 00,000,340 | -HS- | M] ()

< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 -> 

< Registry Shell Spawning - Select to Repair > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command -> 

comfile [open] -> "%1" %* -> 

exefile [open] -> "%1" %* -> 

 

 

[Files/Folders - Created Within 30 Days]

 temp -> C:\Windows\temp -> [2009/12/22 15:41:26 | 00,000,000 | ---D | C]

 temp -> C:\Users\chickshakes\AppData\Local\temp -> [2009/12/22 15:41:26 | 00,000,000 | ---D | C]

 SWXCACLS.exe -> C:\Windows\SWXCACLS.exe -> [2009/12/22 15:15:52 | 00,212,480 | ---- | C] (SteelWerX)

 SWREG.exe -> C:\Windows\SWREG.exe -> [2009/12/22 15:15:52 | 00,161,792 | ---- | C] (SteelWerX)

 SWSC.exe -> C:\Windows\SWSC.exe -> [2009/12/22 15:15:52 | 00,136,704 | ---- | C] (SteelWerX)

 NIRCMD.exe -> C:\Windows\NIRCMD.exe -> [2009/12/22 15:15:52 | 00,031,232 | ---- | C] (NirSoft)

 ERDNT -> C:\Windows\ERDNT -> [2009/12/22 15:15:43 | 00,000,000 | ---D | C]

 Qoobox -> C:\Qoobox -> [2009/12/22 15:13:24 | 00,000,000 | ---D | C]

 rsit -> C:\rsit -> [2009/12/22 11:48:23 | 00,000,000 | ---D | C]

 Trend Micro -> C:\Program Files\Trend Micro -> [2009/12/16 21:55:16 | 00,000,000 | ---D | C]

 ParetoLogic Anti-Virus PLUS -> C:\ProgramData\ParetoLogic Anti-Virus PLUS -> [2009/12/16 21:45:55 | 00,000,000 | ---D | C]

 ParetoLogic -> C:\ProgramData\ParetoLogic -> [2009/12/16 21:45:55 | 00,000,000 | ---D | C]

 ParetoLogic -> C:\Program Files\ParetoLogic -> [2009/12/16 21:45:55 | 00,000,000 | ---D | C]

 ParetoLogic -> C:\Program Files\Common Files\ParetoLogic -> [2009/12/16 21:45:55 | 00,000,000 | ---D | C]

 Spybot - Search & Destroy -> C:\ProgramData\Spybot - Search & Destroy -> [2009/12/12 13:24:27 | 00,000,000 | ---D | C]

 Spybot - Search & Destroy -> C:\Program Files\Spybot - Search & Destroy -> [2009/12/12 13:24:27 | 00,000,000 | ---D | C]

 Microsoft Help -> C:\Users\chickshakes\AppData\Local\Microsoft Help -> [2009/12/06 14:52:41 | 00,000,000 | ---D | C]

 tzres.dll -> C:\Windows\System32\tzres.dll -> [2009/11/29 03:03:37 | 00,002,048 | ---- | C] (Microsoft Corporation)

 

[Files/Folders - Modified Within 30 Days]

 NTUSER.DAT -> C:\Users\chickshakes\NTUSER.DAT -> [2009/12/27 12:27:11 | 03,670,016 | -HS- | M] ()

 fidbox.dat -> C:\Windows\System32\drivers\fidbox.dat -> [2009/12/27 12:17:37 | 01,292,064 | -HS- | M] ()

 bootstat.dat -> C:\Windows\bootstat.dat -> [2009/12/27 12:16:23 | 00,067,584 | --S- | M] ()

 7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 -> [2009/12/27 12:16:20 | 00,003,072 | -H-- | M] ()

 7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -> C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 -> [2009/12/27 12:16:20 | 00,003,072 | -H-- | M] ()

 settings.dat -> C:\Windows\System32\settings.dat -> [2009/12/26 22:25:26 | 00,000,000 | ---- | M] ()

 User_Feed_Synchronization-{E60CA63E-D9D6-44AA-B631-867EE795316A}.job -> C:\Windows\tasks\User_Feed_Synchronization-{E60CA63E-D9D6-44AA-B631-867EE795316A}.job -> [2009/12/26 18:15:52 | 00,000,430 | -H-- | M] ()

 Launch Anti-Virus PLUS.lnk -> C:\Users\Public\Desktop\Launch Anti-Virus PLUS.lnk -> [2009/12/23 19:18:50 | 00,002,563 | ---- | M] ()

 ParetoLogic Anti-Virus PLUS_dbsummary.job -> C:\Windows\tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job -> [2009/12/23 18:00:02 | 00,000,454 | ---- | M] ()

 ParetoLogic Registration.job -> C:\Windows\tasks\ParetoLogic Registration.job -> [2009/12/23 18:00:01 | 00,000,454 | ---- | M] ()

 system.ini -> C:\Windows\system.ini -> [2009/12/22 15:33:59 | 00,000,215 | ---- | M] ()

 ParetoLogic Update Version2.job -> C:\Windows\tasks\ParetoLogic Update Version2.job -> [2009/12/22 15:07:15 | 00,000,428 | ---- | M] ()

 rollback.ini -> C:\rollback.ini -> [2009/12/22 15:05:56 | 00,000,000 | ---- | M] ()

 PerfStringBackup.INI -> C:\Windows\System32\PerfStringBackup.INI -> [2009/12/22 14:43:23 | 00,716,948 | ---- | M] ()

 perfh009.dat -> C:\Windows\System32\perfh009.dat -> [2009/12/22 14:43:23 | 00,618,648 | ---- | M] ()

 perfc009.dat -> C:\Windows\System32\perfc009.dat -> [2009/12/22 14:43:23 | 00,104,024 | ---- | M] ()

 nvModes.001 -> C:\ProgramData\nvModes.001 -> [2009/12/22 14:36:52 | 00,028,409 | ---- | M] ()

 hpqp.ini -> C:\Users\Public\Documents\hpqp.ini -> [2009/12/22 14:36:38 | 00,000,162 | ---- | M] ()

 ParetoLogic Anti-Virus PLUS.job -> C:\Windows\tasks\ParetoLogic Anti-Virus PLUS.job -> [2009/12/22 14:35:33 | 00,000,478 | ---- | M] ()

 SA.DAT -> C:\Windows\tasks\SA.DAT -> [2009/12/22 14:35:33 | 00,000,006 | -H-- | M] ()

 hiberfil.sys -> C:\hiberfil.sys -> [2009/12/22 14:34:33 | 20,792,48384 | -HS- | M] ()

 fidbox.idx -> C:\Windows\System32\drivers\fidbox.idx -> [2009/12/22 14:33:39 | 00,010,040 | -HS- | M] ()

 IconCache.db -> C:\Users\chickshakes\AppData\Local\IconCache.db -> [2009/12/22 14:32:56 | 02,608,548 | -H-- | M] ()

 nvModes.dat -> C:\ProgramData\nvModes.dat -> [2009/12/22 14:25:50 | 00,028,409 | ---- | M] ()

 Malwarebytes' Anti-Malware.lnk -> C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/12/22 13:21:23 | 00,000,818 | ---- | M] ()

 HijackThis.lnk -> C:\Users\chickshakes\Desktop\HijackThis.lnk -> [2009/12/16 21:55:17 | 00,001,874 | ---- | M] ()

 Spybot - Search & Destroy.lnk -> C:\Users\chickshakes\Desktop\Spybot - Search & Destroy.lnk -> [2009/12/16 20:42:17 | 00,001,073 | ---- | M] ()

 d3d9caps.dat -> C:\Users\chickshakes\AppData\Local\d3d9caps.dat -> [2009/12/15 23:59:00 | 00,006,944 | ---- | M] ()

 PEV.exe -> C:\Windows\PEV.exe -> [2009/12/09 22:54:07 | 00,261,632 | ---- | M] ()

 GDIPFONTCACHEV1.DAT -> C:\Users\chickshakes\AppData\Local\GDIPFONTCACHEV1.DAT -> [2009/12/07 19:25:04 | 00,076,960 | ---- | M] ()

 FNTCACHE.DAT -> C:\Windows\System32\FNTCACHE.DAT -> [2009/12/07 19:23:00 | 00,307,096 | ---- | M] ()

 mbamswissarmy.sys -> C:\Windows\System32\drivers\mbamswissarmy.sys -> [2009/12/03 16:14:06 | 00,038,224 | ---- | M] (Malwarebytes Corporation)

 mbam.sys -> C:\Windows\System32\drivers\mbam.sys -> [2009/12/03 16:13:56 | 00,019,160 | ---- | M] (Malwarebytes Corporation)

 

[Files - No Company Name]

 settings.dat -> C:\Windows\System32\settings.dat -> [2009/12/26 22:25:26 | 00,000,000 | ---- | C] ()

 PEV.exe -> C:\Windows\PEV.exe -> [2009/12/22 15:15:52 | 00,261,632 | ---- | C] ()

 sed.exe -> C:\Windows\sed.exe -> [2009/12/22 15:15:52 | 00,098,816 | ---- | C] ()

 grep.exe -> C:\Windows\grep.exe -> [2009/12/22 15:15:52 | 00,080,412 | ---- | C] ()

 MBR.exe -> C:\Windows\MBR.exe -> [2009/12/22 15:15:52 | 00,077,312 | ---- | C] ()

 zip.exe -> C:\Windows\zip.exe -> [2009/12/22 15:15:52 | 00,068,096 | ---- | C] ()

 rollback.ini -> C:\rollback.ini -> [2009/12/22 15:05:56 | 00,000,000 | ---- | C] ()

 HijackThis.lnk -> C:\Users\chickshakes\Desktop\HijackThis.lnk -> [2009/12/16 21:55:17 | 00,001,874 | ---- | C] ()

 ParetoLogic Registration.job -> C:\Windows\tasks\ParetoLogic Registration.job -> [2009/12/16 21:52:53 | 00,000,454 | ---- | C] ()

 fidbox.dat -> C:\Windows\System32\drivers\fidbox.dat -> [2009/12/16 21:52:52 | 01,292,064 | -HS- | C] ()

 fidbox.idx -> C:\Windows\System32\drivers\fidbox.idx -> [2009/12/16 21:52:52 | 00,010,040 | -HS- | C] ()

 ParetoLogic Anti-Virus PLUS_dbsummary.job -> C:\Windows\tasks\ParetoLogic Anti-Virus PLUS_dbsummary.job -> [2009/12/16 21:46:40 | 00,000,454 | ---- | C] ()

 ParetoLogic Anti-Virus PLUS.job -> C:\Windows\tasks\ParetoLogic Anti-Virus PLUS.job -> [2009/12/16 21:46:33 | 00,000,478 | ---- | C] ()

 ParetoLogic Update Version2.job -> C:\Windows\tasks\ParetoLogic Update Version2.job -> [2009/12/16 21:46:32 | 00,000,428 | ---- | C] ()

 Launch Anti-Virus PLUS.lnk -> C:\Users\Public\Desktop\Launch Anti-Virus PLUS.lnk -> [2009/12/16 21:46:06 | 00,002,563 | ---- | C] ()

 Spybot - Search & Destroy.lnk -> C:\Users\chickshakes\Desktop\Spybot - Search & Destroy.lnk -> [2009/12/16 20:42:17 | 00,001,073 | ---- | C] ()

 Malwarebytes' Anti-Malware.lnk -> C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk -> [2009/12/16 20:41:24 | 00,000,818 | ---- | C] ()

 INetHTTPFilter.dll -> C:\Windows\System32\INetHTTPFilter.dll -> [2009/02/18 14:43:08 | 00,111,960 | ---- | C] ()

 ODBC.INI -> C:\Windows\ODBC.INI -> [2008/12/01 20:14:41 | 00,000,376 | ---- | C] ()

 qt-dx331.dll -> C:\Windows\System32\qt-dx331.dll -> [2008/11/06 11:37:32 | 03,596,288 | ---- | C] ()

 dtu100.dll.manifest -> C:\Windows\System32\dtu100.dll.manifest -> [2008/11/06 11:34:00 | 00,000,416 | ---- | C] ()

 dpl100.dll.manifest -> C:\Windows\System32\dpl100.dll.manifest -> [2008/11/06 11:34:00 | 00,000,416 | ---- | C] ()

 DivXWMPExtType.dll -> C:\Windows\System32\DivXWMPExtType.dll -> [2008/11/06 11:33:02 | 00,012,288 | ---- | C] ()

 rixdicon.dll -> C:\Windows\System32\rixdicon.dll -> [2007/12/29 20:46:58 | 00,016,480 | ---- | C] ()

 GlobalUserInterface.CompositeFont -> C:\Windows\Fonts\GlobalUserInterface.CompositeFont -> [2006/11/02 07:37:35 | 00,030,808 | ---- | C] ()

 GlobalSerif.CompositeFont -> C:\Windows\Fonts\GlobalSerif.CompositeFont -> [2006/11/02 07:37:35 | 00,029,779 | ---- | C] ()

 GlobalSansSerif.CompositeFont -> C:\Windows\Fonts\GlobalSansSerif.CompositeFont -> [2006/11/02 07:37:35 | 00,026,489 | ---- | C] ()

 GlobalMonospace.CompositeFont -> C:\Windows\Fonts\GlobalMonospace.CompositeFont -> [2006/11/02 07:37:35 | 00,026,040 | ---- | C] ()

 sysprepMCE.dll -> C:\Windows\System32\sysprepMCE.dll -> [2006/11/02 07:35:32 | 00,005,632 | ---- | C] ()

 igfxTMM.dll -> C:\Windows\System32\igfxTMM.dll -> [2006/11/02 05:25:21 | 00,061,440 | ---- | C] ()

 pacerprf.ini -> C:\Windows\System32\pacerprf.ini -> [2006/11/02 02:40:29 | 00,013,750 | ---- | C] ()

 WdfCoInstaller01000.dll -> C:\Windows\System32\WdfCoInstaller01000.dll -> [2006/03/09 17:58:00 | 01,060,424 | ---- | C] ()

 OUTLPERF.INI -> C:\Windows\System32\OUTLPERF.INI -> [2003/01/07 15:05:08 | 00,002,695 | ---- | C] ()

 

[HardLinks - Junction Points - Mount Points - Symbolic Links]

capilock.dat -> C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\capilock.dat -> HardLink

 

[Alternate Data Streams]

@Alternate Data Stream - 111 bytes -> C:\ProgramData\TEMP:A5B56640

< End of report >